Articles

Metasploit Framework Windows Tutorial
Remote Desktop Connection
Windows Processes That May Be Dangerous
How-To use NetCat a Tutorial
Common Linux Commands
Common Ports
Netcat Commands
HTTP Response Codes
War-Google Hack Terms
Wardriving
Avoiding Social Engineering and Phishing Attacks
Intrusion Detection on Linux
Linux Intrusion Detection
Penetration Testing Guide
Penetration Testing Tools
Social Engineering Fundamentals, Part I: Hacker Tactics
Social engineering (computer security)
The Psychology of Social Engineering

The Archives

General GSO
GovernmentSecurity.org News & Suggestions
In The News
Open Topic
General Security Information
Trash Can
Exploit & Vulnerability Mailing List Archives
Trial Member Forum
Product and Program Reviews GSO Tutorials
System Security
Windows Systems
Beginners Section
Linux & Unix Systems
File Downloads
Exploit Research & Discussion Trojan & Virus Errata
Networking Security / Firewall / IDS / VPN / Routers
System Hardening
E-Mail Security
Wifi Security
Trial Member Uploads
Upload discovered Trojans & Mal ware
GSO Programming Section
C , C++ , VC++
Visual Basic.NET
Perl /CGI
Java/Javascript
PHP/XML/ASP/HTML
Assembly + Other
The Cork Board
Network Security Consultant Directory
Network Security Jobs
The Archives
Encryption Information
General Network Security
Internet Anonymity
HTTP Protocol Security
Linux Security
MS IIS Information
Exploit Articles
Programming / Tool Design
GSO Software Projects
Public Downloads
Microsoft Security Questions and Papers

flashlord
checks an ip for phpmyadmin vuln... (coded by me)

CODE


#!perl
open( VULNFILE, ">>vuln.txt" );

#use strict;
use LWP::UserAgent;
use HTTP::Request;

$ua = new LWP::UserAgent;
$ua->timeout(2);
$ua->agent("Mozilla/6.0");

#Start and Filename input
print "Phpmyadmin Vuln Checker by flashlord\n";
print "hostfile: ";
$filename = <STDIN>;
chop($filename);
print VULNFILE "vuln test on ".$filename." started\n";
print VULNFILE "==================================\n";

close(VULNFILE);

#open file
open(FILEHANDLE,$filename);
@lines=<FILEHANDLE>;

#Count Ips
$linecount=@lines;
print $linecount." IPs found !\n";
$i=0;
while($i<$linecount){  
 
 $ip= pop(@lines);
 chop($ip);
 print "\n";
 $url = "http://".$ip."/phpmyadmin/main.php";  
 print $ip.": ".$url;
 $req = HTTP::Request->new('GET',$url);
 $res = $ua->request($req);
 $content= $res->content;
 if(($content =~ /Welcome/) && ($content =~ /root/)) {
   open( VULNFILE, ">>vuln.txt" );
   print VULNFILE $ip."\n";
   close(VULNFILE);
   print " -> VULNERABLE";
 }
 print "\n";
 $i=$i+1;
}



Well, i hope this works. Have phun
genxweb
QUOTE(flashlord @ Aug 9 2005, 02:55 PM)
checks an ip for phpmyadmin vuln... (coded by me)

CODE


#!perl
open( VULNFILE, ">>vuln.txt" );

#use strict;
use LWP::UserAgent;
use HTTP::Request;

$ua = new LWP::UserAgent;
$ua->timeout(2);
$ua->agent("Mozilla/6.0");

#Start and Filename input
print "Phpmyadmin Vuln Checker by flashlord\n";
print "hostfile: ";
$filename = <STDIN>;
chop($filename);
print VULNFILE "vuln test on ".$filename." started\n";
print VULNFILE "==================================\n";

close(VULNFILE);

#open file
open(FILEHANDLE,$filename);
@lines=<FILEHANDLE>;

#Count Ips
$linecount=@lines;
print $linecount." IPs found !\n";
$i=0;
while($i<$linecount){  
 
 $ip= pop(@lines);
 chop($ip);
 print "\n";
 $url = "http://".$ip."/phpmyadmin/main.php";  
 print $ip.": ".$url;
 $req = HTTP::Request->new('GET',$url);
 $res = $ua->request($req);
 $content= $res->content;
 if(($content =~ /Welcome/) && ($content =~ /root/)) {
   open( VULNFILE, ">>vuln.txt" );
   print VULNFILE $ip."\n";
   close(VULNFILE);
   print " -> VULNERABLE";
 }
 print "\n";
 $i=$i+1;
}



Well, i hope this works. Have phun
*




Code looks good I suggest that you include a link to the cert advisory about this so called vuln so people can see what your code is actually looking for. Also this code would not work on sites that have password protected phpmyadmin directories such as cpanel sites.
brOmstar
Think that one only checks for phpmyadmin with root permissions in the root directory of a webpage without pw protection.

CODE

if(($content =~ /Welcome/) && ($content =~ /root/)) {


this code checks for exactly that (sry german version)
===================================================
Willkommen bei phpMyAdmin 2.6.0-pl3 <---- willkommen = welcome in german
Verbunden mit MySQL 4.1.7-nt auf localhost als root@localhost <----- root
===================================================
That would allow control over the mysql database for inject for example user definded functions.


ps: Little hint add other languages for checking cause this one will only find english versions of phpmyadmin.
flashlord
phpmyadmin checks the users language. this perl code identifies itself as english, so it will always get "welcome to phpmyadmin"
brOmstar
So i missed something;) I'm not so good in perl how and where is this configured ?
flashlord
well, i don't know. Perhaps in the LWP or HTTP lib.
it's also possible that perl doesn't send any language information, so phpmyadmin uses englisch as default.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2005 Invision Power Services, Inc.