bugtraq
[Top] [All Lists]

Re: LuckyBot v3 Remote File Include

To: bugtraq@securityfocus.com
Subject: Re: LuckyBot v3 Remote File Include
From: Stuart Moore <smoore.bugtraq@securityglobal.net>
Date: Tue, 26 Dec 2006 18:33:52 -0500
Delivered-to: sp-com-lists@consult.net
Delivered-to: bugtraq-list@securepoint.com
Delivered-to: mailing list bugtraq@securityfocus.com
Delivered-to: moderator for bugtraq@securityfocus.com
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@securityfocus.com; run by ezmlm
User-agent: Thunderbird 1.5.0.9 (Windows/20061207)
Hi,

> www.Example.com/[Lucky]/run.php?dir=SHELL?&file=
> www.Example.com/[Lucky]/classes/ircbot.class.php?dir=SHELL?&file=

In 'run.php', the include statement ( include_once $dir . $file; ) is within a function:

  include_dir($dir)

It appears that the function is never called with user-controllable input.

In 'classes/ircbot.class.php', the include statement ( include $dir . $file ."/plugin.php"; ) is also within a function:

  load_plugins($dir)

Again, it appears that the function is never called with user-controllable input.

Did you test this?

Stuart

<Prev in Thread] Current Thread [Next in Thread>