Skip to content

Commit 058dc20

Browse files
shraddha761shraddha761
committed
RPCScan script
1 parent 858aa63 commit 058dc20

5 files changed

Lines changed: 284 additions & 0 deletions

File tree

‎RPCScan/Readme.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# RPCScan
2+
3+
A python tool to automate all the efforts that you put on finding the xmlrpc.php file on all of your targets subdomains and then finding the vulnerable methods and then finding the reports on hackerone and medium writeups.

‎RPCScan/scanner.py‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
from colorama import Fore
2+
import re
3+
import requests
4+
import os
5+
import sys
6+
import urllib3
7+
8+
url = sys.argv[1]
9+
urllib3.disable_warnings()
10+
http = urllib3.PoolManager(cert_reqs='CERT_NONE')
11+
12+
print(f"{Fore.BLUE}[!] Checking if Mod_Security waf is present [!]")
13+
checkxml = """<methodCall>
14+
<methodName>system.listMethods</methodName>
15+
<params></params>
16+
</methodCall>"""
17+
headers = {'Content-Type': 'application/xml'}
18+
url = f"{url}/xmlrpc.php"
19+
postresp = requests.post(url, data=checkxml, headers=headers, verify=False).text
20+
if re.search("Mod_Security", postresp):
21+
print(f"{Fore.RED}[!] Potential: Target is protected by Mod_Security WAF [!]")
22+
print("[!] Interrupting Attack [!]")
23+
sys.exit(0)
24+
else:
25+
print("[!] Mod_Security not found [!]")
26+
print(f"[!] Confidence: 100% [!]")
27+
28+
print(f"{Fore.BLUE}[!] Checking for DDOS exploit(pingback.ping method) [!]")
29+
if re.search("pingback.ping", postresp):
30+
print(f"{Fore.GREEN}[!] {Fore.RED}Potential: {Fore.BLUE}Method pingback.ping enabled {Fore.GREEN}[!]")
31+
print(f"{Fore.GREEN}[!] {Fore.RED}Potential: {Fore.BLUE}Possibly this domain can be used as a botnet in a DDOS attack {Fore.GREEN}[!]")
32+
print(f"{Fore.GREEN}[!] {Fore.RED}Potential: {Fore.BLUE}Possible internal port scanning. [!]")
33+
else:
34+
print(f"{Fore.GREEN}[!] Method pingback.ping not found [!]")
35+
36+
print(f"{Fore.BLUE}[!] Checking if Bruteforce is Possible(wp.getUserBlogs) [!]")
37+
if re.search("wp.getUserBlogs", postresp):
38+
print(f"{Fore.GREEN}[!] {Fore.RED}Potential: {Fore.BLUE}Method wp.getUserBlogs enabled {Fore.GREEN}[!]")
39+
print(f"{Fore.GREEN}[!] {Fore.RED}Potential: {Fore.BLUE} Accounts can be cracked by taking advantage of this method {Fore.GREEN}[!]")
40+
else:
41+
print(f"{Fore.GREEN}[!] Method wp.getUserBlogs not found [!]")
42+
43+
inp = input("Do you want to check all the available XMLRPC methods that are allowed? (y/any key) : ")
44+
45+
if inp=='y':
46+
ask=input("Do you want to save this response in a file for futher testing? (y/any key) : ")
47+
if ask=="y":
48+
filename = input("Enter the filename for output : ")
49+
try:
50+
op = open(filename, "a")
51+
op.write(postresp)
52+
print(postresp)
53+
print(f"\n[I] output saved to {filename} [I]")
54+
except:
55+
print(f"{Fore.RED}[!] Unable to open/create a file in this directory. [!]\nTry:\n\t1. Changing the directory.\n\t2. Run this script as root(if not running).")
56+
else:
57+
print(postresp)
58+
else:
59+
pass

