what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

RootPanel SQL Injection

RootPanel SQL Injection
Posted Jul 22, 2013
Authored by Akastep

RootPanel suffers from a remote SQL injection vulnerability that allows for account takeover.

tags | exploit, remote, sql injection
SHA-256 | 3b0a2b15e86e26905ee913231acbaecfa5ddc1f2eefcea4109cfc8734f8e8c13

RootPanel SQL Injection

Change Mirror Download
============================================================
RootPanel (All versions) SQL injection/Account takeover.
Discovery: AkaStep and CAMOUFL4G3
Vendor: http://www.rootpanel.ru/
============================================================
What is RootPanel ?
RootPanel is professional hosting billing system for your organisation and for your
internet-business.
It is usefull for hosting management things like:
/vps/vds/servers and for automate domain registrations/server/hosting management
and so on.
============================================================
Vulnerability details:
0x30

After looking into code we noticed that theris a lot fundamental dangerious some
"implementations" exists.

Fun begins with that developers didn't used mysql_real_escape_string() function.


//_rootfuncs.php

function htmlEncode($txt)
{
return htmlspecialchars($txt, ENT_QUOTES, "UTF-8");
}


So we can't use single quotes (') right?
Because they will be converted to:

' (single quote) =====> wil be converted to: '
" (double quote) =====> will be converted to: "

Also notice for first view we may think that we can't use backslash to break out an SQL query syntax and control it under our conditions.

DO WE RIGHT ABOUT stripslashes() ?
[ YES ] [ NO ] [ CANCEL ] [ VABSE DUR SIKDIR xD ]

http://php.net/manual/en/function.stripslashes.php


Here is what php manual says and does as needed:

==================================


Return Values

Returns a string with backslashes stripped off. (\' becomes ' and so on.)
Double backslashes (\\) are made into a single backslash (\).


==================================


So, as input we need pass double slashes ( \\ ) to gain access to an SQL query and correspondingly control it.



0x31 Account Takeover


No need to crack passwords...
No need waste your machines and your gold time...


Password retrieval functionality is your best Friend!
Here is how we gained immediate access to accounts of lamers and owned all of them.


//forgotpass.php
//SNIP//
//variable $nameemail is user input and it passed through htmlEncode() function.//

if ($do == 'request') {
if (!$nameemail) { $error = $_lang[ForgotErrorNameOrEmail]; $do='';}
else {
$r = @mysql_query("select * from users where login='$nameemail' or email='$nameemail'") or die("File: ".__FILE__."<BR>Line: ".__LINE__."<BR>MySQL Error: ".mysql_error());
if (mysql_num_rows($r) > 0) {
while ($rr = mysql_fetch_object($r))
{$forgotkey=generatePassword(15);

@mysql_query("update users set forgotkey='$forgotkey' where id='$rr->id'") or die("File: ".__FILE__."<BR>Line: ".__LINE__."<BR>MySQL Error: ".mysql_error());
$tpl=GetTpl('email_touser_forgot_password',$rr->lang);
$subject=$tpl[subject]; $template=$tpl[template];
if ($subject and $template) {$company_name=GetSetting('company_name');
$company_url=GetSetting('company_url');$support_email=GetSetting("support_email");
$support_url=GetSetting('support_url');

$subject = str_replace('{login}',$rr->login,$subject);
$template = str_replace('{company_name}',$company_name,$template);
$template = str_replace('{company_url}',$company_url,$template);
$template = str_replace('{support_url}',$support_url,$template);
$template = str_replace('{login}',$rr->login,$template);
$template = str_replace('{link}',$full_www_path."forgotpass.php?fkey=$forgotkey",$template);

// EOF SNIP //





0x32 Exploitation:

1 ) Whois interesting domain.Grab registrant mail addr.
2 ) Using sql injection grab login field's data (ur choise you can fetch mail too)
3 ) Travel to HOSTER.TLD/forgotpass.php and enter victim mail address.
Once you've submit "SEND" button new token (aka reset token) will be generated for victim account .
*Be carefull it also will be @mailed to victim mail address.*
4 ) Using sql injection grab token from database for victim account.
5 ) Travel to : HOSTER.TLD/forgotpass.php?fkey=APPEND_TOKEN_HERE
6 ) Set new password for lamer's account and sign in using login and new generated password.
7 ) Travel 1111

Below is one of real exploitation examples:
http://oi40.tinypic.com/2ceiwsp.jpg

NOTE 1: Avoid using error based way. In most cases it may create powerfull Denial Of service against hoster.
NOTE 2: Depending on software version column counts may vary.
Fix? 0day!

Anyways,Enjoy.


Random() notes:
0x6176616E65736F76 how are you baby? xD
Ala besdi plagiatla mesgul olduz blet!




=========================================
KUDOSSSSSSS
=========================================

packetstormsecurity.org
packetstormsecurity.com
packetstormsecurity.net
securityfocus.com
cxsecurity.com
security.nnov.ru
securtiyvulns.com
securitylab.ru
secunia.com
securityhome.eu
exploitsdownload.com
osvdb.com
websecurity.com.ua
1337day.com
itsecuritysolutions.org
waraxe.us
exploit-db.com
insecurety.net

Special respect to CAMOUFL4G3 && and to all
Azerbaijan Black hatz,Aa team && to All Turkish hackers.
=========================================


/AkaStep

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close