Shoryuken v1.0 - very simple tool to takeover systems vulnerable to SQL Injections

imed at easy and fast hacking, shoryuken is a linux bash tool designed to get full control of poorly configurated web applications with backend DBMS in the same machine. In its current version, it uses SQL injection techniques to own MYSQL and MSSQL hosts when they run as OS user ROOT with application user having file privileges (Linux MySQL) or as DB sysadmin user with DB running as OS user SYSTEM (Windows MSSQL). It is done using the same unique HTTP request, the shoryuken (that means "rising dragon punch" in japanese).
Takeover is pretty straightforward with a single request issued to open a "custom shell" on Windows using xp_cmdshell output redirected to a file at default web server root (c:\inetpub\wwwroot) and on Linux using a PHP one line web shell with sudo also at default web server root (/var/www).
The custom shell is provided using default HTTP port 80 (it will be always there) without need to run or download anything and/or relying on firewall's policy.

Shoryuken needs curl installed (Debian-like systems: apt-get install curl).
Shoryuken only exploits SQL injection, you need to first find this kind of vulnerability on target using another tool or method.

Usage:

./shoryuken [OPTION] {TARGET | INPUT_FILE} {OUTPUT_FILE}

=> Rearrange target URL if needed to put vulnerable parameter always at the end.

Options:

-h help

-i interactive mode

-p direct punch

-t test mode

-l test from list

Examples:

./shoryuken -i

./shoryuken -p "192.168.0.2/test.asp?id=1"

./shoryuken -p "vuln-site.net/home/news.php?info=text&vuln_param=11230"

./shoryuken -t "www.example.com/page.php?name=john"

./shoryuken -l mytargets.txt results.txt"

Advantages:

- Very simple to use;

- Very small (just 8k) e portable;

- Can be easily used in tiny linux systems like mobile ones;

- Pwns MySQL and MSSQL systems at once;

- Doesn't need to download/upload anything to target;

- Doesn't need an extra open port on machine or firewall;

- Can be easily used when pivoting over linux machines;

- Minimum footprinting in Test Mode (1 request);

- Auto cleaning (except for logs);

- Impressive hacking to people that lacks hacking/security knowledge.

IMPORTANT: do not use this tool on servers where you don't have permission to do that.

download:

Code:

---

http://code.google.com/p/shoryuken/

---