‎RPCScan/setup.py‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
#!/bin/python3
2+
import os
3+
try:
4+
import requests
5+
except:
6+
os.system("pip3 install requests")
7+
print("Run the setup again to continue.")
8+
exit(0)
9+
import sys
10+
try:
11+
import urllib3
12+
except:
13+
os.system("pip3 install urllib3")
14+
print("Run the setup again to continue.")
15+
exit(0)
16+
try:
17+
from colorama import Fore
18+
except:
19+
os.system("pip3 install colorama")
20+
print("Run the setup again to continue.")
21+
exit(0)
22+
if len(sys.argv)>1:
23+
if sys.argv[1]=="-r":
24+
print("Repairing...")
25+
command = "rm -r .verified.rc"
26+
try:
27+
open(".verified.rc")
28+
os.system(command)
29+
except:
30+
print("Unable to repair the tool.")
31+
sys.exit(1)
32+
33+
try:
34+
open(".verified.rc")
35+
print("The tool is already configured!\nrun the command rpcscan -h to see help menu.\nNote: If you are not able to run the tool run the command python3 setup.py -r .")
36+
sys.exit(1)
37+
except:
38+
pass
39+
40+
currentdir = os.getcwd()
41+
42+
try:
43+
open("rpcscan.py")
44+
except:
45+
print("[-] rpcscan.py not found [-]")
46+
ask = input("Do you want to download rpcscan.py? (y/n) ")
47+
if ask=="y" or ask=="yes":
48+
print("Downloading....")
49+
file_content = requests.get("https://raw.githubusercontent.com/shraddha761").text
50+
file = open("rpcscan.py", "w")
51+
file.write(file_content)
52+
file.close()
53+
elif ask=="n" or "no":
54+
exit(0)
55+
else:
56+
ask = "Please type y/n : "
57+
if ask=="y" or ask=="yes":
58+
print("Downloading....")
59+
elif ask=="n" or "no":
60+
exit(0)
61+
else:
62+
exit(0)
63+
try:
64+
open("scanner.py")
65+
except:
66+
print("[-] scanner.py not found [-]")
67+
ask = input("Do you want to download scanner.py? (y/n) ")
68+
if ask=="y" or ask=="yes":
69+
print("Downloading....")
70+
file_content = requests.get("https://raw.githubusercontent.com/shraddha761").text
71+
file = open("scanner.py", "w")
72+
file.write(file_content)
73+
print("File has been downloaded now rerun this program to proceed")
74+
file.close()
75+
exit(0)
76+
elif ask=="n" or "no":
77+
exit(0)
78+
else:
79+
ask = "Please type y/n : "
80+
if ask=="y" or ask=="yes":
81+
print("Downloading....")
82+
file_content = requests.get("https://raw.githubusercontent.com/shraddha761").text
83+
file = open("scanner.py", "w")
84+
file.write(file_content)
85+
print("File has been downloaded now rerun this program to proceed")
86+
file.close()
87+
exit(0)
88+
elif ask=="n" or "no":
89+
exit(0)
90+
else:
91+
exit(0)
92+
def verifyintsall():
93+
command = "echo true >> .verified.rc"
94+
os.system(command)
95+
print("The tool is now successfully installed!\nNow you can use the command rpcscan <websitelist> to find xmlrpc.php files.")
96+
97+
def install():
98+
command = "cp rpcscan.py /usr/bin/rpcscan"
99+
try:
100+
os.system(command)
101+
except:
102+
print("Unable to setup the file.\nTry running this script as superuser.")
103+
sys.exit(1)
104+
command = "cp scanner.py /usr/bin/rpcscanner"
105+
try:
106+
os.system(command)
107+
verifyintsall()
108+
except:
109+
print("Unable to setup the file.\nTry running this script as superuser.")
110+
sys.exit(1)
111+
install()

