exploit.php

<?php
/** 

RIPS - A static source code analyser for vulnerabilities in PHP scripts 
	by Johannes Dahse (johannesdahse@gmx.de)
			
			
Copyright (C) 2010 Johannes Dahse

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, see <http://www.gnu.org/licenses/>.	

**/

if(!empty($_GET['file']))
{
	$file = $_GET['file'];
?>

<div style="padding: 20px; width: 400px">
	
<div style='width: 300px'>
	#!/usr/bin/php -f<br>
	&lt;?php<br>
	#<br>
	# <?php echo basename($file); ?> curl exploit<br>
	#<br><br>
</div>

<div id="exploitbuild">
<div class="exploitbox">
	<div class="exploittitlebox">
		<div class="exploittitle">general settings:</div>
		<div style="clear: left;"></div>
	</div>

	<div class="exploitcontentbox">
	<table>
	<tr>
		<td>URL:</td>
		<td><input type="text" size="40" id="target" name="target" value="http://$target/<?php echo basename($file); ?>" /></td>
	</tr>
	<tr>
		<td>COOKIEJAR:</td>
		<td><input type="text" id="cookiejar" name="cookiejar" value="/tmp/cookie_$target" /></td>
	</tr>
	<tr>
		<td>Max Exec Time:</td>
		<td><input type="text" id="exectime" size=2 name="exectime" value="3" /> (s)</td>
	</tr>
	<tr>
		<td>SSL: <input type="checkbox" id="ssl" name="ssl" value="1" onChange="setssl()" /></td>
		<td>BasicAuth: <input type="checkbox" id="auth" name="auth" value="1" /></td>
	</tr>
	</table>
	</div>
</div>

<?php
	
	function creatediv($method, $name)
	{
		if(!empty($method))
		{
			$method = htmlentities($method, ENT_QUOTES, 'utf-8');
?>		

<div id="<?php echo $name.'box'; ?>" class="exploitbox">
	<div class="exploittitlebox">
		<div class="exploittitle"><?php echo $name ?> parameter:</div>
		<input type="button" class="closebutton" value="x" onClick="deleteMethod('<?php echo $name; ?>')" />
		<div style="clear: left;"></div>
	</div>

	<div class="exploitcontentbox" id="<?php echo $name.$param; ?>">
	<form id="<?php echo $name; ?>">
		<table cellspacing=0px cellpadding=2px>
<?php		
			$params =  explode(',', $method);
			foreach($params as $param)
			{
				$param = htmlentities($param, ENT_QUOTES, 'utf-8');
				echo "\n<tr><td>$param:</td>\n",
				"\t<td colspan='2'><input type='text' name='$param' value=''></td>\n",
				'</tr>';	
			}
?>
		</table>
	</form>
	</div>	
</div>	
<?php			
		}
	}
	
	if(isset($_GET['get'])) creatediv($_GET['get'], '$_GET');
	if(isset($_GET['post'])) creatediv($_GET['post'], '$_POST');
	if(isset($_GET['cookie'])) creatediv($_GET['cookie'], '$_COOKIE');
	if(isset($_GET['files'])) creatediv($_GET['files'], '$_FILES');
	if(isset($_GET['server'])) creatediv($_GET['server'], '$_SERVER');

	
?>
	
	<input type="button" class="Button" value="create" onClick="createExploit()" />&nbsp;
	<br /><br />
</div>	

<div id="exploitcode" style="display:none;"></div>
	?&gt;
</div>	
<?php
} else
{
	echo 'No file loaded';
}

?>