n0gada
Source-scoped identity with 1 associated PoC and 1 linked vulnerability.
Exploit catalog results
Showing 1 PoC on this page
ExploitDBZeroBoard 4.1 - 'preg_replace' Remote Nobody Shell
ExploitDB exploitPublished 2005-05-31ExploitCVE-2005-18201 file
Analysis
Technical assessment
A C program that exploits a preg_replace vulnerability in Zeroboard 4.1 to upload a PHP webshell and execute arbitrary commands on the target server.
Backdoor review
No backdoor observed in reviewed code
The supplied C source code is a public exploit for CVE-2005-1820 that uploads a PHP webshell to a vulnerable Zeroboard instance. All actions are consistent with the stated exploit purpose: writing a post containing a PHP file, triggering the preg_replace vulnerability to rename it to shell.php, confirming the shell, and deleting the post. No concealed backdoor, unrelated payload, or operator-directed harm was observed.
Classification basis and observed behavior
Classification basis
The code actively exploits a vulnerability by sending crafted HTTP requests to upload a webshell and execute a shell command on the target, which is the definition of an exploit.
exploits/php/webapps/1020.c:246-247exploits/php/webapps/1020.c:261-272exploits/php/webapps/1020.c:410-418Requirements
- Target running Zeroboard 4.1 pl2 to 4.1 pl5 with the vulnerable zboard.php endpoint accessible.
exploits/php/webapps/1020.c:17 - Network connectivity to the target web server on the specified port (default 80).
exploits/php/webapps/1020.c:86-87
Observed behavior
- Parses a target URL to extract host, directory, and board ID.
exploits/php/webapps/1020.c:104-135 - Connects to the target web server via TCP socket.
exploits/php/webapps/1020.c:138-161 - Sends a multipart POST request to write_ok.php containing a PHP webshell as a file upload and a shell command in the memo field to move the uploaded file to a web-accessible location.
exploits/php/webapps/1020.c:163-398 - Sends a crafted GET request to view.php with a keyword parameter containing a null byte injection to trigger the preg_replace vulnerability and execute the shell command.
exploits/php/webapps/1020.c:400-485 - Verifies the webshell is accessible by requesting the generated shell.php file.
exploits/php/webapps/1020.c:487-554 - Deletes the article used in the exploit by sending a POST request to delete_ok.php.
exploits/php/webapps/1020.c:557-633
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe exploit writes a post containing a PHP file (lines 246-272) that provides a command execution interface. This is the intended exploit payload.
exploits/php/webapps/1020.c:246-272 - Exploit Behavior
- Payload withheldThe exploit sends a crafted GET request with a null-byte injection to trigger preg_replace and rename the uploaded file to shell.php (lines 410-426). This matches the CVE description.
exploits/php/webapps/1020.c:410-426 - Exploit Behavior
- Payload withheldThe exploit checks for HTTP 200 OK on the generated shell.php to confirm successful exploitation (lines 495-505, 530-534).
exploits/php/webapps/1020.c:495-505exploits/php/webapps/1020.c:530-534 - Exploit Behavior
- Payload withheldThe exploit sends a POST request to delete_ok.php to remove the article containing the exploit payload (lines 566-582). This is a cleanup step.
exploits/php/webapps/1020.c:566-582
What the analysis did not establish
- Only the exploit source code was reviewed; the target application and runtime behavior were not analyzed.
- The exploit uploads a PHP webshell to the target server, which could be used maliciously by anyone who discovers it, but this is inherent to the exploit's purpose and not a backdoor against the person running the PoC.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.