‎RPCScan/termux.py‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
import os
2+
try:
3+
import requests
4+
except:
5+
os.system("pip3 install requests")
6+
print("Run the setup again to continue.")
7+
exit(0)
8+
import sys
9+
try:
10+
import urllib3
11+
except:
12+
os.system("pip3 install urllib3")
13+
print("Run the setup again to continue.")
14+
exit(0)
15+
try:
16+
from colorama import Fore
17+
except:
18+
os.system("pip3 install colorama")
19+
print("Run the setup again to continue.")
20+
exit(0)
21+
if len(sys.argv)>1:
22+
if sys.argv[1]=="-r":
23+
print("Repairing...")
24+
command = "rm -r .verified.rc"
25+
try:
26+
open(".verified.rc")
27+
os.system(command)
28+
except:
29+
print("Unable to repair the tool.")
30+
sys.exit(1)
31+
32+
try:
33+
open(".verified.rc")
34+
print("The tool is already configured!\nrun the command rpcscan -h to see help menu.\nNote: If you are not able to run the tool run the command python3 setup.py -r .")
35+
sys.exit(1)
36+
except:
37+
pass
38+
39+
currentdir = os.getcwd()
40+
41+
try:
42+
open("rpcscan.py")
43+
except:
44+
print("[-] rpcscan.py not found [-]")
45+
ask = input("Do you want to download rpcscan.py? (y/n) ")
46+
if ask=="y" or ask=="yes":
47+
print("Downloading....")
48+
file_content = requests.get("https://raw.githubusercontent.com//shraddha761").text
49+
file = open("rpcscan.py", "w")
50+
file.write(file_content)
51+
file.close()
52+
elif ask=="n" or "no":
53+
exit(0)
54+
else:
55+
ask = "Please type y/n : "
56+
if ask=="y" or ask=="yes":
57+
print("Downloading....")
58+
elif ask=="n" or "no":
59+
exit(0)
60+
else:
61+
exit(0)
62+
try:
63+
open("scanner.py")
64+
except:
65+
print("[-] scanner.py not found [-]")
66+
ask = input("Do you want to download scanner.py? (y/n) ")
67+
if ask=="y" or ask=="yes":
68+
print("Downloading....")
69+
file_content = requests.get("https://raw.githubusercontent.com//shraddha761").text
70+
file = open("scanner.py", "w")
71+
file.write(file_content)
72+
print("File has been downloaded now rerun this program to proceed")
73+
file.close()
74+
exit(0)
75+
elif ask=="n" or "no":
76+
exit(0)
77+
else:
78+
ask = "Please type y/n : "
79+
if ask=="y" or ask=="yes":
80+
print("Downloading....")
81+
file_content = requests.get("https://raw.githubusercontent.com//shraddha761").text
82+
file = open("scanner.py", "w")
83+
file.write(file_content)
84+
print("File has been downloaded now rerun this program to proceed")
85+
file.close()
86+
exit(0)
87+
elif ask=="n" or "no":
88+
exit(0)
89+
else:
90+
exit(0)
91+
def verifyintsall():
92+
command = "echo true >> .verified.rc"
93+
os.system(command)
94+
print("The tool is now successfully installed!\nNow you can use the command rpcscan <websitelist> to find xmlrpc.php files.")
95+
96+
def install():
97+
command = "cp rpcscan.py /data/data/com.termux/files/usr/bin/rpcscan"
98+
try:
99+
os.system(command)
100+
except:
101+
print("Unable to setup the file.\nTry running this script as superuser.")
102+
sys.exit(1)
103+
command = "cp scanner.py /data/data/com.termux/files/usr/bin/rpcscanner"
104+
try:
105+
os.system(command)
106+
verifyintsall()
107+
except:
108+
print("Unable to setup the file.\nTry running this script as superuser.")
109+
sys.exit(1)
110+
install()

‎SCRIPTS.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,3 +98,4 @@
9898
| 64\. | RapidScan | The Multi-Tool Web Vulnerability Scanner | [Take me](./RapidScan)
9999
| 64\. | CredPhish | CredPhish is a PowerShell script designed to invoke credential prompts and exfiltrate passwords. | [Take me](./CredPhish)
100100
| 64\. | WebStor | This script is designed to perform reconnaissance and vulnerability assessment across websites within an organization's networks | [Take me](./WebStor)
101+
| 65\. | RPCScan | A python tool to automate all the efforts that you put on finding the xmlrpc | [Take me](./RPCScan)

0 commit comments

Comments
 (0)